diff --git a/.custodian-brief.md b/.custodian-brief.md
index 5aa6879..4f3de41 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,21 +2,22 @@
 # Custodian Brief — railiance-forge
 
 **Domain:** financials  
-**Last synced:** 2026-08-25 17:58 UTC  
+**Last synced:** 2026-10-13 17:10 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Enforce secret detection independently in the forge receive path
+Progress: 1/3 done  |  workplan_id: `69458fdc-d727-5391-b88b-d03da0afe24e`
+
+**Open tasks:**
+- ► Admit the inventory and activate a reviewed server profile  `210e7935`
+- ► Verify CI independence, detection response and complete coverage  `e65f9093`
 
 ## Inbox Hygiene
 
-**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 1 unread message(s) lack supersession chains.
-
-## SCOPE Freshness
-
-- SCOPE.md says active but no open workplans remain — refresh Current State.
+**Stale unread:** 4 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 4 unread message(s) lack supersession chains.
 
 ---
 ## MCP Orientation (when available)
diff --git a/workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md b/workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md
index d5b79a4..11dd97d 100644
--- a/workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md
+++ b/workplans/FORGE-WP-0007-reuse-private-reader-contract-review.md
@@ -10,6 +10,7 @@ created: "2026-10-15"
 updated: "2026-10-15"
 flavor: planning
 depends_on: []
+state_hub_workstream_id: "4d26f0d3-8504-5a38-96d8-590efa0ae5dc"
 ---
 
 Review CCR-2026-0046 independently under railiance-forge INTENT Core Principles
@@ -24,6 +25,7 @@ credential authority. No hub task writes or integration commits occur here.
 id: FORGE-WP-0007-T01
 status: done
 priority: high
+state_hub_task_id: "0af25c12-5acf-56d2-ba2a-f2af70c2ab1d"
 ```
 
 Public unauthenticated target metadata reports Forgejo 11.0.3+gitea-1.22.0.
@@ -40,6 +42,7 @@ changes_requested. No authenticated target-state proof is claimed.
 id: FORGE-WP-0007-T02
 status: done
 priority: high
+state_hub_task_id: "ef53dca7-17d8-5354-b11b-c287ea87cb71"
 ```
 
 Review complete pagination and exact lifecycle recovery changes when platform