diff --git a/.custodian-brief.md b/.custodian-brief.md
index 3c3b787..af22ccb 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,16 @@
 # Custodian Brief — railiance-infra
 
 **Domain:** financials  
-**Last synced:** 2026-08-15 17:05 UTC  
+**Last synced:** 2026-08-15 18:56 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### New reefs do not get 80/443 until a substrate grant exists
+Progress: 0/1 done  |  workplan_id: `9eed7d88-27a5-4fbe-b405-2a40aae832f3`
+
+**Open tasks:**
+- · T01 — Fail-closed new-reef UFW  `f4cc01f8`
 
 ---
 ## MCP Orientation (when available)