diff --git a/.custodian-brief.md b/.custodian-brief.md
index 1e39cf6..b98a1d8 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-infra
 
 **Domain:** financials  
-**Last synced:** 2026-08-11 12:45 UTC  
+**Last synced:** 2026-08-11 22:02 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -15,6 +15,15 @@ Progress: 0/3 done  |  workplan_id: `7122657f-87c8-46b5-a725-a1af1ba0af12`
 - · T02 — Publish host capacity and utilization evidence  `8b0e5547`
 - · T03 — Record infrastructure operations labor and exit inputs  `8bdaa96f`
 
+### Firewall declared-state integrity and k3s API exposure
+Progress: 1/5 done  |  workplan_id: `ebf3c8d1-9066-4f13-a2d5-1da0409f2162`
+
+**Open tasks:**
+- · Tasks  `7d91dfc2`
+- · Tasks  `3e835b96`
+- · Tasks  `908630e8`
+- · Tasks  `81af8470`
+
 ---
 ## MCP Orientation (when available)