.custodian-brief.md

@@ -2,15 +2,16 @@
 # Custodian Brief — railiance-master
 
 **Domain:** financials  
-**Last synced:** 2026-08-03 18:35 UTC  
+**Last synced:** 2026-08-03 16:46 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
 ### Migrate authoritative OpenBao from CoulombCore to reef-railiance
-Progress: 3/8 done  |  workplan_id: `0616a297-18c5-4c4e-a4fc-69135b3f9a15`
+Progress: 2/8 done  |  workplan_id: `0616a297-18c5-4c4e-a4fc-69135b3f9a15`
 
 **Open tasks:**
+- ! T03 - Prove backup and isolated restore before cutover  `88671108`
 - ! T04 - Restore authoritative state on railiance01  `d04d7fdd`
 - ! T05 - Migrate consumers to local workload identity  `f0a82e4e`
 - ! T06 - Cut over public OpenBao DNS and operator access  `f458d110`

workplans/RAILIANCE-WP-0020-openbao-migration-to-reef-railiance.md

@@ -90,7 +90,7 @@ was aligned to OpenBao 2.5.4, matching the source.
 
 ```task
 id: RAILIANCE-WP-0020-T03
-status: done
+status: wait
 priority: high
 state_hub_task_id: "88671108-cf8c-4de6-b1ce-06e99b1c3d70"
 ```
@@ -112,13 +112,6 @@ Shamir barrier. The remaining semantic and repeated restart/unseal proof needs
 two of the three existing source shares through the attended custody ceremony;
 no supported automated custody route exposes those shares.
 
-Completed 2026-08-03. The operator supplied two rotated shares through hidden
-prompts. Two restart/unseal cycles passed. The restored cluster became active
-with the source cluster ID; inventory counts matched; the existing scoped Qonto
-AppRole proved exact-path `read` and sibling `deny`; and declarative file audit
-output was non-empty. Machine-readable evidence is in
-`docs/evidence/openbao-isolated-restore-2026-08-03.json`.
-
 ## T04 - Restore authoritative state on railiance01
 
 ```task