diff --git a/.custodian-brief.md b/.custodian-brief.md
index cfb7aa3..c55846a 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — railiance-platform
 
 **Domain:** financials  
-**Last synced:** 2026-09-21 17:20 UTC  
+**Last synced:** 2026-09-21 17:41 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -35,15 +35,11 @@ Progress: 2/8 done  |  workplan_id: `98140775-3b9a-5cf9-9af6-722502d487dc`
 - · Plan phase C: retire coulombcore's ArgoCD  `55d1382f`
 
 ### Move openbao-activity-core and openbao-email-connect off expired static tokens to Kubernetes auth
-Progress: 0/6 done  |  workplan_id: `0edc6426-9cc8-5bbe-88ea-c27d9862d96e`
+Progress: 4/6 done  |  workplan_id: `0edc6426-9cc8-5bbe-88ea-c27d9862d96e`
 
 **Open tasks:**
-- ! T01 OpenBao roles and policies (founder, admin credential)  `766ec8d9`
-- ! T03 Apply the ServiceAccounts and switch the two stores (founder go-ahead)  `ea84219a`
-- ! T04 Verify  `8416600e`
 - ! T05 Rollback (only if T03/T04 fails)  `6bccc229`
 - ! T06 Retire the two static-token Secrets  `f56d7096`
-- · T02 Confirm the declared manifests are the ones to apply  `27819462`
 
 ### Close Forgejo primary backup coverage on Scaleway
 Progress: 3/4 done  |  workplan_id: `7beec1a7-aa82-5a36-9a66-6b60008a2455`