diff --git a/.custodian-brief.md b/.custodian-brief.md
index de13ba0..bc47c1f 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-20 22:55 UTC  
+**Last synced:** 2026-10-20 22:59 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,7 +12,7 @@ Progress: 2/3 done  |  workplan_id: `23c7bcf5-5f5d-524f-a06e-be5247ae1a98`
 
 **Open tasks:**
 - ! Review, publish and verify deployed consumer  `789bb918`
-  *(wait: Execution of approved credential provisioning and platform/apps image rollout)*
+  *(wait: Approved rollout requested from railiance-apps (msg f8f142bc); prerequisite: operator creates reuse-surface-reader bot + PAT in OpenBao)*
 
 ---
 ## MCP Orientation (when available)
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index f6222ee..fa5d890 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -2060,8 +2060,10 @@ capabilities:
   source_index: ../ops-warden/registry/indexes/capabilities.yaml
 - id: capability.security.credential-lifecycle
   name: Cataloged credential lifecycle
-  summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
-    delivery and revoke.
+  summary: Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan,
+    exact metadata apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file),
+    wrapped handoff, rotate, revoke and lifecycle, with founder-signed trust admission
+    and a local evidence outbox.
   domain: infotech
   status: draft
   owner: secrets-engine