diff --git a/.custodian-brief.md b/.custodian-brief.md
index fdd6c45..f13a43f 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,32 +2,11 @@
 # Custodian Brief — secrets-engine
 
 **Domain:** infotech  
-**Last synced:** 2026-10-09 17:20 UTC  
+**Last synced:** 2026-10-09 17:54 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### KeyCape secrets-engine-openbao consumer custody acceptance
-Progress: 3/4 done  |  workplan_id: `143de42b-b568-5070-add0-d5e71eabd436`
-
-**Open tasks:**
-- ! Attended consumer-copy delivery  `1c3afd34`
-  *(wait: All upstream objects are live: CCR-2026-0033 applied, KeyCape registration live (KEY-WP-0037), CCR-2026-0038 JWT mount keycape-services / role secrets-engine-openbao applied 2026-10-08 (railiance-platform 1b36e14). Founder writes the non-secret local login contract file and runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md.)*
-
-### Production-safe provisioning, authorization, and lifecycle hardening
-Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
-
-**Open tasks:**
-- ! Resume native production lane adoption  `a0a1dd92`
-  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
-
-### Evolve the Lifecycle engine to the accepted security layer model
-Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
-
-**Open tasks:**
-- ! No standing engine credential  `d7bc8bdc`
-  *(wait: RPF-WP-0035-T02 awaits coordinated platform-tenant live registration, credential custody and scoped attended JWT role provisioning with native login/negative/revocation proof. The historical env-auth acceptance is not service-JWT adoption.)*
-
 ### Activate native Claude credential delivery for Glas
 Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`
 
@@ -44,6 +23,27 @@ Progress: 4/6 done  |  workplan_id: `31f7f8ea-7f73-516c-8877-f03a13f1db82`
 - ! Reconcile routing ownership and retire interim proxies  `1431edae`
   *(wait: Needs owner-agreed routing/proxy retirement for each verified lane and custody disposition of the legacy npm pointer; a single approved OpenRouter key-check does not authorize broader routing cutover.)*
 
+### Production-safe provisioning, authorization, and lifecycle hardening
+Progress: 6/7 done  |  workplan_id: `68a39be1-bd9c-5133-ad64-e7bca892aaf3`
+
+**Open tasks:**
+- ! Resume native production lane adoption  `a0a1dd92`
+  *(wait: Engine approval hardening is complete. Remaining per-lane cutover includes native routing/proxy retirement with ops-warden under SECRETS-WP-0006-T05/T06; the exact OpenRouter key-check receipt does not establish broader recipient readiness.)*
+
+### Evolve the Lifecycle engine to the accepted security layer model
+Progress: 5/6 done  |  workplan_id: `9c9e5164-b2f5-5ea2-a557-5368d65e9fe0`
+
+**Open tasks:**
+- ! No standing engine credential  `d7bc8bdc`
+  *(wait: RPF-WP-0035-T02 awaits coordinated platform-tenant live registration, credential custody and scoped attended JWT role provisioning with native login/negative/revocation proof. The historical env-auth acceptance is not service-JWT adoption.)*
+
+### KeyCape secrets-engine-openbao consumer custody acceptance
+Progress: 3/4 done  |  workplan_id: `143de42b-b568-5070-add0-d5e71eabd436`
+
+**Open tasks:**
+- ! Attended consumer-copy delivery  `1c3afd34`
+  *(wait: All upstream objects are live: CCR-2026-0033 applied, KeyCape registration live (KEY-WP-0037), CCR-2026-0038 JWT mount keycape-services / role secrets-engine-openbao applied 2026-10-08 (railiance-platform 1b36e14). Founder writes the non-secret local login contract file and runs the attended probe-openbao command in docs/keycape-openbao-consumer-custody.md.)*
+
 ## Inbox Hygiene
 
 **Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.