diff --git a/.custodian-brief.md b/.custodian-brief.md
index ee9e27c..c5c4062 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,11 +2,19 @@
 # Custodian Brief — secrets-engine
 
 **Domain:** infotech  
-**Last synced:** 2026-10-10 08:20 UTC  
+**Last synced:** 2026-10-11 12:21 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Design and prove task-scoped protected OpenBao execution
+Progress: 0/3 done  |  workplan_id: `5e38aecc-85ca-5f55-94c6-9fbb08604819`
+
+**Open tasks:**
+- ! Implement and prove one native metadata action  `5f8f7c41`
+- ► Define the exact mediated execution contract  `b2f0d462`
+- ► Prevent consumption without execution readiness  `4ad61917`
+
 ### Activate native Claude credential delivery for Glas
 Progress: 2/3 done  |  workplan_id: `40ccc3b4-d046-5a58-8649-e7935f45c974`