diff --git a/.custodian-brief.md b/.custodian-brief.md
index e7e64e4..b50ad3c 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,28 +2,36 @@
 # Custodian Brief — the-custodian
 
 **Domain:** infotech  
-**Last synced:** 2026-09-24 08:02 UTC  
+**Last synced:** 2026-09-28 12:36 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
+### Agents cannot read secret values: separate agent and admin credentials
+Progress: 0/5 done  |  workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d`
+
+**Open tasks:**
+- ! Rotate what was exposed  `1b41b532`
+- ► Decide the identity model  `4781bb99`
+- ► Reject last-applied annotations on Secrets  `5abbfcae`
+- ► Fleet guidance and harness guards  `90725511`
+- · Build and hand out the agent identity  `4b88b0b7`
+
 ### Size Railiance workloads from actual demand and establish a weekly allocation review
 Progress: 1/5 done  |  workplan_id: `2249bddb-7524-5add-bd5c-c4163a6ca0f3`
 
 **Open tasks:**
-- ! Measure the Vergabe prototype under representative pilot use  `82192370`
-  *(wait: Await reliable measurements and the current invited-pilot deployment or an equivalent isolated fixture.)*
-- ! Review ecosystem allocations and reserve operating room  `6dc67558`
-  *(wait: Await reconciled demand evidence and a measured pilot recommendation.)*
 - ! Apply accepted sizing changes and verify their effects  `944f98e2`
   *(wait: Await reviewed allocation proposals and applicable workload-owner authority.)*
 - ! Establish the regular weekly workload-demand and allocation assessment  `20ddd4d7`
   *(wait: Await the repeatable observation and accepted sizing/review procedure.)*
+- ► Measure the Vergabe prototype under representative pilot use  `82192370`
+- ► Review ecosystem allocations and reserve operating room  `6dc67558`
 
 ## Inbox Hygiene
 
-**Stale unread:** 4 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 6 unread message(s) lack supersession chains.
+**Stale unread:** 13 message(s) older than 3 day(s) — triage at session start.
+**Missing thread_id:** 5 unread message(s) lack supersession chains.
 
 ---
 ## MCP Orientation (when available)