diff --git a/.custodian-brief.md b/.custodian-brief.md
index b50ad3c..27f8f62 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,17 +2,16 @@
 # Custodian Brief — the-custodian
 
 **Domain:** infotech  
-**Last synced:** 2026-09-28 12:36 UTC  
+**Last synced:** 2026-09-28 12:44 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Agents cannot read secret values: separate agent and admin credentials
-Progress: 0/5 done  |  workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d`
+### Separate agent credentials and establish supervised privileged execution
+Progress: 1/5 done  |  workplan_id: `a98a9f34-83b4-5c8c-8107-e05f7806d50d`
 
 **Open tasks:**
 - ! Rotate what was exposed  `1b41b532`
-- ► Decide the identity model  `4781bb99`
 - ► Reject last-applied annotations on Secrets  `5abbfcae`
 - ► Fleet guidance and harness guards  `90725511`
 - · Build and hand out the agent identity  `4b88b0b7`