diff --git a/.custodian-brief.md b/.custodian-brief.md
index 1825024..67466ca 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,18 @@
 # Custodian Brief — whitehat-security
 
 **Domain:** infotech  
-**Last synced:** 2026-09-01 18:29 UTC  
+**Last synced:** 2026-09-01 18:51 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Authorized live residuals after WHITEHAT-WP-0001
+Progress: 0/3 done  |  workplan_id: `fe26f070-70ca-55ba-92b3-3378929ba90f`
+
+**Open tasks:**
+- ! T01 — Live E3 against a runtime-safe surface  `ed82ecb5`
+- ! T02 — Live P1/P2 against a bounded substrate window  `f226b8e1`
+- ! T03 — Remaining E2 under new engagement IDs  `414a7f68`
 
 ---
 ## MCP Orientation (when available)