diff --git a/project/roadmap.md b/project/roadmap.md
index d1ebeda..c4828f4 100644
--- a/project/roadmap.md
+++ b/project/roadmap.md
@@ -27,6 +27,7 @@ This document tracks the high-level goals and future development milestones for
 - [x] Implement `build_and_deploy_service` MCP tool.
 - [ ] Implement `get_project_status` and `append_project_task` MCP tools.
 
-## Phase 4: Autonomous Operation
-- [ ] Implement proactive project status reporting.
-- [ ] Develop agentic workflows for self-healing and automated deployment.
+## Phase 4: Data, Secret & CMEK Governance
+- [~] Transition secrets to GCP Secret Manager (staged, pending rotation config).
+- [ ] Enforce Customer-Managed Encryption Keys (CMEK) for Artifact Registry, Storage Buckets, and Cloud Run.
+- [ ] Configure BigQuery real-time audit log streaming and setup `query_tyr_audit` MCP tool.
diff --git a/tyr/memory_bank/completed.md b/tyr/memory_bank/completed.md
index 3cb51e0..f4ea337 100644
--- a/tyr/memory_bank/completed.md
+++ b/tyr/memory_bank/completed.md
@@ -35,3 +35,7 @@
 - **Phase 3: Workload Security**
   - Status: **Complete**
   - Notes: Created SPIFFE workload entry for Ollama, completing the foundational step for mTLS.
+
+- **Task 4.1: Create Auto-Rotating Secret**
+  - Status: **Staged**
+  - Notes: Secret `tyr-api-credentials` created, but auto-rotation could not be configured via gcloud.