# WORKING.md — Active Session Tracker

Agent work only. User actions (deploy, review, UAT) are NOT tracked here.
The human decides when the work is "done".

## Current Tasks

- [ ] Add update_item() to bw_helper.py (root cause of credential deletion)
- [ ] Fix --enable-2fa to update item in place, never create duplicates
- [ ] Add duplicate-prevention safeguard to create_item()
- [ ] Write credential lifecycle tests (create, read, update, never delete)
- [ ] Verify 2FA is enabled and working end-to-end
- [ ] Update STATUS.md