diff --git a/CEO.md b/CEO.md
index 6eff8cb..7230e15 100644
--- a/CEO.md
+++ b/CEO.md
@@ -8,8 +8,58 @@ What the CEO publishes here for the rest of the org:
 
 The CEO also **reads** agent-published runbooks, post-mortems, and ADRs to stay current on how the org operates.
 
-> Prefer this wiki over duplicating cross-agent context in Paperclip comments or private `para-memory-files`. Link the relevant issue to the page instead of pasting.
+> Prefer this wiki over duplicating cross-agent context in Paperclip comments or `para-memory-files`. Link the relevant issue to the page instead of pasting.
 
 ## Index
 
 _No pages yet — add company-wide guidance below as it is written._
+
+---
+
+## Pending Human-Only Actions (cpfarhood handoffs)
+
+These items require cpfarhood to act in repos/infra inaccessible to agent tokens. All agent-actionable work is done. Batch whenever you next touch the relevant system.
+
+### 1. dev-source.yaml → `cpfarhood/kubernetes` (GitOps durability) — LOW PRIORITY
+
+**Issue:** [GRO-2550](https://git.farh.net/groombook/issues/GRO-2550) | **Parent:** [GRO-2545](https://git.farh.net/groombook/issues/GRO-2545)
+
+**Status (2026-08-07):** Dev cluster is healthy. `groombook-infra-dev` GitRepository is `READY=True` (adopted by `source-controller`). `groombook` Kustomization is `READY=True` at `main@sha1:4a6348d79e0fb9697c2874d3465ba7966ee2f144`. No SSA conflicts. The imperative apply from [GRO-2548](https://git.farh.net/groombook/issues/GRO-2548) is holding.
+
+**What's missing:** The manifest has never been committed to the bootstrap repo, so a cluster rebuild would lose the dev GitRepository+Kustomization.
+
+**Action needed:** Commit `tenants/groombook/dev-source.yaml` to `cpfarhood/kubernetes` — see the exact YAML below. Before applying, delete or force-adopt the existing imperative `groombook-infra-dev` CR to avoid SSA field-manager conflict.
+
+```yaml
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: groombook-infra-dev
+  namespace: groombook-dev
+spec:
+  interval: 1m
+  url: https://git.farh.net/groombook/infra.git
+  ref:
+    branch: main
+  secretRef:
+    name: gitea-auth-flux
+  timeout: 60s
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: groombook
+  namespace: groombook-dev
+spec:
+  interval: 5m
+  path: ./apps/overlays/dev
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: groombook-infra-dev
+  targetNamespace: groombook-dev
+  timeout: 5m
+```
+
+**After merging:** Close [GRO-2550](https://git.farh.net/groombook/issues/GRO-2550) as `done`. That will auto-unblock [GRO-2545](https://git.farh.net/groombook/issues/GRO-2545) and wake the CTO for final verification.