diff --git a/workplans/KEY-WP-0038-forgejo-oidc-client.md b/workplans/KEY-WP-0038-forgejo-oidc-client.md
index 8cb7c00..ea89b6f 100644
--- a/workplans/KEY-WP-0038-forgejo-oidc-client.md
+++ b/workplans/KEY-WP-0038-forgejo-oidc-client.md
@@ -119,6 +119,17 @@ secret value.
 Acceptance: discovery metadata lists the client's redirect URI. The secret is
 readable by Forgejo's custody path only.
 
+2026-10-10: key-cape reviewed the type's composition
+(`docs/oidc-browser-relying-party-type-review.md`). net-kingdom fixed the findings
+in `61ab6bc`, a 1.0 patch: redirects with `?` or `#` refused, the groups scope
+required, and descriptions corrected. A new 1.1 (`e2174ce`, founder go) adds the
+`consumer-enforces-groups` verification. For Forgejo, that is the required-claim
+setting railiance-apps configures. `security-cases/forgejo-netkingdom-oidc.yaml`
+is re-pinned to @1.1, with parameters unchanged. KeyCape added `keycape
+check-config` (`c528daa`), which register-client runs before the restart. T02 still
+waits on NK-WP-0048-T06, which needs both executors' light paths (MASON-WP-0010-T03,
+WARDEN-WP-0044-T03).
+
 ```task
 id: KEY-WP-0038-T03
 status: wait