diff --git a/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md b/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
index aa0ab44..37d4ac4 100644
--- a/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
+++ b/workplans/KEY-WP-0012-userinfo-canonical-subject-resolution.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Repair UserInfo canonical subject resolution"
 domain: infotech
 repo: key-cape
-status: active
+status: finished
 owner: codex
 topic_slug: userinfo-canonical-subject-resolution
 created: "2026-08-31"
-updated: "2026-08-31"
+updated: "2026-09-01"
 ---
 
 ## Repair subject lookup
@@ -38,9 +38,16 @@ behavior. Run the KeyCape test suite and image build checks.
 
 ```task
 id: KEY-WP-0012-T03
-status: progress
+status: done
 priority: high
 ```
 
 Publish and deploy the corrected KeyCape image, prove `/userinfo` accepts a
 fresh human access token, then resume the governed Policy Nexus bootstrap.
+
+Completed 2026-09-01. Forgejo Actions run 14 built commit
+`153258b9d39273d53ca7ab5d1bdc09961ea9026e`; image digest
+`sha256:4c7193efc3e50bd72a01812a583e823cc04f41ca96ef387b31ba9ae2533b80d0`
+rolled out successfully. A fresh OpenBao OIDC flow passed `/userinfo`, and the
+governed Policy Nexus bootstrap subsequently completed with deterministic
+session revocation.