diff --git a/workplans/KEY-WP-0041-sign-in-diagnosis-page.md b/workplans/KEY-WP-0041-sign-in-diagnosis-page.md
new file mode 100644
index 0000000..147c6c9
--- /dev/null
+++ b/workplans/KEY-WP-0041-sign-in-diagnosis-page.md
@@ -0,0 +1,54 @@
+---
+id: KEY-WP-0041
+type: workplan
+title: "Sign-in diagnosis page and auth log uid (NK-WP-0051-T02)"
+domain: infotech
+repo: key-cape
+status: active
+owner: claude-code
+topic_slug: netkingdom
+created: "2026-10-14"
+updated: "2026-10-14"
+flavor: implementation
+depends_on: []
+---
+
+Demand: NetKingdom `NK-WP-0051-T02`. The field names (`uid`, `groups`,
+`assurance`, `client_id`) and the never-show/never-log list come only from
+`net-kingdom/docs/sign-in-diagnosis.md`; this workplan does not restate them.
+
+## Opt-in pre-redirect page and auth log fields
+
+```task
+id: KEY-WP-0041-T01
+status: done
+priority: high
+```
+
+- Client registration flag `signInDiagnosis` (default false) in the YAML
+  config, `domain.Client` and `spec/canonical-model.yaml`.
+- With the flag on, `/authorize/callback` renders a page before the redirect
+  with `uid`, sorted `groups`, `assurance` and `client_id`, one continue link
+  to the unchanged redirect (code + state), and a sign-out hint. html/template
+  escaping, `no-store`, `Referrer-Policy: no-referrer`, restrictive CSP.
+- `assurance` is `aal2` only when this request verified a one-time code; a
+  reused aal2 session is `aal1` (contract wording, stricter than the session
+  satisfied `MFAVerified`).
+- The `auth_success` log line gains `uid` and `assurance` beside `client_id`.
+- Enabled for `openbao-admin` in `config/dev-config.yaml`; the live flag is set
+  in `sso/keycape-config` (see `docs/operations.md`).
+- Tests: `src/internal/server/oidc/signin_diagnosis_test.go`.
+
+## Deploy the image and record its digest
+
+```task
+id: KEY-WP-0041-T02
+status: todo
+priority: high
+```
+
+Build and push with `make push IMAGE_TAG=<sha>`, set `signInDiagnosis: true`
+on the OpenBao browser client in `sso/keycape-config`, roll the issuer under
+the usual live-change approval, and send the digest to net-kingdom for the
+evidence table in `docs/sign-in-diagnosis.md`. Not done by the implementing
+session: deployment needs operator approval.