diff --git a/workplans/KEY-WP-0038-forgejo-oidc-client.md b/workplans/KEY-WP-0038-forgejo-oidc-client.md
index 5c836a8..1121eb3 100644
--- a/workplans/KEY-WP-0038-forgejo-oidc-client.md
+++ b/workplans/KEY-WP-0038-forgejo-oidc-client.md
@@ -92,14 +92,24 @@ in the first two.
 ```task
 id: KEY-WP-0038-T02
 status: wait
-depends_on: [KEY-WP-0038-T01]
-blocking_reason: "Registration follows the accepted claim contract."
+depends_on: [KEY-WP-0038-T01, NK-WP-0048-T06]
+blocking_reason: "Registration runs as the first KnownSecurityCase of type oidc-browser-relying-party (NK-WP-0048-T06), not as a hand-built rollout."
 priority: high
 state_hub_task_id: "ddcfb482-8f33-5c81-9ce8-84be8fa5dc30"
 ```
 
 ### T02 — Register the client and hand over its secret
 
+**Changed 2026-10-08 (founder direction):** no case-specific helper script.
+Registration is the first case of the SecurityCaseType `oidc-browser-relying-party`
+(net-kingdom NK-WP-0048, canon `security-case-types_v0.1`). The parameters
+accepted in T01 become the case; ops-mason materializes it (MASON-WP-0010) and
+ops-warden follows through (WARDEN-WP-0044). key-cape's part is to declare
+client registration as a playbook capability that the type composes, and to
+review the type's composition.
+
+The original intent below still describes what must result.
+
 Register `forgejo` from the packet. Mint the client secret straight into custody
 (proposed OpenBao path `platform/workloads/forgejo/netkingdom-oidc-client`,
 custody owner railiance-platform, consumer Forgejo). Record a receipt with no