diff --git a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
index 12aa4ec..c14e9c3 100644
--- a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
+++ b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
@@ -89,14 +89,14 @@ each verified capabilities-safe, taint cleared only on success.
 
 ```task
 id: WARDEN-WP-0027-T02
-status: wait
-needs_human: true
+status: todo
 decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
-blocking_reason: "Trust-root design is a founder decision: who holds unseal shares and recovery keys, quorum, break-glass invocation; executable seal steps are attended."
 priority: medium
 state_hub_task_id: "cae498ee-6307-5d32-9f1b-a471cfcc2536"
 ```
 
+2026-10-11: requalified after founder decision D3 (trust root, build-mode default) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
+
 Design and document a graded lockdown: (a) soft — deny agent roles read on all
 high-risk lanes; (b) hard — seal + re-key with a pre-designed trust-root and quorum.
 Define the trust-root (who holds unseal shares, recovery keys), the break-glass
diff --git a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
index 17e6c0f..a3eba2d 100644
--- a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
+++ b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
@@ -60,14 +60,15 @@ from returning.
 id: WARDEN-WP-0037-T03
 status: wait
 priority: high
-needs_human: true
 decision_id: 1591daa1-6e85-4dfd-aadd-5a9fe1ef47fa
 depends_on: [SECRETS-WP-0006-T06]
-blocking_reason: "Founder HOLD 2026-09-21: no rotation until SECRETS-WP-0006-T06 moves the publish lane off the legacy whynot-design npm path; then rotate and prove a fresh publish."
+blocking_reason: "Hold kept by D3 until SECRETS-WP-0006-T06 moves publishing off the legacy whynot-design npm path; then rotate and prove a fresh publish."
 intervention_note: "HOLD (founder, 2026-09-21): do not rotate yet. secrets-engine exec reads the ungoverned legacy path secret/coulomb/whynot-design/npm/publish (field npm_token); this runbook writes the governed path platform/workloads/coulomb/whynot-design/npm-publish (NPM_AUTH_TOKEN). A rotation now would not reach the live publish path. Resume after SECRETS-WP-0006-T06 moves the lane. Then: rotate the dedicated Forgejo package token, and prove a fresh publish and exact npm view through this lane."
 state_hub_task_id: "a8b1b855-ab34-5835-b9fd-5f48bc0b6817"
 ```
 
+2026-10-11: requalified after founder decision D3 (trust root, build-mode default) resolved — see the-custodian docs/decisions/2026-10-11-security-unblock-decisions.md.
+
 Pass catalog and routing tests, verify the checkout route, and record the exact
 Forgejo package release proven through the lane.