diff --git a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
index a111c31..8b1a634 100644
--- a/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
+++ b/workplans/WARDEN-WP-0027-credential-governance-lockdown.md
@@ -5,6 +5,7 @@ title: "Tamper-resistant credential governance + mass rotation/lockdown (Strand
 domain: infotech
 repo: ops-warden
 status: active
+flavor: implementation
 owner: codex
 topic_slug: custodian
 planning_priority: medium
diff --git a/workplans/WARDEN-WP-0034-layer-model-v07-conformance.md b/workplans/WARDEN-WP-0034-layer-model-v07-conformance.md
index 81a8f19..834cd89 100644
--- a/workplans/WARDEN-WP-0034-layer-model-v07-conformance.md
+++ b/workplans/WARDEN-WP-0034-layer-model-v07-conformance.md
@@ -5,6 +5,9 @@ title: "Layer model v0.7 conformance — state the deadline, bind the agent boun
 domain: infotech
 repo: ops-warden
 status: active
+flavor: implementation
+depends_on:
+  - WARDEN-WP-0030
 owner: ops-warden
 topic_slug: netkingdom
 planning_priority: P1
diff --git a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
index 38a4d5b..31d06d8 100644
--- a/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
+++ b/workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md
@@ -5,6 +5,7 @@ title: "Repoint the whynot-design npm lane to Forgejo"
 domain: infotech
 repo: ops-warden
 status: active
+flavor: planning
 owner: codex
 topic_slug: whynot-design-forgejo-npm-lane
 created: "2026-09-04"
diff --git a/workplans/WARDEN-WP-0039-explicit-policy-refusal.md b/workplans/WARDEN-WP-0039-explicit-policy-refusal.md
index 5476108..54d3528 100644
--- a/workplans/WARDEN-WP-0039-explicit-policy-refusal.md
+++ b/workplans/WARDEN-WP-0039-explicit-policy-refusal.md
@@ -5,6 +5,7 @@ title: "Preserve explicit policy caller refusals before credential and CA effect
 domain: infotech
 repo: ops-warden
 status: blocked
+flavor: residual
 owner: codex
 topic_slug: custodian
 created: "2026-09-08"
@@ -24,6 +25,7 @@ fail-open. Caller-auth rejection is an explicit refusal, not a transport outage.
 ```task
 id: WARDEN-WP-0039-T01
 status: done
+flavor: residual
 priority: high
 assignee: the-custodian
 state_hub_task_id: "eaad08d9-ae47-5f50-8278-ea402a0e2869"
@@ -39,6 +41,7 @@ both permissive and closed outage profiles and refusal before child execution.
 ```task
 id: WARDEN-WP-0039-T02
 status: done
+flavor: residual
 priority: high
 assignee: the-custodian
 state_hub_task_id: "ac85cf00-391c-5c63-b8f4-ed5bd57684e5"
@@ -58,6 +61,7 @@ Verify the installed module as well as the checkout before the live refusal test
 ```task
 id: WARDEN-WP-0039-T03
 status: wait
+flavor: residual
 priority: high
 assignee: the-custodian
 blocking_reason: "The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership."
diff --git a/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md b/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md
index d7b3601..79b1a54 100644
--- a/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md
+++ b/workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md
@@ -5,6 +5,10 @@ title: "Adopt unknown -> fail_closed behind signing-target classification covera
 domain: infotech
 repo: ops-warden
 status: proposed
+flavor: planning
+depends_on:
+  - WARDEN-WP-0032
+  - WARDEN-WP-0034
 owner: ops-warden
 topic_slug: netkingdom
 planning_priority: P1