Classify open workplans with flavor (CUST-WP-0072).

Set flavor on open workplans from origin/prose/status. Copy existing
depends_on aliases only. Do not promote residuals.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

workplans/WARDEN-WP-0027-credential-governance-lockdown.md

@@ -5,6 +5,7 @@ title: "Tamper-resistant credential governance + mass rotation/lockdown (Strand
 domain: infotech
 repo: ops-warden
 status: active
+flavor: implementation
 owner: codex
 topic_slug: custodian
 planning_priority: medium

workplans/WARDEN-WP-0034-layer-model-v07-conformance.md

@@ -5,6 +5,9 @@ title: "Layer model v0.7 conformance — state the deadline, bind the agent boun
 domain: infotech
 repo: ops-warden
 status: active
+flavor: implementation
+depends_on:
+  - WARDEN-WP-0030
 owner: ops-warden
 topic_slug: netkingdom
 planning_priority: P1

workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md

@@ -5,6 +5,7 @@ title: "Repoint the whynot-design npm lane to Forgejo"
 domain: infotech
 repo: ops-warden
 status: active
+flavor: planning
 owner: codex
 topic_slug: whynot-design-forgejo-npm-lane
 created: "2026-09-04"

workplans/WARDEN-WP-0039-explicit-policy-refusal.md

@@ -5,6 +5,7 @@ title: "Preserve explicit policy caller refusals before credential and CA effect
 domain: infotech
 repo: ops-warden
 status: blocked
+flavor: residual
 owner: codex
 topic_slug: custodian
 created: "2026-09-08"
@@ -24,6 +25,7 @@ fail-open. Caller-auth rejection is an explicit refusal, not a transport outage.
 ```task
 id: WARDEN-WP-0039-T01
 status: done
+flavor: residual
 priority: high
 assignee: the-custodian
 state_hub_task_id: "eaad08d9-ae47-5f50-8278-ea402a0e2869"
@@ -39,6 +41,7 @@ both permissive and closed outage profiles and refusal before child execution.
 ```task
 id: WARDEN-WP-0039-T02
 status: done
+flavor: residual
 priority: high
 assignee: the-custodian
 state_hub_task_id: "ac85cf00-391c-5c63-b8f4-ed5bd57684e5"
@@ -58,6 +61,7 @@ Verify the installed module as well as the checkout before the live refusal test
 ```task
 id: WARDEN-WP-0039-T03
 status: wait
+flavor: residual
 priority: high
 assignee: the-custodian
 blocking_reason: "The configured ops-warden caller represents ops-warden; credential requests name their owner as resource.system. Need the flex-auth/credential-owner contract for that exact delegated read, without broadening caller bindings or relabelling resource ownership."

workplans/WARDEN-WP-0040-unknown-zone-fail-closed-adoption.md

@@ -5,6 +5,10 @@ title: "Adopt unknown -> fail_closed behind signing-target classification covera
 domain: infotech
 repo: ops-warden
 status: proposed
+flavor: planning
+depends_on:
+  - WARDEN-WP-0032
+  - WARDEN-WP-0034
 owner: ops-warden
 topic_slug: netkingdom
 planning_priority: P1