diff --git a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md
index 5f8057f..6bd0e8a 100644
--- a/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md
+++ b/workplans/RPF-WP-0054-keycape-client-secret-generate-lane.md
@@ -65,9 +65,8 @@ format, field or caller.
 
 ```task
 id: RPF-WP-0054-T02
-status: todo
+status: done
 priority: high
-needs_human: true
 state_hub_task_id: "4183abc4-4acc-5937-9f27-005feb181025"
 ```
 
@@ -95,6 +94,11 @@ plus the case-reference check make it visible.
 **Done when:** the founder records the choice here (and on a State Hub decision
 if one is opened).
 
+**Decision 2026-10-09 (founder): option A**, one templated create-only grant
+`keycape/client-secret-generate` with the broker-side case-ref and
+absence checks above. T04 implements it; per-case exact grants (B) are not
+built.
+
 ## T03 — Implement the broker generate operation
 
 ```task