diff --git a/workplans/ZONE-WP-0001-security-zone-model.md b/workplans/ZONE-WP-0001-security-zone-model.md
index 54ea63a..e73bae5 100644
--- a/workplans/ZONE-WP-0001-security-zone-model.md
+++ b/workplans/ZONE-WP-0001-security-zone-model.md
@@ -11,6 +11,10 @@ planning_priority: P1
 created: "2026-08-19"
 updated: "2026-08-22"
 state_hub_workstream_id: "a75c8c9c-c108-4831-8d72-4343cce49879"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-08-22"
+quality_dod_by: codex
+quality_dod_note: "All tasks are done; canon is published, two owner declarations resolve successfully through a third repo, both consumer suites pass, live caller identity is re-proven, and the no-runtime decision is recorded."
 ---
 
 # ZONE-WP-0001 — The security zone model