From 7e71c0c8371541f27dc7d0fd2667241ba312e758 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Wed, 22 Jul 2026 00:33:34 +0200
Subject: [PATCH] chore: hub IDs for ACTIVITY-WP-0025 after fix-consistency

---
 WORK-RECORDS.md                                 | 9 +++++++++
 workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md | 9 +++++++++
 2 files changed, 18 insertions(+)

diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index e7905e4..e50f8f0 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -28,6 +28,7 @@
 | workplan | ACTIVITY-WP-0022 | finished | — | workplans/ACTIVITY-WP-0022-issuesink-no-default-forgejo.md |
 | workplan | ACTIVITY-WP-0023 | finished | — | workplans/ACTIVITY-WP-0023-intent-scope-gap-closure.md |
 | workplan | ACTIVITY-WP-0024 | finished | — | workplans/ACTIVITY-WP-0024-operator-automation-console.md |
+| workplan | ACTIVITY-WP-0025 | proposed | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | workplan | ADHOC-2026-06-01 | finished | — | workplans/ADHOC-2026-06-01.md |
 | workplan | custodian-WP-0001 | done | — | workplans/custodian-WP-0001-temporal-backbone.md |
 | workplan | custodian-WP-0002 | done | — | workplans/custodian-WP-0002-triggers-ops.md |
@@ -142,6 +143,14 @@
 | task | ACTIVITY-WP-0024-T07 | done | — | workplans/ACTIVITY-WP-0024-operator-automation-console.md |
 | task | ACTIVITY-WP-0024-T08 | done | — | workplans/ACTIVITY-WP-0024-operator-automation-console.md |
 | task | ACTIVITY-WP-0024-T09 | done | — | workplans/ACTIVITY-WP-0024-operator-automation-console.md |
+| task | ACTIVITY-WP-0025-T01 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T02 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T03 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T04 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T05 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T06 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T07 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
+| task | ACTIVITY-WP-0025-T08 | todo | — | workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md |
 | task | ADHOC-2026-06-01-T01 | done | — | workplans/ADHOC-2026-06-01.md |
 | task | ADHOC-2026-06-01-T02 | done | — | workplans/ADHOC-2026-06-01.md |
 | task | ADHOC-2026-06-01-T03 | done | — | workplans/ADHOC-2026-06-01.md |
diff --git a/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md b/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
index 03ee24e..dbfc6b0 100644
--- a/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
+++ b/workplans/ACTIVITY-WP-0025-ops-ui-sso-access.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: activity-core
 created: "2026-07-22"
 updated: "2026-07-22"
+state_hub_workstream_id: "c4e48358-df12-4bf4-9916-0e93f05f5fcf"
 ---
 
 # SSO access control for ops console and Temporal UI
@@ -82,6 +83,7 @@ git or State Hub.
 id: ACTIVITY-WP-0025-T01
 status: todo
 priority: high
+state_hub_task_id: "de28ac08-cae5-476b-b093-82fcf8e3fa5e"
 ```
 
 1. Document intended audience (founders / operators), MFA expectation, and
@@ -100,6 +102,7 @@ hostnames and IdP group named.
 id: ACTIVITY-WP-0025-T02
 status: todo
 priority: high
+state_hub_task_id: "650db102-ad4e-4d8e-86c1-eee50f5bafcc"
 ```
 
 1. Find an existing oauth2-proxy / OIDC ingress pattern on railiance01 or
@@ -115,6 +118,7 @@ priority: high
 id: ACTIVITY-WP-0025-T03
 status: todo
 priority: high
+state_hub_task_id: "7084f7d5-4181-4dfa-b239-0dad15efbae9"
 ```
 
 1. Add Ingress (or Gateway) for `actcore-api` serving at least `/ops` and
@@ -132,6 +136,7 @@ port-forward; unauthorized gets login or 403.
 id: ACTIVITY-WP-0025-T04
 status: todo
 priority: high
+state_hub_task_id: "99b36f31-eb19-4f96-b3f1-9ac1ab02d78f"
 ```
 
 1. Expose `actcore-temporal-ui` behind the same auth edge (hostname or path).
@@ -148,6 +153,7 @@ port-forward, under SSO.
 id: ACTIVITY-WP-0025-T05
 status: todo
 priority: high
+state_hub_task_id: "77fff202-bfb6-49eb-b8e5-3760abacc8bd"
 ```
 
 1. Accept trusted identity from the auth edge (e.g. `X-Forwarded-User` /
@@ -166,6 +172,7 @@ token not required for normal operator use.
 id: ACTIVITY-WP-0025-T06
 status: todo
 priority: medium
+state_hub_task_id: "b14e1f2c-1320-4218-8bd3-2a309295a69c"
 ```
 
 1. Register OIDC client(s) via key-cape / netkingdom process (not ad-hoc).
@@ -181,6 +188,7 @@ account.
 id: ACTIVITY-WP-0025-T07
 status: todo
 priority: medium
+state_hub_task_id: "c5945e64-c460-4830-a19e-a944bb44a67e"
 ```
 
 1. Runbook: primary access = SSO URLs; port-forward = break-glass only.
@@ -195,6 +203,7 @@ priority: medium
 id: ACTIVITY-WP-0025-T08
 status: todo
 priority: medium
+state_hub_task_id: "f73eafbf-ad11-4d7d-b89e-e910c662ce86"
 ```
 
 1. Confirm ClusterIP APIs without Ingress path remain not publicly reachable.