diff --git a/workplans/AUDIT-WP-0010-tenant-engine-sender-admission.md b/workplans/AUDIT-WP-0010-tenant-engine-sender-admission.md
index e8e07ff..ed44dc8 100644
--- a/workplans/AUDIT-WP-0010-tenant-engine-sender-admission.md
+++ b/workplans/AUDIT-WP-0010-tenant-engine-sender-admission.md
@@ -11,6 +11,7 @@ created: "2026-08-29"
 updated: "2026-08-29"
 depends_on:
   - AUDIT-WP-0005
+state_hub_workstream_id: "54655357-74da-5f7f-8fa6-647d4c969f21"
 ---
 
 # AUDIT-WP-0010 — Admit tenant-engine as an attributive sender
@@ -50,6 +51,7 @@ validated, not when events start arriving.
 id: AUDIT-WP-0010-T01
 status: todo
 priority: high
+state_hub_task_id: "e26170e3-78f1-5d98-bb8f-46cef32244bb"
 ```
 Register the sender identity: name `tenant-engine`, `sources: [tenant-engine]`,
 `may_write: true`, `may_read: false`, `secret_policy: redact`, tenants scoped as
@@ -61,6 +63,7 @@ value in Git — projected only, per the established lane.
 id: AUDIT-WP-0010-T02
 status: todo
 priority: high
+state_hub_task_id: "13855bd9-4ff4-5e8c-ab98-d5ff45103d22"
 ```
 Provide the token lane. Coordinate the projected credential with the owning
 credential operator through the `ops-warden` route, matching the custody pattern
@@ -71,6 +74,7 @@ transport a value through State Hub messages.
 id: AUDIT-WP-0010-T03
 status: todo
 priority: high
+state_hub_task_id: "1a75fba2-a625-5e87-bba9-e38f010856fc"
 ```
 Extend the NetworkPolicy. `deploy/networkpolicies.yaml` currently admits
 `user-engine`; add `tenant-engine`. `tests/test_networkpolicies.py` exists —
@@ -81,6 +85,7 @@ third sender fails the test rather than silently failing in production.
 id: AUDIT-WP-0010-T04
 status: todo
 priority: medium
+state_hub_task_id: "56bde19e-6b54-5d9e-a3d7-8b13e810cb51"
 ```
 Validate the envelope against what `tenant-engine` actually sends:
 `schema_version: audit-core.event.v1alpha1`, `tenant` = affected `tenant_id`,
@@ -98,6 +103,7 @@ so the §9.6 trade is documented here and not only in the emitter.
 id: AUDIT-WP-0010-T05
 status: todo
 priority: medium
+state_hub_task_id: "777bb728-4a4d-5c5b-8b62-24fdb6ab31e3"
 ```
 Prove it end to end against the production receiver: a real event from
 `tenant-engine` accepted, attributed to the right tenant, redacted per policy,