diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 9cc9022..4405283 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -16,9 +16,10 @@
 | workplan | FLEX-WP-0006 | finished | — | workplans/FLEX-WP-0006-ops-warden-ssh-signing-policy-gate.md |
 | workplan | FLEX-WP-0007 | finished | — | workplans/FLEX-WP-0007-ops-warden-policy-gate-production-deployment.md |
 | workplan | FLEX-WP-0008 | finished | — | workplans/FLEX-WP-0008-tenant-engine-consumer-integration.md |
-| workplan | FLEX-WP-0009 | active | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
+| workplan | FLEX-WP-0009 | finished | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | workplan | FLEX-WP-0010 | finished | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | workplan | FLEX-WP-0011 | proposed | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
+| workplan | FLEX-WP-0012 | proposed | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
 | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@@ -66,7 +67,7 @@
 | task | FLEX-WP-0009-T01 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | task | FLEX-WP-0009-T02 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | task | FLEX-WP-0009-T03 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
-| task | FLEX-WP-0009-T04 | progress | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
+| task | FLEX-WP-0009-T04 | done | — | workplans/FLEX-WP-0009-user-engine-production-policy-service.md |
 | task | FLEX-WP-0010-T01 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | task | FLEX-WP-0010-T02 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
 | task | FLEX-WP-0010-T03 | done | — | workplans/FLEX-WP-0010-tenant-lifecycle-policy-actions.md |
@@ -74,3 +75,7 @@
 | task | FLEX-WP-0011-T01 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
 | task | FLEX-WP-0011-T02 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
 | task | FLEX-WP-0011-T03 | todo | — | workplans/FLEX-WP-0011-railiance-staged-promotion-overlay.md |
+| task | FLEX-WP-0012-T01 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
+| task | FLEX-WP-0012-T02 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
+| task | FLEX-WP-0012-T03 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
+| task | FLEX-WP-0012-T04 | todo | — | workplans/FLEX-WP-0012-credential-grant-authorization-surface.md |
diff --git a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
index 73eb283..2a8ec53 100644
--- a/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
+++ b/workplans/FLEX-WP-0012-credential-grant-authorization-surface.md
@@ -13,6 +13,7 @@ related_workplans:
   - RAILIANCE-WP-0005
 created: "2026-08-11"
 updated: "2026-08-11"
+state_hub_workstream_id: "89ecdb1f-ceb0-4a50-b72d-c3dfd5fa7c73"
 ---
 
 # FLEX-WP-0012 - Authorize railiance-platform credential-grant requests
@@ -85,6 +86,7 @@ What is *actually* missing is narrower and worth stating precisely:
 id: FLEX-WP-0012-T01
 status: todo
 priority: medium
+state_hub_task_id: "a1c9ba0c-3413-4823-9f9e-ccee09cf5d74"
 ```
 
 Two honest options, and the choice is a charter question rather than a
@@ -126,6 +128,7 @@ something they own.
 id: FLEX-WP-0012-T02
 status: todo
 priority: medium
+state_hub_task_id: "7e9c4e59-e59c-4617-a87f-99142952fe78"
 ```
 
 Add `examples/railiance-platform/` with a protected-system manifest, subject
@@ -162,6 +165,7 @@ for an unregistered grant.
 id: FLEX-WP-0012-T03
 status: todo
 priority: medium
+state_hub_task_id: "3335b2b7-cf1a-411d-95b3-03c4b4c35659"
 ```
 
 Implement whichever shape T01 chose. If B, the adapter must reuse the
@@ -195,6 +199,7 @@ over real HTTP, `go test ./...` is green, and `gofmt`/`go vet` are clean.
 id: FLEX-WP-0012-T04
 status: todo
 priority: low
+state_hub_task_id: "40015a87-040c-4d48-b360-fd5566dbc552"
 ```
 
 Reply to capability request `893ff109` — it has been open since 2026-07-02