diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index f7d28ec..54a50ef 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -32,6 +32,7 @@
 | workplan | FLEX-WP-0022 | proposed | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md |
 | workplan | FLEX-WP-0023 | active | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
 | workplan | FLEX-WP-0024 | active | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
+| workplan | FLEX-WP-0025 | ready | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
 | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@@ -147,6 +148,9 @@
 | task | FLEX-WP-0024-T02 | todo | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
 | task | FLEX-WP-0024-T03 | wait | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
 | task | FLEX-WP-0024-T04 | done | — | workplans/FLEX-WP-0024-decision-envelope-authenticity.md |
+| task | FLEX-WP-0025-T01 | todo | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
+| task | FLEX-WP-0025-T02 | todo | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
+| task | FLEX-WP-0025-T03 | wait | — | workplans/FLEX-WP-0025-fact-versus-assertion.md |
 | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
 | decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |
diff --git a/workplans/FLEX-WP-0025-fact-versus-assertion.md b/workplans/FLEX-WP-0025-fact-versus-assertion.md
index 1584b25..3603d86 100644
--- a/workplans/FLEX-WP-0025-fact-versus-assertion.md
+++ b/workplans/FLEX-WP-0025-fact-versus-assertion.md
@@ -16,6 +16,7 @@ related_workplans:
   - FLEX-WP-0024
 created: "2026-09-07"
 updated: "2026-09-07"
+state_hub_workstream_id: "f9a657ce-67b4-5d25-9933-e0fcb2c20b1c"
 ---
 
 # FLEX-WP-0025 — A policy cannot tell a registry fact from a caller assertion
@@ -55,6 +56,7 @@ while the value it produces is never read.**
 id: FLEX-WP-0025-T01
 status: todo
 priority: high
+state_hub_task_id: "05c6a85d-ee3d-5875-bea4-e9a9c5382e2e"
 ```
 
 Owner: `flex-auth`.
@@ -83,6 +85,7 @@ before any package changes.
 id: FLEX-WP-0025-T02
 status: todo
 priority: high
+state_hub_task_id: "fc61c8a7-347b-59d2-b6a6-a72c5c1cdb08"
 ```
 
 Owner: `flex-auth`.
@@ -105,6 +108,7 @@ allowlist unbacked. Add it to `docs/request-enrichment.md`.
 id: FLEX-WP-0025-T03
 status: wait
 priority: medium
+state_hub_task_id: "8ee5baf9-b364-5d3e-9c49-d0c9eb014c10"
 ```
 
 Owner: `flex-auth`.