diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 48e3a9a..0c6b58a 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -30,6 +30,7 @@
 | workplan | FLEX-WP-0020 | proposed | — | workplans/FLEX-WP-0020-repository-identity-migration.md |
 | workplan | FLEX-WP-0021 | finished | — | workplans/FLEX-WP-0021-secrets-engine-consumer-policy-gate.md |
 | workplan | FLEX-WP-0022 | proposed | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md |
+| workplan | FLEX-WP-0023 | ready | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
 | task | FLEX-WP-0001-T001 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T002 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
 | task | FLEX-WP-0001-T003 | done | — | workplans/FLEX-WP-0001-repo-intent-and-architecture-baseline.md |
@@ -136,6 +137,11 @@
 | task | FLEX-WP-0022-T01 | todo | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md |
 | task | FLEX-WP-0022-T02 | wait | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md |
 | task | FLEX-WP-0022-T03 | todo | — | workplans/FLEX-WP-0022-tenant-scope-coverage.md |
+| task | FLEX-WP-0023-T01 | todo | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
+| task | FLEX-WP-0023-T02 | wait | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
+| task | FLEX-WP-0023-T03 | wait | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
+| task | FLEX-WP-0023-T04 | todo | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
+| task | FLEX-WP-0023-T05 | wait | — | workplans/FLEX-WP-0023-operator-caller-access-path.md |
 | intake | FLEX-IN-0001 | closed | — | intakes/intakes.md |
 | intake | FLEX-IN-0002 | closed | — | intakes/intakes.md |
 | decision | FLEX-DEC-2026-001 | resolved | — | decisions/decisions.md |
diff --git a/workplans/FLEX-WP-0023-operator-caller-access-path.md b/workplans/FLEX-WP-0023-operator-caller-access-path.md
index b1b0945..53cd725 100644
--- a/workplans/FLEX-WP-0023-operator-caller-access-path.md
+++ b/workplans/FLEX-WP-0023-operator-caller-access-path.md
@@ -16,6 +16,7 @@ related_workplans:
   - SECRETS-WP-0009
 created: "2026-09-06"
 updated: "2026-09-06"
+state_hub_workstream_id: "ad011f92-786c-51ad-b3f6-c06ad77e7af7"
 ---
 
 # FLEX-WP-0023 — Operator caller access path and caller identity in the decision record
@@ -47,6 +48,7 @@ admitted exactly one pod. Here the warn window protects nothing while it runs.
 id: FLEX-WP-0023-T01
 status: todo
 priority: high
+state_hub_task_id: "10e5a40c-f142-55b9-ab15-fc77c0064ce0"
 ```
 
 Owner: `flex-auth`; production write, operator approval required.
@@ -73,6 +75,7 @@ Gate: `kubectl -n secrets-engine create token secrets-engine --audience=flex-aut
 id: FLEX-WP-0023-T02
 status: wait
 priority: high
+state_hub_task_id: "79a8d82d-777c-5462-b49d-098f4b7a3b9c"
 ```
 
 Owner: `flex-auth` to run; `glas-harness` to receive.
@@ -109,6 +112,7 @@ isolates. Nothing is reported as verified that was not run.
 id: FLEX-WP-0023-T03
 status: wait
 priority: high
+state_hub_task_id: "8117c9d8-6efa-5ccf-8ed4-4da2519c3de3"
 ```
 
 Owner: `flex-auth`; deployment approval required.
@@ -132,6 +136,7 @@ caller adoption is proved — is satisfied by `T02`, not bypassed by this task.
 id: FLEX-WP-0023-T04
 status: todo
 priority: high
+state_hub_task_id: "c0e4f31a-cc42-5bd2-b938-d140ecd52e1a"
 ```
 
 Owner: `flex-auth`.
@@ -166,6 +171,7 @@ same request's `request_digest` is byte-identical to the pre-change value.
 id: FLEX-WP-0023-T05
 status: wait
 priority: medium
+state_hub_task_id: "d685abfc-cf86-50c8-ad5e-2c04e1531ddd"
 ```
 
 Owner: `flex-auth`.