diff --git a/workplans/GLAS-WP-0018-session-agent-identity-and-tool-boundary.md b/workplans/GLAS-WP-0018-session-agent-identity-and-tool-boundary.md
index 029b828..e0b9a20 100644
--- a/workplans/GLAS-WP-0018-session-agent-identity-and-tool-boundary.md
+++ b/workplans/GLAS-WP-0018-session-agent-identity-and-tool-boundary.md
@@ -10,6 +10,7 @@ owner: claude
 topic_slug: session-agent-identity-tool-boundary
 created: "2026-10-24"
 updated: "2026-10-24"
+state_hub_workstream_id: "4805066a-58f6-51c5-bc99-eabe9cd719d0"
 ---
 
 # Session-scoped agent identity, attribution and tool boundary
@@ -27,6 +28,7 @@ changed by drafting this plan.
 id: GLAS-WP-0018-T01
 status: todo
 priority: high
+state_hub_task_id: "c19c4644-058a-5a85-a840-3e917d86c58e"
 ```
 
 Add optional `identity_ref` (subject, act.sub, jti, issuer, expiry; never the
@@ -39,6 +41,7 @@ Add hashed evidence-receipt location and sha256. Tests; backwards compatible.
 id: GLAS-WP-0018-T02
 status: todo
 priority: high
+state_hub_task_id: "b1e1ac59-e03c-5e01-986f-721383888999"
 ```
 
 Add a profile `boundary` block, record it in evidence, and fail the run when the
@@ -53,6 +56,7 @@ manifest.
 id: GLAS-WP-0018-T03
 status: todo
 priority: medium
+state_hub_task_id: "3e2baf39-0b0e-5dd4-bb72-ebc5b72e3b0b"
 ```
 
 Define `AgentIdentityIssuer` with a test double. Gateway obtains a per-run token
@@ -66,6 +70,7 @@ teardown. Never put the token in argv, task file, evidence or Hub detail.
 id: GLAS-WP-0018-T04
 status: wait
 priority: medium
+state_hub_task_id: "5dd4ea64-172a-583e-a353-407c0734bf55"
 ```
 
 Blocked on key-cape (agent-token issuance, `act`, revocation) and the sand-boxer
@@ -79,6 +84,7 @@ rein-aharness task.
 id: GLAS-WP-0018-T05
 status: todo
 priority: medium
+state_hub_task_id: "66bb42e1-bb6b-5943-8aac-b13425408018"
 ```
 
 Emit an ActionRecord per observed commit and streamed tool event, with
@@ -93,6 +99,7 @@ step defined with net-kingdom (SI-15 verify).
 id: GLAS-WP-0018-T06
 status: todo
 priority: low
+state_hub_task_id: "bd782576-eb37-5f71-90cb-cb29c0e96f61"
 ```
 
 Publish a provider-neutral session identity contract for sessions Glas does not