diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index a6913f5..2acce2a 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -24,6 +24,7 @@
 | workplan | KEY-WP-0013 | blocked | — | workplans/KEY-WP-0013-approval-engine-resource-audience.md |
 | workplan | KEY-WP-0014 | blocked | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
 | workplan | KEY-WP-0015 | finished | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
+| workplan | KEY-WP-0016 | finished | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
 | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
 | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
 | task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@@ -101,4 +102,8 @@
 | task | KEY-WP-0014-T03 | done | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
 | task | KEY-WP-0014-T04 | wait | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
 | task | KEY-WP-0015-T01 | done | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
+| task | KEY-WP-0016-T01 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T02 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T03 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0016-T04 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |
diff --git a/workplans/KEY-WP-0016-authorization-code-protocol-hardening.md b/workplans/KEY-WP-0016-authorization-code-protocol-hardening.md
index afc788e..52839bd 100644
--- a/workplans/KEY-WP-0016-authorization-code-protocol-hardening.md
+++ b/workplans/KEY-WP-0016-authorization-code-protocol-hardening.md
@@ -9,6 +9,7 @@ owner: claude
 topic_slug: authorization-code-protocol-hardening
 created: "2026-09-06"
 updated: "2026-09-06"
+state_hub_workstream_id: "22698171-f283-59a9-9443-183faaeb6287"
 ---
 
 Closes gap G01 of `history/2026-09-05-011726-scope-intent-assessment.md`, the
@@ -27,6 +28,7 @@ separate trust-contract decision and is not addressed here.
 id: KEY-WP-0016-T01
 status: done
 priority: high
+state_hub_task_id: "a5171df0-4905-518d-a52f-7152b980af79"
 ```
 
 `SessionStore.Get` reads a code and `Delete` removes it in separate lock
@@ -49,6 +51,7 @@ PKCE-failed exchange left the code replayable. Both now fail closed —
 id: KEY-WP-0016-T02
 status: done
 priority: high
+state_hub_task_id: "1d0fb108-273f-5c9a-a7c7-7640f19bad9d"
 ```
 
 On the authorization-code path: require `redirect_uri` and compare it for exact
@@ -80,6 +83,7 @@ the authclient test stub was recording no redirect and is now faithful to real
 id: KEY-WP-0016-T03
 status: done
 priority: high
+state_hub_task_id: "336db63a-e4fd-522d-86b6-0bf54a31af1c"
 ```
 
 UserInfo verifies an RSA signature and expiry but ignores its own `Issuer` field
@@ -106,6 +110,7 @@ isolates the header check.
 id: KEY-WP-0016-T04
 status: done
 priority: medium
+state_hub_task_id: "90efa6ef-9495-5716-bee2-49d01c9ce05d"
 ```
 
 Update `SCOPE.md`'s protocol-hardening limit and G01's closure status in the