diff --git a/workplans/KEY-WP-0043-per-run-agent-identity.md b/workplans/KEY-WP-0043-per-run-agent-identity.md
index b1e54e4..9dff6e9 100644
--- a/workplans/KEY-WP-0043-per-run-agent-identity.md
+++ b/workplans/KEY-WP-0043-per-run-agent-identity.md
@@ -11,6 +11,7 @@ created: "2026-10-24"
 updated: "2026-10-24"
 flavor: extension
 depends_on: []
+state_hub_workstream_id: "b6b58a0b-cf75-5fd6-9545-96f37da0cc90"
 ---
 
 Proposed from docs/proposals/2026-10-24-per-run-agent-identity-assessment.md
@@ -25,6 +26,7 @@ client live; registration and rollout stay NetKingdom/Railiance-gated.
 id: KEY-WP-0043-T01
 status: todo
 priority: high
+state_hub_task_id: "cb2d7cf1-7989-5e93-a711-c843ea56f666"
 ```
 
 With net-kingdom, glas-harness, flex-auth and railiance-platform: fix `agent`
@@ -38,6 +40,7 @@ the launcher-holds-the-credential model. Output: an IAM Profile amendment note.
 id: KEY-WP-0043-T02
 status: wait
 priority: high
+state_hub_task_id: "4fc0ea89-0a0b-5310-b7dd-00c4dfaf2175"
 ```
 
 Add `principal_type: agent` as a literal on its own path, agent client class
@@ -53,6 +56,7 @@ Depends on T01.
 id: KEY-WP-0043-T03
 status: wait
 priority: high
+state_hub_task_id: "7d2ee7e1-0b5a-5aad-b917-fd6807a1c112"
 ```
 
 Implement RFC 8693 exchange: authenticate the agent client, verify the human
@@ -67,6 +71,7 @@ token, tenant mismatch, expired or revoked subject, scope widening. Depends on T
 id: KEY-WP-0043-T04
 status: wait
 priority: medium
+state_hub_task_id: "d6645702-3bee-5ea2-b2e2-ec3e406a3a81"
 ```
 
 Hand OpenBao role bindings (including nested-claim bindability) to