Bind portal OIDC workplan to State Hub

workplans/KEY-WP-0007-user-engine-portal-oidc-client.md

@@ -12,6 +12,7 @@ updated: "2026-07-27"
 depends_on:
   - KEY-WP-0005
   - USER-WP-0020
+state_hub_workstream_id: "92727f0c-09a8-4431-88c4-3cb6fe946d27"
 ---
 
 # KEY-WP-0007 - User-engine portal OIDC relying-party integration
@@ -26,6 +27,7 @@ not move user-domain or authorization ownership into KeyCape.
 id: KEY-WP-0007-T01
 status: done
 priority: high
+state_hub_task_id: "619a642a-da29-4f32-a48e-54e44627f54e"
 ```
 
 Register `user-engine-portal` for authorization code with mandatory S256 PKCE,
@@ -38,6 +40,7 @@ implicit flow, client secret, or dynamic registration is allowed.
 id: KEY-WP-0007-T02
 status: done
 priority: high
+state_hub_task_id: "cbebb6d2-d263-40cb-a5fc-1d16011ad928"
 ```
 
 Update the railiance01 KeyCape configuration without exposing its signing key
@@ -50,6 +53,7 @@ unregistered callback denial and successful token exchange through the portal.
 id: KEY-WP-0007-T03
 status: progress
 priority: high
+state_hub_task_id: "43f6cd61-70d0-43d7-93d1-e87286466ff2"
 ```
 
 Prove issuer, audience, tenant, groups, roles and assurance claims are verified