diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 2acce2a..57f3539 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -9,6 +9,7 @@
 | Kind | ID | Status | Lane | Source |
 | --- | --- | --- | --- | --- |
 | workplan | ADHOC-2026-09-05 | finished | — | workplans/ADHOC-2026-09-05.md |
+| workplan | ADHOC-2026-09-07 | finished | — | workplans/ADHOC-2026-09-07.md |
 | workplan | KEY-WP-0001 | finished | — | workplans/KEY-WP-0001-keycape-implementation.md |
 | workplan | KEY-WP-0002 | finished | — | workplans/KEY-WP-0002-container-image-gitea.md |
 | workplan | KEY-WP-0003 | finished | — | workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md |
@@ -25,7 +26,9 @@
 | workplan | KEY-WP-0014 | blocked | — | workplans/KEY-WP-0014-native-credential-lane-handoff.md |
 | workplan | KEY-WP-0015 | finished | — | workplans/KEY-WP-0015-scope-intent-assessment.md |
 | workplan | KEY-WP-0016 | finished | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| workplan | KEY-WP-0017 | finished | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
 | task | ADHOC-2026-09-05-T01 | done | — | workplans/ADHOC-2026-09-05.md |
+| task | ADHOC-2026-09-07-T01 | done | — | workplans/ADHOC-2026-09-07.md |
 | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
 | task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
 | task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@@ -106,4 +109,8 @@
 | task | KEY-WP-0016-T02 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
 | task | KEY-WP-0016-T03 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
 | task | KEY-WP-0016-T04 | done | — | workplans/KEY-WP-0016-authorization-code-protocol-hardening.md |
+| task | KEY-WP-0017-T01 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T02 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T03 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
+| task | KEY-WP-0017-T04 | done | — | workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md |
 | intake | KEY-IN-0001 | closed | — | intakes/intakes.md |
diff --git a/workplans/ADHOC-2026-09-07.md b/workplans/ADHOC-2026-09-07.md
index 7a530d6..1740107 100644
--- a/workplans/ADHOC-2026-09-07.md
+++ b/workplans/ADHOC-2026-09-07.md
@@ -8,6 +8,7 @@ status: finished
 owner: claude
 created: "2026-09-07"
 updated: "2026-09-07"
+state_hub_workstream_id: "c2fdc5cc-89be-561d-b832-f0b3019ea1c7"
 ---
 
 ## Publish the consumer-facing rollout note
@@ -16,6 +17,7 @@ updated: "2026-09-07"
 id: ADHOC-2026-09-07-T01
 status: done
 priority: medium
+state_hub_task_id: "2187cef2-07c0-5ac1-89ca-3bb25a160fa4"
 ```
 
 KEY-WP-0016 changed `/token` and `/userinfo` behaviour without a consumer-facing
diff --git a/workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md b/workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md
index 0449e3b..00eb039 100644
--- a/workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md
+++ b/workplans/KEY-WP-0017-canonical-model-and-discovery-conformance.md
@@ -9,6 +9,7 @@ owner: claude
 topic_slug: canonical-model-and-discovery-conformance
 created: "2026-09-07"
 updated: "2026-09-07"
+state_hub_workstream_id: "0904caad-ad8b-573f-9cdb-b6da09262a18"
 ---
 
 Closes gap G02 of `history/2026-09-05-011726-scope-intent-assessment.md`.
@@ -29,6 +30,7 @@ files once leaves them free to drift again the same afternoon.
 id: KEY-WP-0017-T01
 status: done
 priority: high
+state_hub_task_id: "996f6895-f36b-585e-844d-3e55d02eefda"
 ```
 
 Bring the `Client` entity in `spec/canonical-model.yaml` in line with
@@ -52,6 +54,7 @@ removing them would discard intent the check can now hold honest.
 id: KEY-WP-0017-T02
 status: done
 priority: high
+state_hub_task_id: "77df5043-2b23-56cd-947e-317f7117ac18"
 ```
 
 Add a test that compares the canonical model's `Client` field set against
@@ -74,6 +77,7 @@ a hand-maintained exception list.
 id: KEY-WP-0017-T03
 status: done
 priority: medium
+state_hub_task_id: "5eb36f9b-a8e0-541e-8f81-310db49b77a0"
 ```
 
 `claims_supported` omits `tenant`, `principal_type`, `assurance`, `scope` and
@@ -99,6 +103,7 @@ assessment asked for: a missing core claim fails, optional metadata does not.
 id: KEY-WP-0017-T04
 status: done
 priority: medium
+state_hub_task_id: "63290e2a-bae1-51c3-9cb9-d49994d804b6"
 ```
 
 Two files currently claim to be authoritative. State in both that the Go model is