diff --git a/workplans/KEY-WP-0035-optional-mfa.md b/workplans/KEY-WP-0035-optional-mfa.md
index 83ee54a..6d4933e 100644
--- a/workplans/KEY-WP-0035-optional-mfa.md
+++ b/workplans/KEY-WP-0035-optional-mfa.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: infotech
 created: "2026-09-13"
 updated: "2026-09-13"
+state_hub_workstream_id: "b27601d8-d0a5-5c79-a1ff-c2a4cedafa74"
 ---
 
 Requested behavior: password-only login before OTP activation; require OTP after
@@ -20,6 +21,7 @@ activation. Do not lower assurance of unrelated applications.
 id: KEY-WP-0035-T01
 status: done
 priority: high
+state_hub_task_id: "c1ed06c2-c689-53d1-afc7-e10d79e9e94f"
 ```
 
 Add mfaOptional, preserve explicit AAL2 and existing client policy, fail closed on
@@ -33,6 +35,7 @@ Validation: `go test ./...` and `git diff --check` passed on 2026-09-13. See doc
 id: KEY-WP-0035-T02
 status: wait
 priority: high
+state_hub_task_id: "b066a273-f91c-50ee-b497-a39eace03b3a"
 ```
 
 Live factor-read credentials return HTTP 401. The owner route
@@ -48,6 +51,7 @@ available; deploy digest-pinned source and run no-factor/enrolled/error checks.
 id: KEY-WP-0035-T03
 status: wait
 priority: high
+state_hub_task_id: "93ce2e97-6c5a-58a7-8f3c-1c4f0eb6f1b5"
 ```
 
 Verify provider self-service login, possession-confirmed activation, cancellation