diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 48a6750..df8b6a9 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -18,6 +18,7 @@
 | workplan | KEY-WP-0008 | finished | — | workplans/KEY-WP-0008-registration-handoff-and-client-mfa-policy.md |
 | workplan | KEY-WP-0009 | finished | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
 | workplan | KEY-WP-0010 | finished | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
+| workplan | KEY-WP-0011 | blocked | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
 | task | KEY-WP-0001-T01 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
 | task | KEY-WP-0001-T02 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
 | task | KEY-WP-0001-T03 | done | — | workplans/KEY-WP-0001-keycape-implementation.md |
@@ -79,3 +80,6 @@
 | task | KEY-WP-0009-T03 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
 | task | KEY-WP-0009-T04 | done | — | workplans/KEY-WP-0009-provider-capabilities-and-service-identities.md |
 | task | KEY-WP-0010-T01 | done | — | workplans/KEY-WP-0010-openbao-operator-loopback-callback.md |
+| task | KEY-WP-0011-T01 | done | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0011-T02 | wait | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
+| task | KEY-WP-0011-T03 | wait | — | workplans/KEY-WP-0011-live-secret-exposure-recovery.md |
diff --git a/workplans/KEY-WP-0011-live-secret-exposure-recovery.md b/workplans/KEY-WP-0011-live-secret-exposure-recovery.md
index 0e020f7..bb51810 100644
--- a/workplans/KEY-WP-0011-live-secret-exposure-recovery.md
+++ b/workplans/KEY-WP-0011-live-secret-exposure-recovery.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: netkingdom
 created: "2026-08-23"
 updated: "2026-08-23"
+state_hub_workstream_id: "158aa957-8818-52ea-b7a5-3962cf30ba5e"
 ---
 
 # KEY-WP-0011 — Live KeyCape Secret exposure recovery
@@ -23,6 +24,7 @@ metadata check. Never reproduce, decode, or store the exposed payload.
 id: KEY-WP-0011-T01
 status: done
 priority: high
+state_hub_task_id: "a8f5e33d-c725-5181-849e-a42bba34d3d8"
 ```
 
 Stopped live rollout work, treated the payload as exposed, and notified
@@ -38,6 +40,7 @@ mutation was attempted.
 id: KEY-WP-0011-T02
 status: wait
 priority: high
+state_hub_task_id: "9d60569c-a0f1-53a9-b4dc-01687ab92bcc"
 ```
 
 Requires an approved owner-coordinated rotation plan. KeyCape signing-key
@@ -53,6 +56,7 @@ arguments, or ordinary logs.
 id: KEY-WP-0011-T03
 status: wait
 priority: high
+state_hub_task_id: "a079573d-97fd-5c6c-b1f9-c0af65e2933a"
 ```
 
 After rotation, verify new resource versions and non-secret fingerprints,