Record managed registration and custody work identities

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1046b-5629-7f52-badd-f718eadb6042

workplans/KEY-WP-0037-secrets-engine-openbao-registration-custody.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: netkingdom
 created: "2026-10-04"
 updated: "2026-10-04"
+state_hub_workstream_id: "62800ecf-064b-5546-a1e4-4521b5932973"
 ---
 
 KeyCape's accepted provider contract (KEY-WP-0009) does not establish actual
@@ -22,6 +23,7 @@ not live registration, credential generation, rotation, fetching or deployment.
 id: KEY-WP-0037-T01
 status: done
 priority: high
+state_hub_task_id: "0409f656-65fb-5ee2-a934-a687a3e139f1"
 ```
 
 Reviewed KeyCape base 672e1faf4b3401ff7bf68bb0b29f8dc50ca51ac6:
@@ -44,6 +46,7 @@ status: wait
 priority: high
 needs_human: true
 intervention_note: "Approve the exact separate secrets-engine-openbao custody boundary only after platform and consumer owners complete the proposed coordinates and reviewed execution packet. Informed-decision reader approval does not cover this client."
+state_hub_task_id: "ac798fb4-ed77-5e45-83ab-f56eea92be34"
 ```
 
 Platform owns the authoritative OpenBao client-secret custody and least-privilege
@@ -63,6 +66,7 @@ status: wait
 priority: high
 depends_on:
   - KEY-WP-0037-T02
+state_hub_task_id: "52f03e39-d05b-5da5-85df-e28c059430e4"
 ```
 
 Coordinate source registration merge and the single new env secretKeyRef with
@@ -82,6 +86,7 @@ status: wait
 priority: high
 depends_on:
   - KEY-WP-0037-T03
+state_hub_task_id: "40b80bcd-243d-5bf8-ba18-b992e3c5f8f7"
 ```
 
 After authorized registration and custody, verify issuer/JWKS signature, subject,