diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 419cd01..5f1bc66 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -15,6 +15,7 @@
 | workplan | MASON-WP-0004 | blocked | — | workplans/MASON-WP-0004-credential-inventory-descriptions.md |
 | workplan | MASON-WP-0005 | blocked | — | workplans/MASON-WP-0005-fluid-telegram-operator-credential-lane.md |
 | workplan | MASON-WP-0006 | blocked | — | workplans/MASON-WP-0006-readiness-tier-check.md |
+| workplan | MASON-WP-0007 | blocked | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
 | task | MASON-0001-T01 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
 | task | MASON-0001-T01 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
 | task | MASON-0001-T02 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
@@ -47,6 +48,12 @@
 | task | MASON-WP-0006-T04 | done | — | workplans/MASON-WP-0006-readiness-tier-check.md |
 | task | MASON-WP-0006-T05 | done | — | workplans/MASON-WP-0006-readiness-tier-check.md |
 | task | MASON-WP-0006-T06 | wait | — | workplans/MASON-WP-0006-readiness-tier-check.md |
+| task | MASON-WP-0007-T01 | todo | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
+| task | MASON-WP-0007-T02 | wait | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
+| task | MASON-WP-0007-T03 | wait | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
+| task | MASON-WP-0007-T04 | wait | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
+| task | MASON-WP-0007-T05 | wait | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
+| task | MASON-WP-0007-T06 | wait | — | workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md |
 | intake | MASON-IN-0001 | closed | green | intakes/intakes.md |
 | intake | MASON-IN-0002 | closed | — | intakes/intakes.md |
 | intake | MASON-IN-0003 | open | — | intakes/intakes.md |
diff --git a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
index 092edc6..f777d24 100644
--- a/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
+++ b/workplans/MASON-WP-0007-tenant-engine-audit-core-sender-projection.md
@@ -10,6 +10,7 @@ owner: claude
 topic_slug: netkingdom
 created: "2026-10-01"
 updated: "2026-10-01"
+state_hub_workstream_id: "60acab5e-8ee3-5449-bc1e-91b203e92262"
 ---
 
 # MASON-WP-0007 — Project the tenant-engine audit-core sender token
@@ -45,6 +46,7 @@ Construction plan: `plans/tenant-engine-audit-core-sender-projection.md`
 id: MASON-WP-0007-T01
 status: todo
 priority: high
+state_hub_task_id: "1819909b-3949-5c04-ae4e-c38e003a1707"
 ```
 
 With a scoped `./scripts/bao-session.sh grant MASON-WP-0007-T01` session,
@@ -65,6 +67,7 @@ depends_on: [MASON-WP-0007-T01]
 blocked_on: founder
 blocking_reason: "Founder approval of the construction plan (status: approved, approved_by, approved_at)."
 priority: high
+state_hub_task_id: "18151439-0d9c-536f-93c8-2b113bf80c27"
 ```
 
 ## Policy and Kubernetes-auth role declared by railiance-platform
@@ -76,6 +79,7 @@ depends_on: [MASON-WP-0007-T02]
 blocked_on: message-from:railiance-platform
 blocking_reason: "railiance-platform declares policy workload-kv-read-tenant-engine-audit-core-sender-eso and role tenant-engine-audit-core-sender-eso (ESO Kubernetes auth lane), or confirms the ops-mason builder may write the role."
 priority: high
+state_hub_task_id: "aadb4beb-7cdd-56d1-8140-1dbe38ff5db7"
 ```
 
 ## Manifests in the tenant-engine rApp repository
@@ -87,6 +91,7 @@ depends_on: [MASON-WP-0007-T02]
 blocked_on: message-from:tenant-engine
 blocking_reason: "tenant-engine/rapp-tenant-engine declares SA tenant-engine-eso, ClusterSecretStore openbao-tenant-engine-audit-core-sender and ExternalSecret tenant-engine-audit-core-sender per the plan, reconciled by ArgoCD."
 priority: high
+state_hub_task_id: "e56f0374-fede-5494-8266-a30f08896a6a"
 ```
 
 ## Attended seed of the dedicated KV path
@@ -99,6 +104,7 @@ depends_on: [MASON-WP-0007-T03]
 blocked_on: founder
 blocking_reason: "Wrapped platform-admin process copies the tenant-engine token from the registry document to platform/workloads/tenant-engine/audit-core-sender without printing it; ops-mason-build is denied value reads, so only an attended admin lane can do it."
 priority: high
+state_hub_task_id: "1bb05319-25a5-579f-8b63-897ec583bc3e"
 ```
 
 ## Verify and hand off
@@ -110,4 +116,5 @@ depends_on: [MASON-WP-0007-T03, MASON-WP-0007-T04, MASON-WP-0007-T05]
 blocked_on: other-task
 blocking_reason: "Needs T03-T05. Verify by metadata only: KV version exists, store Ready, ExternalSecret SecretSynced, Secret exists with key name token; negative check that the role cannot read the registry path. Add the ops-warden audit-core-senders pointer line and tell tenant-engine."
 priority: medium
+state_hub_task_id: "84576093-9133-5708-b724-2266db434407"
 ```