diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index db3af43..ca40009 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -11,6 +11,7 @@
 | workplan | MASON-0001 | finished | — | workplans/MASON-0001-statehub-bootstrap.md |
 | workplan | MASON-WP-0001 | finished | — | workplans/MASON-WP-0001-foundation.md |
 | workplan | MASON-WP-0002 | finished | — | workplans/MASON-WP-0002-whitehat-foundational-plane.md |
+| workplan | MASON-WP-0003 | proposed | — | workplans/MASON-WP-0003-state-hub-forge-read-lane.md |
 | task | MASON-0001-T01 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
 | task | MASON-0001-T01 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
 | task | MASON-0001-T02 | done | — | workplans/MASON-0001-statehub-bootstrap.md |
@@ -24,4 +25,10 @@
 | task | MASON-WP-0002-T02 | done | — | workplans/MASON-WP-0002-whitehat-foundational-plane.md |
 | task | MASON-WP-0002-T03 | done | — | workplans/MASON-WP-0002-whitehat-foundational-plane.md |
 | task | MASON-WP-0002-T04 | done | — | workplans/MASON-WP-0002-whitehat-foundational-plane.md |
+| task | MASON-WP-0003-T01 | todo | — | workplans/MASON-WP-0003-state-hub-forge-read-lane.md |
+| task | MASON-WP-0003-T02 | todo | — | workplans/MASON-WP-0003-state-hub-forge-read-lane.md |
+| task | MASON-WP-0003-T03 | todo | — | workplans/MASON-WP-0003-state-hub-forge-read-lane.md |
+| task | MASON-WP-0003-T04 | todo | — | workplans/MASON-WP-0003-state-hub-forge-read-lane.md |
+| task | MASON-WP-0003-T05 | todo | — | workplans/MASON-WP-0003-state-hub-forge-read-lane.md |
+| task | MASON-WP-0003-T06 | wait | — | workplans/MASON-WP-0003-state-hub-forge-read-lane.md |
 | intake | MASON-IN-0001 | closed | green | intakes/intakes.md |
diff --git a/workplans/MASON-WP-0003-state-hub-forge-read-lane.md b/workplans/MASON-WP-0003-state-hub-forge-read-lane.md
index a38e755..f026993 100644
--- a/workplans/MASON-WP-0003-state-hub-forge-read-lane.md
+++ b/workplans/MASON-WP-0003-state-hub-forge-read-lane.md
@@ -12,6 +12,7 @@ updated: "2026-08-26"
 related:
   - CUST-ADR-012
   - STATE-WP-0083
+state_hub_workstream_id: "4015b46d-02f1-56ac-853e-87e8542cf0dd"
 ---
 
 # Forge read lane so central can derive private repositories
@@ -62,6 +63,7 @@ Forgejo token is not its to vend.
 id: MASON-WP-0003-T01
 status: todo
 priority: high
+state_hub_task_id: "36d26000-ae71-5a58-a563-a07ff5be664f"
 ```
 
 Two choices to settle before anything is created, because they determine what
@@ -89,6 +91,7 @@ just a value.
 id: MASON-WP-0003-T02
 status: todo
 priority: high
+state_hub_task_id: "68a1c8e4-c12b-550e-962c-06a90ab8c1c2"
 ```
 
 Create the read-only Forgejo token, an OpenBao policy granting read on exactly
@@ -111,6 +114,7 @@ anything else.
 id: MASON-WP-0003-T03
 status: todo
 priority: high
+state_hub_task_id: "e14f0eb3-a920-5623-b4c1-c20858dbb45d"
 ```
 
 Add an entry so `warden route find "state hub read private repository"` resolves.
@@ -129,6 +133,7 @@ operator enough to act without reading this workplan.
 id: MASON-WP-0003-T04
 status: todo
 priority: medium
+state_hub_task_id: "1b802564-84aa-5934-8923-51b2ad9dd607"
 ```
 
 Make the token available to the `state-hub` deployment as a Kubernetes Secret,
@@ -147,6 +152,7 @@ it; rotating the token does not require a redeploy.
 id: MASON-WP-0003-T05
 status: todo
 priority: medium
+state_hub_task_id: "4eeb9744-0d2f-57d8-a063-0e4ed371ac63"
 ```
 
 `derive_from_forge()` in `state-hub` clones anonymously. It should use the
@@ -174,6 +180,7 @@ as retirement work.
 id: MASON-WP-0003-T06
 status: wait
 priority: medium
+state_hub_task_id: "cbc9c02c-e49a-54c3-91e5-51df238139a6"
 ```
 
 Re-run the fleet reset and confirm the nine repositories derive rather than