diff --git a/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md b/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md
index 2ad106c..3381b81 100644
--- a/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md
+++ b/workplans/MASON-WP-0012-sign-in-diagnosis-caller-proof.md
@@ -9,6 +9,7 @@ owner: claude
 topic_slug: custodian
 created: "2026-10-14"
 updated: "2026-10-14"
+state_hub_workstream_id: "347f452c-cf66-5b92-8d2e-f5027101ae80"
 ---
 
 # Named-role login without session reuse, diagnosis receipt, and a self-only capability proof
@@ -35,6 +36,7 @@ the OpenBao UI role choice).
 id: MASON-WP-0012-T01
 status: done
 priority: high
+state_hub_task_id: "4cb4bb04-b167-577d-a8c9-61c52648f3de"
 ```
 
 `scripts/verify-reuse-surface-hub-writer.py` logs in with
@@ -50,6 +52,7 @@ Done 2026-10-14. Tests: `tests/test_attended_login.py`.
 id: MASON-WP-0012-T02
 status: done
 priority: high
+state_hub_task_id: "b61f41a8-eae9-59f8-91d4-f055df5db0ae"
 ```
 
 The receipt adds `uid`, `openbao_error` (verbatim, redacted of tokens, codes
@@ -66,6 +69,7 @@ Done 2026-10-14. Tests: `tests/test_attended_login.py`,
 id: MASON-WP-0012-T03
 status: done
 priority: high
+state_hub_task_id: "9dcd432e-a497-593b-8ce4-cc46a5c2b35d"
 ```
 
 The verifier no longer reads `BAO_TOKEN`, `VAULT_TOKEN`,
@@ -81,6 +85,7 @@ id: MASON-WP-0012-T04
 status: wait
 depends_on: [MASON-WP-0012-T03]
 priority: medium
+state_hub_task_id: "a22ca4f1-dc18-5298-8a10-0c736951f939"
 ```
 
 After railiance-platform applies CCR-2026-0045 (RPF-WP-0057-T02): run