diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index bb01429..36abc9c 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -12,6 +12,7 @@
 | workplan | QONTO-WP-0001 | finished | — | workplans/QONTO-WP-0001-statehub-bootstrap.md |
 | workplan | QONTO-WP-0002 | finished | — | workplans/QONTO-WP-0002-policy-kernel-and-rest.md |
 | workplan | QONTO-WP-0003 | finished | — | workplans/QONTO-WP-0003-mcp-surface.md |
+| workplan | QONTO-WP-0004 | active | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
 | task | ADHOC-2026-07-21-T01 | done | — | workplans/ADHOC-2026-07-21.md |
 | task | ADHOC-2026-07-21-T02 | done | — | workplans/ADHOC-2026-07-21.md |
 | task | QONTO-WP-0001-T01 | done | — | workplans/QONTO-WP-0001-statehub-bootstrap.md |
@@ -31,3 +32,10 @@
 | task | QONTO-WP-0003-T05 | done | — | workplans/QONTO-WP-0003-mcp-surface.md |
 | task | QONTO-WP-0003-T06 | done | — | workplans/QONTO-WP-0003-mcp-surface.md |
 | task | QONTO-WP-0003-T07 | done | — | workplans/QONTO-WP-0003-mcp-surface.md |
+| task | QONTO-WP-0004-T01 | done | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
+| task | QONTO-WP-0004-T02 | done | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
+| task | QONTO-WP-0004-T03 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
+| task | QONTO-WP-0004-T04 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
+| task | QONTO-WP-0004-T05 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
+| task | QONTO-WP-0004-T06 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
+| task | QONTO-WP-0004-T07 | todo | — | workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md |
diff --git a/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md b/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md
index af5437e..a0777d7 100644
--- a/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md
+++ b/workplans/QONTO-WP-0004-security-hardening-and-scale-to-zero.md
@@ -9,6 +9,7 @@ owner: claude
 topic_slug: the-custodian
 created: "2026-07-23"
 updated: "2026-07-23"
+state_hub_workstream_id: "81a476ac-06d5-4e98-a2ed-1518b16863aa"
 ---
 
 # Security hardening and scale-to-zero facade for internet exposure
@@ -31,6 +32,7 @@ dependencies are tracked explicitly per task rather than assumed away; the
 id: QONTO-WP-0004-T01
 status: done
 priority: high
+state_hub_task_id: "e93b2027-dd28-464b-8ea3-f7540f91caad"
 ```
 
 **2026-07-23:** `specs/security-genome.yaml` written per
@@ -52,6 +54,7 @@ schema; no code changes required for this task.
 id: QONTO-WP-0004-T02
 status: done
 priority: high
+state_hub_task_id: "3b10dd59-b03f-4d2b-8164-aa2a1c8c06c4"
 ```
 
 **2026-07-23:** `src/qonto_assistant/security_watch.py::DenyEscalationTracker`
@@ -79,6 +82,7 @@ proven not to affect ordinary policy-deny traffic.
 id: QONTO-WP-0004-T03
 status: todo
 priority: high
+state_hub_task_id: "f02b1cc0-4afc-44e5-b71d-545a13a3e12b"
 ```
 
 Verify `key-cape`-issued IAM Profile tokens at the request boundary (facade
@@ -102,6 +106,7 @@ already documents as the intended boundary.
 id: QONTO-WP-0004-T04
 status: todo
 priority: high
+state_hub_task_id: "fce7bf0e-674a-461f-8f2f-42d7dde3a722"
 ```
 
 Register `finance.qonto.read` as a `flex-auth` resource. Call `flex-auth`
@@ -127,6 +132,7 @@ allow and the newly-live-checked deny path.
 id: QONTO-WP-0004-T05
 status: todo
 priority: high
+state_hub_task_id: "e8a87292-488d-4871-be3e-59a5b6a38694"
 ```
 
 Per `docs/SecurityPractice.md` §2/§6: a thin, always-on facade is the only
@@ -157,6 +163,7 @@ cold-start; the backend scales back to 0 after the configured idle window.
 id: QONTO-WP-0004-T06
 status: todo
 priority: medium
+state_hub_task_id: "7cd52269-ca0a-4b09-ab51-f02ed71604f2"
 ```
 
 Per `docs/SecurityPractice.md` §7: request I1 "Reinforced" (dedicated node
@@ -179,6 +186,7 @@ now, revisit before going live") and referenced back into this workplan.
 id: QONTO-WP-0004-T07
 status: todo
 priority: low
+state_hub_task_id: "2a2da206-d182-4a72-aea4-56e58ae74c76"
 ```
 
 Close when T03–T06 land or are explicitly deferred with a recorded reason.