diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 8209ab3..f313af4 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -22,6 +22,7 @@
 | workplan | RAILIANCE-WP-0017 | finished | — | workplans/RAILIANCE-WP-0017-consumption-mode-enforcement.md |
 | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | workplan | RPF-WP-0019 | active | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
+| workplan | RPF-WP-0020 | proposed | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
 | task | RAILIANCE-WP-0005-T01 | done | — | workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md |
 | task | RAILIANCE-WP-0005-T02 | done | — | workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md |
 | task | RAILIANCE-WP-0005-T03 | done | — | workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md |
@@ -93,3 +94,7 @@
 | task | RPF-WP-0019-T02 | progress | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
 | task | RPF-WP-0019-T03 | done | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
 | task | RPF-WP-0019-T04 | wait | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
+| task | RPF-WP-0020-T01 | todo | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
+| task | RPF-WP-0020-T02 | todo | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
+| task | RPF-WP-0020-T03 | todo | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
+| task | RPF-WP-0020-T04 | todo | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
diff --git a/workplans/RPF-WP-0020-ccr-schema-drift.md b/workplans/RPF-WP-0020-ccr-schema-drift.md
index 491c662..99aaddf 100644
--- a/workplans/RPF-WP-0020-ccr-schema-drift.md
+++ b/workplans/RPF-WP-0020-ccr-schema-drift.md
@@ -13,6 +13,7 @@ related:
   - RPF-WP-0014
 origin: residual
 origin_ref: RPF-WP-0019
+state_hub_workstream_id: "e2da7c94-0693-40fa-a339-1873b7dd061a"
 ---
 
 # RPF-WP-0020 — CCR schema drift
@@ -77,6 +78,7 @@ draft and a real gap produce identical output.
 id: RPF-WP-0020-T01
 status: todo
 priority: high
+state_hub_task_id: "3bf8bf9c-ac33-4ce7-8b3f-5b40135b227c"
 ```
 **Migrate CCR-2026-0010 to the current schema.** Determine the actual
 authentication path for the `email-connect` transactional lane — Kubernetes
@@ -90,6 +92,7 @@ disagreement is the finding.
 id: RPF-WP-0020-T02
 status: todo
 priority: medium
+state_hub_task_id: "12933d69-82a3-470d-b01c-0c40c28a7984"
 ```
 **Give the suite a way to express a draft.** Add an explicit in-flight state
 so `CCR-2026-0011` is skipped *by declaration* rather than by exception list —
@@ -101,6 +104,7 @@ allowlist of filenames would work today and rot on the next draft.
 id: RPF-WP-0020-T03
 status: todo
 priority: medium
+state_hub_task_id: "da52b518-c6fb-40b8-acb9-c64724ca4eee"
 ```
 **Report the drift rather than only fixing it.** If the `openbao.auth`
 requirement was added without migrating existing active CCRs, other repos
@@ -111,6 +115,7 @@ whether the requirement originated here or upstream, and notify accordingly.
 id: RPF-WP-0020-T04
 status: todo
 priority: low
+state_hub_task_id: "2259ee69-4914-42c4-9175-8c61b2206888"
 ```
 **Make the suite green and keep it that way.** With T01 and T02 done, the full
 suite passes. Record in `docs/credential-change-approval.md` that a new