diff --git a/workplans/RPF-WP-0018-openbao-operator-only-access.md b/workplans/RPF-WP-0025-openbao-operator-only-access.md
similarity index 88%
rename from workplans/RPF-WP-0018-openbao-operator-only-access.md
rename to workplans/RPF-WP-0025-openbao-operator-only-access.md
index e69574a..67cbe2d 100644
--- a/workplans/RPF-WP-0018-openbao-operator-only-access.md
+++ b/workplans/RPF-WP-0025-openbao-operator-only-access.md
@@ -1,5 +1,5 @@
 ---
-id: RPF-WP-0018
+id: RPF-WP-0025
 type: workplan
 title: "Retract public OpenBao listener behind operator-only access"
 domain: financials
@@ -12,10 +12,10 @@ updated: "2026-08-23"
 related:
   - RMASTER-WP-0020-T09
   - RAPP-OPENBAO-WP-0002
-state_hub_workstream_id: "4fcb6026-2630-59a3-b5de-15f54efcf59d"
+state_hub_workstream_id: "6dda6039-295e-5cac-aef6-3183c3218649"
 ---
 
-# RPF-WP-0018 — OpenBao operator-only access
+# RPF-WP-0025 — OpenBao operator-only access
 
 ## Goal
 
@@ -25,10 +25,10 @@ destructive CoulombCore cleanup.
 ## T01 — Align the retained compatibility source
 
 ```task
-id: RPF-WP-0018-T01
+id: RPF-WP-0025-T01
 status: done
 priority: high
-state_hub_task_id: "88d1342b-5093-5fbc-aa84-1608d163b979"
+state_hub_task_id: "80f9638f-707f-5038-bc77-5962b535949e"
 ```
 
 The retained platform manifest now matches the canonical package posture:
@@ -39,10 +39,10 @@ rollback artifact.
 ## T02 — Add guarded retraction and rollback
 
 ```task
-id: RPF-WP-0018-T02
+id: RPF-WP-0025-T02
 status: done
 priority: high
-state_hub_task_id: "03f0a5bd-7876-5784-bf02-11cbcdf005bb"
+state_hub_task_id: "685aba0f-2594-5b99-903a-8c9cd16f6539"
 ```
 
 `scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
@@ -53,10 +53,10 @@ It deletes only the Ingress and provides an exact rollback path.
 ## T03 — Complete the attended operator cutover
 
 ```task
-id: RPF-WP-0018-T03
+id: RPF-WP-0025-T03
 status: wait
 priority: high
-state_hub_task_id: "b602226f-8eb5-5609-995f-94f9074b0895"
+state_hub_task_id: "8850d742-7cd7-5a1b-ba52-4dbc4bdeba7e"
 ```
 
 KeyCape revision `d150be1` now admits exactly
diff --git a/workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md b/workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md
similarity index 84%
rename from workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md
rename to workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md
index 6ac0778..58fce80 100644
--- a/workplans/RPF-WP-0019-flex-auth-credential-grant-integration.md
+++ b/workplans/RPF-WP-0026-flex-auth-credential-grant-integration.md
@@ -1,5 +1,5 @@
 ---
-id: RPF-WP-0019
+id: RPF-WP-0026
 type: workplan
 title: "Adopt canonical flex-auth credential-grant checks"
 domain: financials
@@ -13,10 +13,10 @@ related:
   - FLEX-WP-0012
 origin: routed
 origin_ref: "State Hub decision 1f9f257d-c9f2-4a5e-a018-8058a3f2a51a"
-state_hub_workstream_id: "6ded9d76-e3a8-5d52-9221-2c7935f3b364"
+state_hub_workstream_id: "7677326a-04db-52ef-b05c-967dabe1759e"
 ---
 
-# RPF-WP-0019 — canonical flex-auth credential-grant checks
+# RPF-WP-0026 — canonical flex-auth credential-grant checks
 
 ## Goal
 
@@ -27,10 +27,10 @@ consumer-specific flex-auth endpoint.
 ## T01 — Resolve translation ownership
 
 ```task
-id: RPF-WP-0019-T01
+id: RPF-WP-0026-T01
 status: done
 priority: high
-state_hub_task_id: "9f0c7e4f-6351-51c1-8c5e-39f770668605"
+state_hub_task_id: "07f3fead-76d6-5e53-9a7b-9930560182d9"
 ```
 
 The operator explicitly approved Option A in State Hub decision
@@ -41,10 +41,10 @@ normalization belong here, before the flex-auth policy boundary.
 ## T02 — Implement the canonical request and response
 
 ```task
-id: RPF-WP-0019-T02
+id: RPF-WP-0026-T02
 status: done
 priority: high
-state_hub_task_id: "8c95e2b5-884c-5504-9998-5bdd8ae64b5d"
+state_hub_task_id: "659ac0ee-c2b7-56fc-80d8-92b2fcf30e7b"
 ```
 
 Change the helper default to `/v1/check`, emit the coordinated
@@ -60,10 +60,10 @@ evaluator provenance, and subject/resource binding back to the request.
 ## T03 — Verify and route the contract
 
 ```task
-id: RPF-WP-0019-T03
+id: RPF-WP-0026-T03
 status: done
 priority: medium
-state_hub_task_id: "9d8c534d-72b7-5cac-ada1-72273fb3ab01"
+state_hub_task_id: "8f6b7481-e8c2-56eb-98b5-c49cae562d60"
 ```
 
 Exercise focused allow and deny tests, validate the complete repository suite,
diff --git a/workplans/RPF-WP-0020-keycape-live-secret-exposure-recovery.md b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
similarity index 88%
rename from workplans/RPF-WP-0020-keycape-live-secret-exposure-recovery.md
rename to workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
index c24f20b..4303b3f 100644
--- a/workplans/RPF-WP-0020-keycape-live-secret-exposure-recovery.md
+++ b/workplans/RPF-WP-0027-keycape-live-secret-exposure-recovery.md
@@ -1,5 +1,5 @@
 ---
-id: RPF-WP-0020
+id: RPF-WP-0027
 type: workplan
 title: "Coordinate KeyCape live Secret exposure recovery"
 domain: financials
@@ -13,10 +13,10 @@ related:
   - KEY-WP-0011
 origin: routed
 origin_ref: "State Hub messages e88abb61-e393-4a82-817c-5ac378a2ee3d, acf98be3-ff6b-4270-bd21-0193bebd806b, aeb216b5-9f1b-404b-a483-fb08a00a49b1, and 71b1008a-7fd7-4500-85c6-e8893a6d80d4"
-state_hub_workstream_id: "99bdb617-b577-5de3-a9d8-4990ac676e28"
+state_hub_workstream_id: "b2c25a01-4a80-55c1-90cf-8538000f7e0e"
 ---
 
-# RPF-WP-0020 — KeyCape live Secret exposure recovery
+# RPF-WP-0027 — KeyCape live Secret exposure recovery
 
 ## Goal
 
@@ -27,10 +27,10 @@ payload and never treat repository access as live mutation authority.
 ## T01 — Contain and establish the recovery boundary
 
 ```task
-id: RPF-WP-0020-T01
+id: RPF-WP-0027-T01
 status: done
 priority: high
-state_hub_task_id: "4763622c-78aa-556a-ba8e-9b556a2e78fc"
+state_hub_task_id: "53f47272-92ab-563b-9d69-5eafee733e6b"
 ```
 
 Accepted the KeyCape/NetKingdom incident reports, stopped payload inspection,
@@ -41,10 +41,10 @@ the public JWKS digest/kid. The legacy value-printing rotation helper is banned.
 ## T02 — Publish the governed bundle cutover
 
 ```task
-id: RPF-WP-0020-T02
+id: RPF-WP-0027-T02
 status: done
 priority: high
-state_hub_task_id: "a897b2f5-b7ae-5dbf-9f51-54b2db5ca6fc"
+state_hub_task_id: "3c55b1cd-8f6b-5a48-b416-18ab711954e3"
 ```
 
 `docs/keycape-live-secret-exposure-recovery.md` defines owners, required
@@ -55,10 +55,10 @@ predecessor revocation, and sanitized evidence.
 ## T03 — Collect exact owner acknowledgements
 
 ```task
-id: RPF-WP-0020-T03
+id: RPF-WP-0027-T03
 status: progress
 priority: high
-state_hub_task_id: "44959415-a917-5dfb-a5ab-80ab166b9096"
+state_hub_task_id: "714ae011-903d-55e2-ac47-801b8ef879d1"
 ```
 
 KeyCape supplied source revision `93704fd2424503007c20b458b62a7f7d994bb288`,
@@ -95,10 +95,10 @@ lane remains unresolved and no credential fetch or retry is authorized.
 ## T04 — Execute the attended rotation
 
 ```task
-id: RPF-WP-0020-T04
+id: RPF-WP-0027-T04
 status: wait
 priority: high
-state_hub_task_id: "d85eeb8a-3147-59e1-bc2a-e84244dde93d"
+state_hub_task_id: "28b31e57-7a76-5100-8a61-9aa87339c5d7"
 ```
 
 Requires a fresh exact human GO, an at-most-30-minute window, named driver and
@@ -108,10 +108,10 @@ and all T03 acknowledgements. No value may enter captured output.
 ## T05 — Prove predecessor denial and close
 
 ```task
-id: RPF-WP-0020-T05
+id: RPF-WP-0027-T05
 status: wait
 priority: high
-state_hub_task_id: "e026d9e6-82d0-5322-a3ef-e69e7f613514"
+state_hub_task_id: "9cb5fa67-012a-58cf-bafb-e7c7d4f9782d"
 ```
 
 Verify replacement operation and predecessor rejection for the signing key,
@@ -122,10 +122,10 @@ status, timestamps, and cleanup receipts.
 ## T06 — Publish the Railiance/OpenBao custody handoff
 
 ```task
-id: RPF-WP-0020-T06
+id: RPF-WP-0027-T06
 status: progress
 priority: high
-state_hub_task_id: "0b666b58-b73a-5d2e-a4e5-c53769fef85e"
+state_hub_task_id: "3b9748c4-2906-5ba7-9d34-0a7067a59283"
 ```
 
 The platform/OpenBao owner must publish a non-secret receipt for both routing