From 8f3b4a7e85ebc9fc727ddc3b6ad10ac0107a2503 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Sat, 24 Oct 2026 23:53:35 +0200
Subject: [PATCH] RPF-WP-0065: record hub ids

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 328925@bnt-lap001
Assistant-Session: 14b795fd-c632-4c01-8d28-e7e490c7b0ed
---
 workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md b/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
index 35aa1f7..16ff337 100644
--- a/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
+++ b/workplans/RPF-WP-0065-netkingdom-role-claim-bindings.md
@@ -13,6 +13,7 @@ related:
   - NK-WP-0054
   - RPF-WP-0022
   - RPF-WP-0035
+state_hub_workstream_id: "a042bef1-3370-5731-9f62-a974fa0cb7be"
 ---
 
 # RPF-WP-0065 — Role claim bindings from the NK-WP-0054 review
@@ -50,6 +51,7 @@ so the rollout below keeps an open admin session and a one-command rollback.
 id: RPF-WP-0065-T01
 status: done
 priority: high
+state_hub_task_id: "1e8f9164-dc8e-5f75-8fb8-58182092347a"
 ```
 **Coding-agent transition (option a).** `coding-agent-jwt-role.json` now binds
 `principal_type` to `["service", "agent"]` (OpenBao list = any-of). Sub, audience, tenant, roles,
@@ -66,6 +68,7 @@ standing identity. At removal also bind `/agent/mode` to the agreed mode(s). Rev
 id: RPF-WP-0065-T02
 status: done
 priority: high
+state_hub_task_id: "67b76351-eb4c-5236-af9f-c5c9eca4d862"
 ```
 **platform-admin aal2 (founder decision 2026-10-24).** `netkingdom-platform-admin-role.json`
 now binds `groups: [net-kingdom-admins]` and `"/assurance/level": "aal2"`, as the credential-broker
@@ -75,6 +78,7 @@ role does. Closes exception SI-X4 once applied.
 id: RPF-WP-0065-T03
 status: done
 priority: medium
+state_hub_task_id: "b7bfdb19-a806-589b-b287-fb3abffc2e78"
 ```
 **Tests.** `tests/test_netkingdom_role_files.py` (new) and the bound-claims assertion in
 `tests/test_openbao_platform_admin_callback_prune.py` now follow the declaration:
@@ -84,6 +88,7 @@ priority: medium
 id: RPF-WP-0065-T04
 status: wait
 priority: high
+state_hub_task_id: "abd78db2-03ad-5942-a9ef-12bbada54b28"
 ```
 **Founder live step: apply platform-admin aal2 (needs the founder).** See runbook below.
 
@@ -91,6 +96,7 @@ priority: high
 id: RPF-WP-0065-T05
 status: wait
 priority: medium
+state_hub_task_id: "e0e8d3f5-24c2-5106-a2d7-3ebe0845f840"
 ```
 **Coding-agent: issuer first, then role.** Blocked on the KeyCape owner (see rollout order).
 Then the founder applies the role and later removes `service`.