diff --git a/workplans/RPF-WP-0062-custodian-agent-observer-identity.md b/workplans/RPF-WP-0062-custodian-agent-observer-identity.md
index f93dbcd..8c7b7ef 100644
--- a/workplans/RPF-WP-0062-custodian-agent-observer-identity.md
+++ b/workplans/RPF-WP-0062-custodian-agent-observer-identity.md
@@ -11,6 +11,7 @@ updated: "2026-10-20"
 flavor: implementation
 origin: cross-repo
 origin_ref: the-custodian CUST-WP-0073-T02 (founder decision 2026-10-20)
+state_hub_workstream_id: "2cda239a-c071-5234-a728-7d19c3eff306"
 ---
 
 Demand: CUST-WP-0073-T02 needs a supervised agent identity on railiance01 that
@@ -66,6 +67,7 @@ the agent (no `serviceaccounts/token` grant).
 id: RPF-WP-0062-T01
 status: done
 priority: high
+state_hub_task_id: "889272c3-d025-5e1b-b43a-ddd053ee5482"
 ```
 
 Namespace, ServiceAccount, ClusterRole and ClusterRoleBinding written; the
@@ -79,6 +81,7 @@ Secret, no automount, and a manual pinned Application.
 id: RPF-WP-0062-T02
 status: done
 priority: high
+state_hub_task_id: "e248f206-2b56-5336-a79b-d0a496da6098"
 ```
 
 `custodian-agents.application.yaml` pins `targetRevision` to the commit that
@@ -92,6 +95,7 @@ status: wait
 priority: high
 needs_human: true
 blocking_reason: "Founder runs the attended root sync for the custodian-agents child, issues a token and runs the can-i proof; live production change."
+state_hub_task_id: "c1d2bf34-791e-5bfa-beda-94532448c7b3"
 ```
 
 1. `make argocd-pin-drift` — stop on any `DRIFT` line.