diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 6dfb3ae..1cfb8f0 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -25,11 +25,11 @@
 | workplan | RAILIANCE-WP-0024 | active | — | workplans/RAILIANCE-WP-0024-audit-core-custody-and-recovery-coordination.md |
 | workplan | RAILIANCE-WP-0025 | finished | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md |
 | workplan | RAILIANCE-WP-0026 | finished | — | workplans/RAILIANCE-WP-0026-attended-login-output-containment.md |
+| workplan | RAILIANCE-WP-0027 | blocked | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
 | workplan | RPF-WP-0018 | finished | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | workplan | RPF-WP-0019 | finished | — | workplans/RPF-WP-0019-apps-pg-recoverability-and-controls.md |
 | workplan | RPF-WP-0020 | finished | — | workplans/RPF-WP-0020-ccr-schema-drift.md |
 | workplan | RPF-WP-0021 | finished | — | workplans/RPF-WP-0021-core-hub-platform-onboarding.md |
-| workplan | RAILIANCE-WP-0027 | blocked | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
 | task | RAILIANCE-WP-0005-T01 | done | — | workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md |
 | task | RAILIANCE-WP-0005-T02 | done | — | workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md |
 | task | RAILIANCE-WP-0005-T03 | done | — | workplans/RAILIANCE-WP-0005-credential-request-and-lease-broker.md |
@@ -111,6 +111,9 @@
 | task | RAILIANCE-WP-0025-T05 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md |
 | task | RAILIANCE-WP-0025-T06 | done | — | workplans/RAILIANCE-WP-0025-versioned-ephemeral-custody-lifecycle.md |
 | task | RAILIANCE-WP-0026-T01 | done | — | workplans/RAILIANCE-WP-0026-attended-login-output-containment.md |
+| task | RAILIANCE-WP-0027-T01 | done | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
+| task | RAILIANCE-WP-0027-T02 | done | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
+| task | RAILIANCE-WP-0027-T03 | wait | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
 | task | RPF-WP-0018-T01 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T02 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
 | task | RPF-WP-0018-T03 | done | — | workplans/RPF-WP-0018-policy-surface-alignment.md |
@@ -131,6 +134,3 @@
 | task | RPF-WP-0021-T03 | done | — | workplans/RPF-WP-0021-core-hub-platform-onboarding.md |
 | task | RPF-WP-0021-T04 | done | — | workplans/RPF-WP-0021-core-hub-platform-onboarding.md |
 | task | RPF-WP-0021-T05 | done | — | workplans/RPF-WP-0021-core-hub-platform-onboarding.md |
-| task | RAILIANCE-WP-0027-T01 | done | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
-| task | RAILIANCE-WP-0027-T02 | done | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
-| task | RAILIANCE-WP-0027-T03 | wait | — | workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md |
diff --git a/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md b/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md
index fa190c4..6e0b853 100644
--- a/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md
+++ b/workplans/RAILIANCE-WP-0026-attended-login-output-containment.md
@@ -15,6 +15,7 @@ related:
   - WARDEN-WP-0027-T02-DRILL-20260822-01
 origin: routed
 origin_ref: "State Hub message b3f34c2d-941f-4ddd-b15d-e28075446021"
+state_hub_workstream_id: "73878f8d-d8bb-5845-8a5c-91cdd83c1066"
 ---
 
 # RAILIANCE-WP-0026 — attended OpenBao login output containment
@@ -52,6 +53,7 @@ seal/unseal ceremony, or reuse of the terminal drill scenario.
 id: RAILIANCE-WP-0026-T01
 status: done
 priority: high
+state_hub_task_id: "3c302542-f637-5130-9cd1-5c55fbf109eb"
 ```
 
 Implement the fix in `ops-warden` and return one value-safe owner receipt to
diff --git a/workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md b/workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md
index 2002f61..e4d0ce1 100644
--- a/workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md
+++ b/workplans/RAILIANCE-WP-0027-openbao-operator-only-access.md
@@ -12,6 +12,7 @@ updated: "2026-08-23"
 related:
   - RMASTER-WP-0020-T09
   - RAPP-OPENBAO-WP-0002
+state_hub_workstream_id: "6f8a6cbc-c076-5f0a-ade2-281a7ec71360"
 ---
 
 # RAILIANCE-WP-0027 — OpenBao operator-only access
@@ -27,6 +28,7 @@ destructive CoulombCore cleanup.
 id: RAILIANCE-WP-0027-T01
 status: done
 priority: high
+state_hub_task_id: "d84fb3fd-2166-58a0-81d9-2141ca55a67d"
 ```
 
 The retained platform manifest now matches the canonical package posture:
@@ -40,6 +42,7 @@ rollback artifact.
 id: RAILIANCE-WP-0027-T02
 status: done
 priority: high
+state_hub_task_id: "149fdec9-6735-514e-aad1-0c2daf72d27a"
 ```
 
 `scripts/openbao-public-listener-transition.sh` pins the cluster UID, verifies
@@ -53,6 +56,7 @@ It deletes only the Ingress and provides an exact rollback path.
 id: RAILIANCE-WP-0027-T03
 status: wait
 priority: high
+state_hub_task_id: "99f8b41f-e9db-579d-a6fb-b71337048afc"
 ```
 
 Blocked on two facts: KeyCape and the OpenBao role must accept the exact