diff --git a/workplans/CUST-WP-0073-agent-credential-separation.md b/workplans/CUST-WP-0073-agent-credential-separation.md
index 519e082..3ef6cd4 100644
--- a/workplans/CUST-WP-0073-agent-credential-separation.md
+++ b/workplans/CUST-WP-0073-agent-credential-separation.md
@@ -15,6 +15,7 @@ related:
   - RPF-WP-0044
 origin: incident
 origin_ref: key-cape/docs/operations.md#before-any-live-change
+state_hub_workstream_id: "a98a9f34-83b4-5c8c-8107-e05f7806d50d"
 ---
 
 # Agents cannot read secret values: separate agent and admin credentials
@@ -52,6 +53,7 @@ Secrets is deferred, not dropped (T05). This plan removes the problem class.
 id: CUST-WP-0073-T01
 status: todo
 priority: high
+state_hub_task_id: "4781bb99-020f-59f6-be13-e3b8777d3fd8"
 ```
 
 Decide, with railiance-platform and ops-warden:
@@ -79,6 +81,7 @@ Output: a decision record in the-custodian, resolved by the founder
 id: CUST-WP-0073-T02
 status: todo
 priority: high
+state_hub_task_id: "4b88b0b7-dc7e-5612-aa5d-1a08f0530c35"
 ```
 
 Owner: railiance-platform (RBAC), railiance-enablement (k3s install),
@@ -101,6 +104,7 @@ ops-warden (principal mapping).
 id: CUST-WP-0073-T03
 status: todo
 priority: medium
+state_hub_task_id: "5abbfcae-eb65-5b62-a7fa-f4f698f95312"
 ```
 
 Owner: railiance-platform.
@@ -120,6 +124,7 @@ Owner: railiance-platform.
 id: CUST-WP-0073-T04
 status: todo
 priority: medium
+state_hub_task_id: "90725511-4e31-549f-b567-47feff1a9ca4"
 ```
 
 - Orientation doc §6: add the template-error dump; state that no template or
@@ -144,6 +149,7 @@ priority: medium
 id: CUST-WP-0073-T05
 status: wait
 priority: low
+state_hub_task_id: "1b41b532-38a2-5f39-b387-28737934811a"
 ```
 
 Deferred by founder decision on 2026-09-24 (builder mode). Rotate