diff --git a/DECISIONS.md b/DECISIONS.md
new file mode 100644
index 0000000..d5320d8
--- /dev/null
+++ b/DECISIONS.md
@@ -0,0 +1,21 @@
+# Decision Log
+
+_Auto-generated by the Custodian State Hub._
+
+## Approve deterministic identifier batch 0004 for railiance-cluster
+
+**Date:** 2026-08-22  
+**Decided by:** Bernd Worsch  
+
+Bernd Worsch approved exactly batch SHA-256 554c6cbe119e13738efc6e2836254ddae00ea870f1cb99f2b5603336160e308d for the railiance-cluster-only cutover. No later, broader, cancelled-task, or assignment batch is authorized.
+
+---
+
+## FLEX-WP-0012 T01 — credential-grant wire translation ownership
+
+**Date:** 2026-08-23  
+**Decided by:** operator via Codex session  
+
+Operator explicitly approved Option A on 2026-08-23: railiance-platform owns translation of its credential-grant request into the canonical flex-auth POST /v1/check CheckRequest and reads DecisionEnvelope. requested_ttl is parsed and normalized to integer seconds by railiance-platform before the policy boundary. This preserves one flex-auth decision API and avoids a consumer-specific adapter endpoint.
+
+---
diff --git a/workplans/ZONE-WP-0001-security-zone-model.md b/workplans/ZONE-WP-0001-security-zone-model.md
index e73bae5..96610d8 100644
--- a/workplans/ZONE-WP-0001-security-zone-model.md
+++ b/workplans/ZONE-WP-0001-security-zone-model.md
@@ -10,7 +10,7 @@ topic_slug: netkingdom
 planning_priority: P1
 created: "2026-08-19"
 updated: "2026-08-22"
-state_hub_workstream_id: "a75c8c9c-c108-4831-8d72-4343cce49879"
+state_hub_workstream_id: "84db5351-3813-5059-9462-4a4fc43614fe"
 quality_dod: DoD-Ok
 quality_dod_at: "2026-08-22"
 quality_dod_by: codex
@@ -82,7 +82,7 @@ machinery; it does not grow a second vocabulary beside it.
 id: ZONE-WP-0001-T01
 status: done
 priority: high
-state_hub_task_id: "ea74316e-b711-4888-9b38-553ebc9ad856"
+state_hub_task_id: "297b714c-4aac-5d63-a56f-f3cf83ef038c"
 ```
 
 **Confirm ownership on the record, and say what publishes where.** This repo was
@@ -204,7 +204,7 @@ surface is `tenancy.yaml`'s `zones:` key rather than a new file.
 id: ZONE-WP-0001-T02
 status: done
 priority: high
-state_hub_task_id: "f1016c71-ccb0-46a7-9143-e81c7ac34cad"
+state_hub_task_id: "fa30ca6b-368e-53bf-9314-21f52bcf959b"
 ```
 
 **Derive the zones from the real estate.** Walk ops-warden's 27 catalog lanes,
@@ -275,7 +275,7 @@ those lanes are graded.
 id: ZONE-WP-0001-T03
 status: done
 priority: high
-state_hub_task_id: "7f47b750-1ae4-467d-b3c4-064f4ec07dbd"
+state_hub_task_id: "6896ee26-7abd-5c0a-ba00-076aa9d05874"
 ```
 
 **Model stance and failure mode, per control per zone.** Enforced / advisory /
@@ -513,7 +513,7 @@ not, and a model that implies otherwise will be built and then not work.
 id: ZONE-WP-0001-T04
 status: done
 priority: high
-state_hub_task_id: "1c542ca5-2b82-4778-a3e4-c76e932423c9"
+state_hub_task_id: "8808346a-6293-59be-9336-67e1c896f198"
 ```
 
 **Design the time-boxed exception — this is the load-bearing task.** A standing
@@ -574,7 +574,7 @@ cheaper outcome, but it is T04's call.
 id: ZONE-WP-0001-T05
 status: done
 priority: medium
-state_hub_task_id: "f4556ca0-cb26-46ed-9351-d00270bd2309"
+state_hub_task_id: "911fbcf1-d330-53e6-8874-cff320b5fc3a"
 ```
 
 **Declaration format and conformance rule.** Follow `tenancy.yaml`: per-repo,
@@ -638,7 +638,7 @@ Two things to decide anyway, and both belong in this task:
 id: ZONE-WP-0001-T06
 status: done
 priority: medium
-state_hub_task_id: "8a000c18-6ee7-4328-99c7-53c490435316"
+state_hub_task_id: "1957437b-223f-5f63-961a-c9256690746f"
 ```
 
 **Draft the canon standard and offer it.** `security-zones_v0.1.md` for
@@ -656,7 +656,7 @@ on 2026-08-22.
 id: ZONE-WP-0001-T07
 status: done
 priority: medium
-state_hub_task_id: "c7ea24df-8aa9-4ead-ba3a-033aa5201c21"
+state_hub_task_id: "9a794ffe-c056-5da8-9d56-6826f5ed37ce"
 ```
 
 **Prove it on two consumers.** A model only its author honours is not adopted.