Fixed workplan frontmatter

workplans/KEY-WP-0003-bootstrap-console-oidc-mfa-login.md

@@ -9,6 +9,7 @@ owner: codex
 topic_slug: netkingdom
 created: "2026-05-24"
 updated: "2026-05-24"
+state_hub_workstream_id: "02990009-a2b3-44f6-a579-487fbacae41a"
 ---
 
 # KEY-WP-0003 - Bootstrap Console OIDC Login and MFA Verification
@@ -104,6 +105,7 @@ ceremony, and restart the KeyCape deployment.
 id: KEY-WP-0003-T01
 status: done
 priority: high
+state_hub_task_id: "b396c99f-d711-475a-9cba-4f03a1db561d"
 ```
 
 Add a KeyCape client registration for the bootstrap console. Either create a
@@ -125,6 +127,7 @@ Gate: an authorize request using the local callback no longer returns
 id: KEY-WP-0003-T02
 status: done
 priority: high
+state_hub_task_id: "46172e6d-3e11-493c-b223-79c2fc321aec"
 ```
 
 Confirm whether the current `authelia.baseURL` is safe to use for both browser
@@ -141,6 +144,7 @@ inside the deployment.
 id: KEY-WP-0003-T03
 status: done
 priority: high
+state_hub_task_id: "92fca4d0-6215-4ea6-9f80-9178ae183acb"
 ```
 
 When `CheckMFARequired` returns true after the Authelia callback, render a
@@ -163,6 +167,7 @@ browser and is returned to the registered downstream callback.
 id: KEY-WP-0003-T04
 status: done
 priority: medium
+state_hub_task_id: "079a5929-1864-4461-a64c-746cebca469d"
 ```
 
 Add tests that cover:
@@ -182,6 +187,7 @@ Gate: `make test` passes and the negative redirect URI tests remain green.
 id: KEY-WP-0003-T05
 status: done
 priority: medium
+state_hub_task_id: "1d67225d-a20b-4e36-9b2e-20836be2f439"
 ```
 
 Document the deployment path for updating live KeyCape config without