diff --git a/workplans/WARDEN-WP-0019-route-to-secrets-engine.md b/workplans/WARDEN-WP-0019-route-to-secrets-engine.md
index 3c7c6c4..602fad1 100644
--- a/workplans/WARDEN-WP-0019-route-to-secrets-engine.md
+++ b/workplans/WARDEN-WP-0019-route-to-secrets-engine.md
@@ -11,6 +11,7 @@ planning_priority: high
 planning_order: 19
 created: "2026-06-29"
 updated: "2026-06-29"
+state_hub_workstream_id: "5e49abb6-497f-4640-a484-2da5f39a7c4e"
 ---
 
 # WARDEN-WP-0019 — Route secret-exec lanes to secrets-engine
@@ -41,6 +42,7 @@ caller runs it); changing the proxy's security model; the production policy-gate
 id: WARDEN-WP-0019-T01
 status: done
 priority: high
+state_hub_task_id: "ea153605-7a14-4db7-8bce-d780ea143f8a"
 ```
 
 - [x] `RouteEntry` gains `exec_owner` / `exec_command` / `pointer_command` (pointers only,
@@ -60,6 +62,7 @@ priority: high
 id: WARDEN-WP-0019-T02
 status: done
 priority: medium
+state_hub_task_id: "96059b8a-8938-4763-b3d0-cc5a0eb2465c"
 ```
 
 - [x] `.claude/rules/credential-routing.md`: add secrets-engine as the secret-exec owner;