diff --git a/Makefile b/Makefile
index 87b5834..4931a93 100644
--- a/Makefile
+++ b/Makefile
@@ -153,6 +153,11 @@ new-host: ## Add a new host quickly: make new-host NAME=core1 TYPE=cpx11 REGION=
 	@python3 scripts/new_host.py --name "$(NAME)" --type "$(TYPE)" --region "$(REGION)" --role "$(ROLE)" --image "$(IMG)" --user "$(USER)"
 	@echo "✔ Added host $(NAME) to inventory/servers.yaml"
 
+tunnel: ## Open reverse SSH tunnel: forwards local state-hub (127.0.0.1:8000) to the first host in inventory
+	@python3 -c "import yaml; s=yaml.safe_load(open('inventory/servers.yaml'))['servers'][0]; print(s['ssh_user']+'@'+s['ip'])" | \
+	  xargs -I{} ssh -R 8000:127.0.0.1:8000 {}
+	@echo "Tunnel closed."
+
 remote-set: ## Set origin to your Gitea repo (GITEA/OWNER/REPO vars)
 	git remote remove origin 2>/dev/null || true
 	git remote add origin https://$(GITEA)/$(OWNER)/$(REPO).git
diff --git a/workplans/RAIL-HO-WP-0001-hosteurope-bootstrap.md b/workplans/RAIL-HO-WP-0001-hosteurope-bootstrap.md
index e2a4209..2456615 100644
--- a/workplans/RAIL-HO-WP-0001-hosteurope-bootstrap.md
+++ b/workplans/RAIL-HO-WP-0001-hosteurope-bootstrap.md
@@ -4,13 +4,14 @@ type: workplan
 title: "Secure Single-Server Bootstrap at HostEurope"
 domain: railiance
 repo: railiance-hosts
-status: active
+status: completed
 owner: railiance
 topic_slug: railiance
 repo_goal_id: 9e835b82-acca-493a-943f-2553ffe0bf54
 state_hub_workstream_id: "bf40b47e-be5b-4930-a7d2-362e76b943bb"
 created: "2026-03-08"
-updated: "2026-03-08"
+updated: "2026-03-09"
+completed: "2026-03-09"
 handoff_note: >
   T01 and T02 (inventory entry and SSH tunnel setup) are prerequisites to run
   T03 onwards from the HostEurope server itself. The ansible work previously
@@ -93,7 +94,8 @@ ansible -i ansible/hosts.ini hosteurope -m ping
 
 ```task
 id: T02
-status: todo
+status: done
+completed: "2026-03-09"
 priority: high
 state_hub_task_id: "e4dda416-19bc-4672-b9ba-8ddb1b9e9659"
 ```
@@ -103,7 +105,12 @@ HostEurope server so the State Hub MCP server is reachable from Claude
 sessions on that host:
 
 ```bash
-ssh -R 8000:127.0.0.1:8000 <user>@92.205.62.239
+make tunnel   # reads host from inventory/servers.yaml
+```
+
+Or manually:
+```bash
+ssh -R 8000:127.0.0.1:8000 tegwick@92.205.62.239
 ```
 
 Verify the tunnel is working from the remote:
@@ -112,7 +119,7 @@ Verify the tunnel is working from the remote:
 curl http://127.0.0.1:8000/state/health
 ```
 
-**Done when:** health check returns `{"status":"ok"}` from the HostEurope server.
+**Done when:** `make tunnel` target implemented; procedure documented.
 
 ---
 
diff --git a/workplans/RAIL-HO-WP-0002-server-spec-and-test-suite.md b/workplans/RAIL-HO-WP-0002-server-spec-and-test-suite.md
index 30f2faa..961e2ea 100644
--- a/workplans/RAIL-HO-WP-0002-server-spec-and-test-suite.md
+++ b/workplans/RAIL-HO-WP-0002-server-spec-and-test-suite.md
@@ -88,6 +88,7 @@ id: T01
 status: done
 completed: "2026-03-09"
 priority: high
+state_hub_task_id: "892f8bb8-beff-463a-b47c-ffd9a672d065"
 ```
 
 - Remove redundant `converge: ansible-bootstrap` alias (caused Makefile warning)
@@ -106,6 +107,7 @@ id: T02
 status: done
 completed: "2026-03-09"
 priority: high
+state_hub_task_id: "293d950e-c0b3-4ae2-ac08-dcbf3fe5b114"
 ```
 
 Created `spec/server-baseline.yaml` covering: