diff --git a/workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md b/workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md
index cfa0a0b..2865e55 100644
--- a/workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md
+++ b/workplans/SAND-WP-0005-extension-sdk-and-vm-packer.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: custodian
 created: "2026-06-23"
 updated: "2026-06-23"
+state_hub_workstream_id: "9e1f7eda-d1ea-4c2b-9141-2ee9afbf60de"
 ---
 
 # Extension SDK and ext.vm-packer
@@ -25,6 +26,7 @@ Deliver INTENT near-term outcome #7 (extension SDK sketch) and begin
 id: SAND-WP-0005-T01
 status: done
 priority: high
+state_hub_task_id: "44b69d2c-52e6-43cc-8737-ae3bc8d92c36"
 ```
 
 `SandboxExtension` base class (`src/sandboxer/extensions/base.py`),
@@ -36,6 +38,7 @@ priority: high
 id: SAND-WP-0005-T02
 status: done
 priority: high
+state_hub_task_id: "259bae15-2c64-4f8f-910f-3e79f339945f"
 ```
 
 `VMPackerExtension` — SSH attach to pre-built VM, workspace under `/build/sbx-<id>/`,
@@ -48,6 +51,7 @@ optional repo rsync, teardown removes workspace only. Registration:
 id: SAND-WP-0005-T03
 status: done
 priority: high
+state_hub_task_id: "ac26cb05-bf05-4fdb-bb6c-93d37cbfce73"
 ```
 
 Profile + runbook for Haskell build VM (build-machines lineage).
@@ -59,6 +63,7 @@ Profile + runbook for Haskell build VM (build-machines lineage).
 id: SAND-WP-0005-T04
 status: done
 priority: medium
+state_hub_task_id: "01e1008e-04c0-4319-988a-1f67765c4c70"
 ```
 
 `SSHConfig.port` for reverse-tunnel ports (12222). Manager stores `vm_target` /
@@ -70,6 +75,7 @@ priority: medium
 id: SAND-WP-0005-T05
 status: done
 priority: high
+state_hub_task_id: "55e4577d-bd9c-4437-8457-5e2751100ecc"
 ```
 
 Unit tests: `test_vm_packer.py`, `test_extension_base.py`, `test_extension_registry.py`.
@@ -80,6 +86,7 @@ Unit tests: `test_vm_packer.py`, `test_extension_base.py`, `test_extension_regis
 id: SAND-WP-0005-T06
 status: wait
 priority: low
+state_hub_task_id: "d7d0e75b-d6f5-4b24-aa87-5b3e8b6dd5ad"
 ```
 
 Packer build orchestration from `sandboxer create`; the-custodian `make remote-build`