feat(connectors): complete ATLAS-WP-0003 — discovery connectors (Phase 2)

T01 connector_base + docs/discovery-connectors.md (read-only/stateless,
candidate->PR->promote; `candidate` added to schema status enum; candidates/
gitignored, excluded from gate).
T02 connector_reposcoping (repo-scoping facts -> candidates; graceful degrade).
T03 connector_gitconfig (deterministic scan; real .env -> secret-ref, no values;
verified 4 real candidates from ~/state-hub).
T04 connector_featurecontrol (feature-flag surfaces linking to feature-control
keys, no eval logic; FR-12).
T05 registry_health (unowned + stale detection).
Make targets: connect-gitconfig/reposcoping/featurecontrol, registry-health.

WP-0003 finished (5/5).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/ATLAS-WP-0003-discovery-connectors.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Discovery connectors"
 domain: infotech
 repo: config-atlas
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 created: "2026-06-26"
@@ -39,11 +39,17 @@ proceed in parallel; T05 (stale/unowned) depends on having connector-produced da
 
 ```task
 id: ATLAS-WP-0003-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "e7b03e49-7e49-4629-ada1-facdf596569b"
 ```
 
+Result 2026-06-27: Added `tools/connector_base.py` (validates + writes candidates,
+refuses to overwrite promoted entries, never stores values) and the contract in
+`docs/discovery-connectors.md` (read-only/stateless, candidate->PR->promote,
+`status: candidate` + provenance). Added `candidate` to the schema status enum;
+candidates/ is gitignored and excluded from the gate.
+
 Specify the read-only connector contract and the candidate lifecycle. Define the
 candidate entry format (a surface entry with `status: candidate` + provenance) and
 its location (`registry/surfaces/candidates/`), and the `connector → candidate YAML
@@ -60,11 +66,17 @@ Document in `docs/discovery-connectors.md`.
 
 ```task
 id: ATLAS-WP-0003-T02
-status: todo
+status: done
 priority: high
 state_hub_task_id: "2447547b-1776-4225-af4f-f73680ccb2df"
 ```
 
+Result 2026-06-27: Added `tools/connector_reposcoping.py` (+ make
+connect-reposcoping). Consumes repo-scoping facts (--facts file or
+REPO_SCOPING_URL), filters config facts, emits schema-valid candidates; degrades
+gracefully when the API is down. Verified on synthetic facts (2 config candidates,
+non-config skipped).
+
 Build the connector that consumes `repo-scoping` observed facts/evidence as input
 and emits candidate configuration surfaces, adding only the config-kind and layer
 classification on top (ecosystem-boundaries §2.4 option a). Map repo-scoping facts
@@ -79,11 +91,16 @@ about config files/env/params to `surface.*` candidates with `kind`, `scope`, an
 
 ```task
 id: ATLAS-WP-0003-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "ddfb8eaf-46b4-4b15-9719-b167538c15fb"
 ```
 
+Result 2026-06-27: Added `tools/connector_gitconfig.py` (+ make connect-gitconfig).
+Deterministic scan for *.env.example / values*.yaml / config*.yaml; real .env ->
+secret-ref (no value read). Verified on ~/state-hub: 4 real candidates including a
+Helm values.yaml and a secret-ref .env.
+
 Build a deterministic scanner over repository config surfaces — env files, YAML/TOML
 config, Kubernetes ConfigMap/Secret *references*, and Helm `values*.yaml` overlays —
 emitting candidate entries with inferred `kind` and layer `role` per source. Secret
@@ -96,11 +113,16 @@ references become `secret-ref` candidates (reference only, never values).
 
 ```task
 id: ATLAS-WP-0003-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "9e2f5893-7b98-4ca6-89d7-94d093d6bd4b"
 ```
 
+Result 2026-06-27: Added `tools/connector_featurecontrol.py` (+ make
+connect-featurecontrol). Emits `feature-flag` surfaces linking to feature-control
+keys (role: feature-control-key, openfeature endpoint) with no eval logic (FR-12);
+degrades when no key registry exists. Verified on synthetic keys.
+
 Build a connector that inventories `feature-control` keys and emits `feature-flag`
 surfaces that **link** to the feature-control key (`sources[].role:
 feature-control-key`) and contain no evaluation logic (PRD FR-12; reinforces the
@@ -113,11 +135,16 @@ delegation boundary). Surface stale flags as a signal.
 
 ```task
 id: ATLAS-WP-0003-T05
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "ddcf070c-a863-47df-8c99-61c1980a8d18"
 ```
 
+Result 2026-06-27: Added `tools/registry_health.py` (+ make registry-health).
+Reports unowned (missing/unresolvable owner vs reuse-surface roster as domain-tree
+stand-in) and stale (evidence.last_seen) surfaces. Verified: 4 promoted surfaces,
+all owned and fresh.
+
 Add a report that flags surfaces with no resolvable `owner` (against domain-tree)
 and surfaces whose sources were not seen in the latest scan (stale/drift signal),
 using `evidence.last_seen`. Wire it into the validation tooling (`tools/`).