Draft capability entry (reuse-surface REUSE-WP-0017-T04, cohort 1)

Honest first-pass maturity vector grounded in README/docs/tests present
in this repo; no invented evidence. Flagged for human review before
publish. See reuse-surface history/2026-07-06-coverage-classification.md.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/rules/agents.md

@@ -0,0 +1,20 @@
+## Kaizen Agents
+
+Specialized agent personas available on demand via the state-hub MCP.
+
+**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category
+**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them
+
+Common agents:
+
+| Agent | Category | When to use |
+|-------|----------|-------------|
+| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature |
+| `code-refactoring` | quality | Code quality analysis and safe refactoring |
+| `test-maintenance` | testing | Diagnose and fix failing tests |
+| `requirements-engineering` | process | Prevent interface/mock mismatches upfront |
+| `keepaTodofile` | process | Maintain TODO.md during work |
+| `project-management` | process | Track status, determine next steps |
+| `datamodel-optimization` | quality | Optimize dataclasses and data structures |
+
+All 17 agents: call `list_kaizen_agents()` for the full list.

.claude/rules/architecture.md

@@ -0,0 +1,8 @@
+## Architecture
+
+<!-- TODO: Describe the key design decisions and component structure.
+     Key modules, data flows, external integrations, state machines, etc. -->
+
+## Quick Reference
+
+`~/state-hub/mcp_server/TOOLS.md` — MCP tool reference

.claude/rules/first-session.md

@@ -0,0 +1,38 @@
+## First Session Protocol
+
+Triggered when `get_domain_summary("infotech")` shows **no workstreams**.
+The project is registered but work has not yet been structured.
+
+**Step 1 — Read, don't write**
+- `~/the-custodian/canon/projects/infotech/project_charter_v0.1.md` — purpose, scope
+- `~/the-custodian/canon/projects/infotech/roadmap_v0.1.md` — planned phases
+- Scan repo root: README, directory structure, existing code or docs
+
+**Step 2 — Survey in-progress work**
+Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete.
+
+**Step 3 — Propose workstreams to Bernd**
+Propose 1–3 workstreams — each a coherent strand, weeks to months, anchored to a
+roadmap phase. **Wait for approval before creating.**
+
+**Step 4 — Create workplan file first, then DB record (ADR-001)**
+```
+workplans/EMAIL-WP-NNNN-<slug>.md   ← write this first
+```
+Then register in the hub:
+```
+create_workstream(topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a", title="...", owner="...", description="...")
+create_task(workstream_id="<id>", title="...", priority="high|medium|low")
+```
+
+**Step 5 — Record the setup**
+```
+add_progress_event(
+    summary="First session: structured infotech into N workstreams, M tasks",
+    event_type="milestone",
+    topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a",
+    detail={"workstreams": [...], "tasks_created": M}
+)
+```
+
+<!-- Delete or archive this file once past first session -->

.claude/rules/repo-boundary.md

@@ -0,0 +1,8 @@
+## Repo boundary
+
+This repo owns **email-connect** only. It does not own:
+
+<!-- TODO: List what belongs in adjacent repos, e.g.:
+- SSH key management → railiance-infra/
+- State hub code     → state-hub/
+-->

.claude/rules/repo-identity.md

@@ -0,0 +1,5 @@
+**Purpose:** Headless provider-neutral email communication and evidence service for sending, tracking, diagnosing, and normalizing email-channel events.
+
+**Domain:** infotech
+**Repo slug:** email-connect
+**Topic ID:** cee7bedf-2b48-46ef-8601-006474f2ad7a

.claude/rules/session-protocol.md

@@ -0,0 +1,85 @@
+## Session Protocol
+
+Dev Hub (State Hub API): http://127.0.0.1:8000
+MCP server name in `~/.claude.json`: `dev-hub`
+
+**Step 1 — Orient**
+
+Read the offline-safe brief first — it works without a live hub connection:
+```bash
+cat .custodian-brief.md
+```
+Then call the MCP tool for richer cross-domain context when MCP tools are exposed:
+```
+get_domain_summary("infotech")
+```
+If MCP tools are unavailable in the current agent session, use the REST API:
+```bash
+curl -s "http://127.0.0.1:8000/state/summary" | python3 -m json.tool
+```
+If the hub is offline: `cd ~/state-hub && make api`
+
+**Step 2 — Check inbox**
+With MCP tools:
+```
+get_messages(to_agent="email-connect", unread_only=True)
+```
+Mark read with `mark_message_read(message_id)`. Reply or act on coordination
+requests before proceeding.
+
+Without MCP tools:
+```bash
+curl -s "http://127.0.0.1:8000/messages/?to_agent=email-connect&unread_only=true" \
+  | python3 -m json.tool
+curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
+  -H "Content-Type: application/json" -d '{}'
+```
+
+**Step 3 — Scan workplans**
+```bash
+ls workplans/
+```
+For each file with `status: ready`, `active`, or `blocked`, note pending
+`wait`/`todo`/`progress` tasks.
+
+**Step 4 — Present brief**
+
+1. **Active workstreams** for `infotech` — title, task counts, blocking decisions
+2. **Pending tasks** from `workplans/` + any `[repo:email-connect]` hub tasks
+3. **Goal guidance** — if `goal_guidance` in summary:
+   - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
+   - `alignment_warnings`: flag if active work is not aligned with current goal
+4. **Suggested next action** — highest-priority open item
+5. **SBOM status** — flag if `last_sbom_at` is unset for this repo
+
+If no workstreams: follow First Session Protocol (`first-session.md`).
+
+**During work:** `record_decision()` · `add_progress_event()` · `resolve_decision()`
+
+> State Hub is a *read model*. Bootstrap tools (`create_workstream`, `create_task`)
+> are First Session Protocol only. Work structure belongs in repo files (ADR-001).
+
+**Session close:**
+With MCP tools:
+```
+add_progress_event(summary="...", topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a", workstream_id="<uuid>")
+```
+Without MCP tools:
+```bash
+curl -s -X POST http://127.0.0.1:8000/progress/ \
+  -H "Content-Type: application/json" \
+  -d '{"topic_id":"cee7bedf-2b48-46ef-8601-006474f2ad7a","workstream_id":"<uuid>","event_type":"note","summary":"what changed","author":"codex"}'
+```
+If workplan files were modified, ensure the local copy is up to date first:
+```bash
+git -C <repo_path> pull --ff-only
+cd ~/state-hub && make fix-consistency REPO=email-connect
+```
+For repos where implementation runs on a remote machine (e.g. CoulombCore),
+use the combined target which pulls before fixing:
+```bash
+cd ~/state-hub && make fix-consistency-remote REPO=email-connect
+```
+**C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
+will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes
+until you pull — intentional to prevent clobbering remote progress.

.claude/rules/stack-and-commands.md

@@ -0,0 +1,19 @@
+## Stack
+
+<!-- TODO: Fill in language, frameworks, and key dependencies -->
+- **Language:**
+- **Key deps:**
+
+## Dev Commands
+
+```bash
+# TODO: Fill in the standard commands for this repo
+
+# Install dependencies
+
+# Run tests
+
+# Lint / type check
+
+# Build / package (if applicable)
+```

.claude/rules/workplan-convention.md

@@ -0,0 +1,40 @@
+## Workplan Convention (ADR-001)
+
+File location: `workplans/EMAIL-WP-NNNN-<slug>.md`
+ID prefix: `EMAIL-WP-`
+
+Work items originate as files in this repo **before** being registered in the hub.
+
+Canonical workplan/workstream frontmatter statuses are:
+`proposed`, `ready`, `active`, `blocked`, `backlog`, `finished`, `archived`.
+Use `proposed` for a newly drafted plan, `ready` after review against current
+repo state, and `finished` when implementation is complete. `stalled` and
+`needs_review` are derived health labels, not stored statuses.
+
+Closed workplans may be moved to `workplans/archived/` with a completion-date
+prefix: `YYMMDD-EMAIL-WP-NNNN-<slug>.md`. The frontmatter id remains
+unchanged; the prefix is only for quick visual reference.
+
+Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**:
+`workplans/ADHOC-YYYY-MM-DD.md`, workstream slug `adhoc-YYYY-MM-DD`, and task ids
+`ADHOC-YYYY-MM-DD-T01`, `T02`, etc. Use adhocs only for low-risk work completed
+directly. Promote anything requiring analysis, design, approval, dependencies, or
+multiple planned phases into a normal workplan.
+
+Ecosystem todos from other agents arrive as `[repo:email-connect]` hub tasks —
+visible at session start. Pick one up by creating the workplan file, then registering
+the workstream.
+
+Task blocks use this shape:
+
+```task
+id: EMAIL-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+```
+
+Status progression is `todo` → `progress` → `done`; use `wait` for waiting or
+blocked work and `cancel` for stopped work.
+
+<!-- Ralph Loop rules and HEUREKA sequence: ~/.claude/CLAUDE.md — do not duplicate here -->

.custodian-brief.md

@@ -1,28 +1,18 @@
 <!-- custodian-brief: generated by fix-consistency — do not edit manually -->
 # Custodian Brief — email-connect
 
-**Domain:** custodian  
-**Last synced:** 2026-06-02 00:43 UTC  
+**Domain:** infotech  
+**Last synced:** 2026-06-22 21:20 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Expected Recipient Reporting and Mailbox Tutorial
-Progress: 0/7 done  |  workstream_id: `438149d2-4f20-42b1-91fd-cdeff29dec7d`
-
-**Open tasks:**
-- · T01 - Expected Recipient Input Model  `d1cd0de0`
-- · T02 - Known Recipient Report Column and Ordering  `3d7d3bb8`
-- · T03 - No-Evidence Rows for Expected Recipients  `aa737837`
-- · T04 - Optional Recipient Context  `731cf592`
-- · T05 - Datetime Range Filtering  `22585e83`
-- · T06 - Report and Evidence Tests  `f30cd5b9`
-- · T07 - Mailbox Report Tutorial  `00a29cb9`
+*(none — repo may need first-session setup)*
 
 ---
 ## MCP Orientation (when available)
 
 If the state-hub MCP server is reachable, call:
-`get_domain_summary("custodian")`
+`get_domain_summary("infotech")`
 This provides richer cross-domain context.
 If the MCP call fails, use this file as your orientation source.

.repo-classification.yaml

@@ -0,0 +1,25 @@
+# Repo classification (Repo Classification Standard v1.0).
+
+repo_classification:
+  standard: Repo Classification Standard
+  version: '1.0'
+  classified_at: '2026-06-22'
+  classified_by: human
+  category: tooling
+  domain: infotech
+  secondary_domains:
+  - communication
+  capability_tags:
+  - evidence
+  - traceability
+  - source-management
+  - automation
+  business_stake:
+  - technology
+  - operations
+  - legal
+  business_mechanics:
+  - operation
+  - coordination
+  notes: Headless, provider-neutral email communication and evidence service. Headless infra
+    for developers -> domain infotech; communication is a secondary market.

AGENTS.md

@@ -2,41 +2,15 @@
 
 ## Repo Identity
 
-**Purpose:** Headless, provider-neutral email communication and evidence service
-for sending, tracking, diagnosing, and normalizing email-channel events without
-overclaiming delivery, awareness, or result satisfaction.
+**Purpose:** Headless provider-neutral email communication and evidence service for sending, tracking, diagnosing, and normalizing email-channel events.
 
-**Domain:** custodian
+**Domain:** infotech
 **Repo slug:** email-connect
 **Topic ID:** `cee7bedf-2b48-46ef-8601-006474f2ad7a`
 **Workplan prefix:** `EMAIL-WP-`
 
 ---
 
-## Repo Orientation
-
-This repository is currently in planning/specification shape. Treat
-`INTENT.md` as the canonical product intent and
-`spec/ProductRequirementsDocument.md` as the detailed requirements source until
-implementation architecture is added.
-
-Preserve the core principle: email events are evidence, not result
-satisfaction. Provider acceptance, MX acceptance, inbox placement, opens,
-clicks, replies, complaints, suppressions, and bounces must remain distinct.
-Do not collapse them into "delivered", "read", "accepted", or any similar
-business conclusion.
-
-Keep the product provider-neutral and adapter-friendly. It should be useful as
-a standalone email communication/evidence service and as the reference
-`coordination-engine` adapter. It should not drift into newsletter campaign
-management, broad marketing automation, or legal/business outcome adjudication.
-
-There is no runtime stack committed yet. Any stack, API, storage, or provider
-choice should be introduced through a workplan and anchored in the current
-intent/PRD.
-
----
-
 ## State Hub Integration
 
 The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
@@ -50,8 +24,8 @@ there is no MCP server for Codex agents.
 ### Orient at session start
 
 ```bash
-# Offline brief, when present
-test -f .custodian-brief.md && cat .custodian-brief.md
+# Offline brief — works without hub connection
+cat .custodian-brief.md
 
 # Active workstreams for this domain
 curl -s "http://127.0.0.1:8000/workstreams/?topic_id=cee7bedf-2b48-46ef-8601-006474f2ad7a&status=active" \
@@ -106,7 +80,7 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
 ## Session Protocol
 
 **Start:**
-1. `test -f .custodian-brief.md && cat .custodian-brief.md` — domain goal and open workstreams, when present
+1. `cat .custodian-brief.md` — domain goal and open workstreams (offline-safe)
 2. Check inbox: `GET /messages/?to_agent=email-connect&unread_only=true`; mark read
 3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
 4. Check human-needed tasks: `GET /tasks/?needs_human=true`
@@ -177,6 +151,11 @@ every repo's agent instructions because it is high-frequency, high-risk, and eas
 get wrong.
 
 **Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
+
+<!-- REPO-AGENTS-EXTENSIONS -->
+<!-- Append repo-specific agent instructions below this marker.
+     The state-hub template sync preserves content after this line. -->
+
 ---
 
 ## Workplan Convention (ADR-001)
@@ -202,7 +181,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
 id: EMAIL-WP-NNNN
 type: workplan
 title: "..."
-domain: custodian
+domain: infotech
 repo: email-connect
 status: proposed | ready | active | blocked | backlog | finished | archived
 owner: codex

CLAUDE.md

@@ -1,21 +1,12 @@
-# email-connect - Claude Code Instructions
+# email-connect — Claude Code Instructions
 
-This repository uses `AGENTS.md` as the canonical local agent instruction file.
-Claude Code agents should read `AGENTS.md` first and follow the same State Hub
-identity, workplan convention, and repo-specific semantic guardrails.
-
-State Hub identity:
-
-- Domain: `custodian`
-- Repo slug: `email-connect`
-- Topic ID: `cee7bedf-2b48-46ef-8601-006474f2ad7a`
-- Workplan prefix: `EMAIL-WP-`
-
-Core product rule: email events are evidence, not result satisfaction. Do not
-treat provider acceptance, MX acceptance, inbox placement, opens, clicks,
-replies, complaints, or suppressions as proof of human awareness or business
-outcome completion.
-
-Start with `INTENT.md`, then `spec/ProductRequirementsDocument.md`, then the
-active files under `workplans/`.
+@SCOPE.md
+@.claude/rules/repo-identity.md
+@.claude/rules/session-protocol.md
+@.claude/rules/first-session.md
+@.claude/rules/workplan-convention.md
+@.claude/rules/stack-and-commands.md
+@.claude/rules/architecture.md
+@.claude/rules/repo-boundary.md
 @.claude/rules/credential-routing.md
+@.claude/rules/agents.md

DECISIONS.md

@@ -0,0 +1,30 @@
+# Decision Log
+
+_Auto-generated by the Custodian State Hub._
+
+## Operate at build-stage security posture; defer production policy enforcement
+
+**Date:** 2026-07-02  
+**Decided by:** human  
+
+We are in build stage with the infrastructure as a whole. We will tighten security step by step but it is not yet strictly necessary.
+
+---
+
+## SECRETS-WP-0004 — approve warden-sign auth-capability lane prod apply
+
+**Date:** 2026-07-02  
+**Decided by:** human  
+
+I want to move to more automation, this is one step needed to go on.
+
+---
+
+## Defer consumer-side contract-parity drift mode (WHYNOT-WP-0003 T09)
+
+**Date:** 2026-07-02  
+**Decided by:** human  
+
+Sufficient for now
+
+---

registry/capabilities/capability.infotech.email-connector.md

@@ -0,0 +1,118 @@
+---
+id: capability.infotech.email-connector
+name: Mailbox Evidence Scanner (email-connect)
+summary: Headless, provider-neutral email communication and evidence service; first slice scans a mailbox
+  or fixture directory and produces timestamped CSV evidence reports.
+owner: email-connect
+status: draft
+domain: infotech
+tags:
+- email
+- evidence
+- coordination
+maturity:
+  discovery:
+    current: D2
+    target: D4
+    confidence: medium
+    rationale: README documents the Mailbox Evidence Scanner MVP slice and explicitly disclaims overclaiming
+      delivery/awareness/coordination success; a coordination-engine adapter contract exists (spec/).
+  availability:
+    current: A1
+    target: A3
+    confidence: medium
+    rationale: Runnable today via `PYTHONPATH=src python3 -m email_connect.cli`; local SQLite state and
+      CSV report output; no packaged distribution or hosted service.
+external_evidence:
+  completeness:
+    level: C1
+    confidence: low
+    basis: scope_vs_intent_and_consumer_expectations
+    satisfied_expectations:
+    - mailbox/fixture scanning with classification and CSV report generation
+    - expected-recipient diffing with known_recipient/undef.no_signal diagnostics
+    broken_expectations: []
+    out_of_scope_expectations: []
+  reliability:
+    level: R0
+    confidence: low
+    basis: consumer_quality_signals
+    known_reliability_risks:
+    - first implementation slice only; broader email-connector scope from INTENT not yet built
+discovery:
+  intent: Provide provider-neutral email-channel evidence (has this address been reached? what signal
+    exists?) without overclaiming delivery or awareness.
+  includes:
+  - mailbox/fixture scanning and classification
+  - CSV evidence report generation
+  - coordination-engine adapter contract
+  excludes:
+  - actually sending email (evidence/scanning only in this slice)
+  - delivery or awareness guarantees
+  assumptions: []
+  use_cases: []
+  research_memos: []
+availability:
+  current_level: A1
+  target_level: A3
+  current_artifacts:
+  - Python CLI module (`email_connect.cli`)
+  target_artifacts: []
+  consumption_modes:
+  - cli
+relations:
+  depends_on: []
+  supports: []
+  related_to: []
+evidence:
+  documentation:
+  - README.md
+  tests:
+  - tests/
+  consumer_feedback: []
+  bug_reports: []
+  incidents: []
+consumer_guidance:
+  recommended_for:
+  - needs for email-channel evidence scanning without delivery guarantees
+  not_recommended_for:
+  - needs requiring actual outbound email sending (not in this slice)
+  known_limitations:
+  - MVP slice; state is local SQLite, not shared/service-backed yet
+promotion_history: []
+---
+
+# Mailbox Evidence Scanner (email-connect)
+
+## Overview
+
+`email-connect` is a headless, provider-neutral email evidence service. Its first slice, the Mailbox Evidence Scanner, scans a mailbox or fixture directory, classifies inbound evidence, and produces timestamped CSV reports without overclaiming delivery or coordination success.
+
+## Assessment notes
+
+### Discovery
+
+README documents the Mailbox Evidence Scanner MVP slice and explicitly disclaims overclaiming delivery/awareness/coordination success; a coordination-engine adapter contract exists (spec/).
+
+### Availability
+
+Runnable today via `PYTHONPATH=src python3 -m email_connect.cli`; local SQLite state and CSV report output; no packaged distribution or hosted service.
+
+### Completeness
+
+First-pass honest assessment from the REUSE-WP-0017 coverage campaign
+(reuse-surface). No external consumer feedback exists yet; levels reflect
+scope-vs-intent documentation quality, not internal code quality.
+
+### Reliability
+
+No production consumer telemetry exists yet; reliability level is
+intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
+
+## Promotion checklist
+
+- [x] ID follows `capability.<domain>.<name>` pattern
+- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
+- [x] `external_evidence` is populated separately from `maturity`
+- [ ] Relations reference valid capability IDs (none yet)
+- [x] Index entry added in `registry/indexes/capabilities.yaml`

registry/indexes/capabilities.yaml

@@ -1,4 +1,19 @@
 version: 1
-updated: '2026-06-16'
+updated: '2026-07-06'
 domain: helix_forge
-capabilities: []
+capabilities:
+- id: capability.infotech.email-connector
+  name: Mailbox Evidence Scanner (email-connect)
+  summary: Headless, provider-neutral email communication and evidence service; first slice scans a mailbox
+    or fixture directory and produces timestamped CSV evidence reports.
+  vector: D2 / A1 / C1 / R0
+  domain: infotech
+  status: draft
+  owner: email-connect
+  path: registry/capabilities/capability.infotech.email-connector.md
+  tags:
+  - email
+  - evidence
+  - coordination
+  consumption_modes:
+  - cli

workplans/EMAIL-WP-0001-repo-onboarding.md

@@ -2,7 +2,7 @@
 id: EMAIL-WP-0001
 type: workplan
 title: "Repository Onboarding and Implementation Foundation"
-domain: custodian
+domain: infotech
 repo: email-connect
 status: finished
 owner: codex

workplans/EMAIL-WP-0002-mvp-mailbox-evidence-scanner.md

@@ -2,7 +2,7 @@
 id: EMAIL-WP-0002
 type: workplan
 title: "MVP Mailbox Evidence Scanner"
-domain: custodian
+domain: infotech
 repo: email-connect
 status: finished
 owner: codex
@@ -653,7 +653,8 @@ This allows rescanning old messages after parser improvements.
 Initial mappings:
 
 | Parsed class              | Normalized event                            | Assessment                      |
-| ------------------------- | ------------------------------------------- | ------------------------------- |
+| ------------------------- | ------------------------------------
+------- | ------------------------------- |
 | `hard_bounce`             | `notification.endpoint.rejected_permanent`  | `fail.hard_bounce`              |
 | `soft_bounce`             | `notification.endpoint.rejected_temporary`  | `undef.deferred`                |
 | `delayed_delivery_notice` | `notification.endpoint.deferred`            | `undef.deferred`                |
@@ -672,7 +673,8 @@ The scanner should update basic endpoint quality.
 Examples:
 
 | Evidence      | Endpoint quality update                                    |
-| ------------- | ---------------------------------------------------------- |
+| ------------- | ------------------------------------
+---------------------- |
 | Hard bounce   | `reachability = unreachable`, `last_failure_at = now`      |
 | Soft bounce   | `reachability = degraded`, `last_failure_at = now`         |
 | Complaint     | `suppression_state = suppressed`                           |

workplans/EMAIL-WP-0003-expected-recipient-reporting-and-mailbox-tutorial.md

@@ -2,7 +2,7 @@
 id: EMAIL-WP-0003
 type: workplan
 title: "Expected Recipient Reporting and Mailbox Tutorial"
-domain: custodian
+domain: infotech
 repo: email-connect
 status: finished
 owner: codex