diff --git a/.claude/rules/agents.md b/.claude/rules/agents.md
new file mode 100644
index 0000000..0e8a5d9
--- /dev/null
+++ b/.claude/rules/agents.md
@@ -0,0 +1,20 @@
+## Kaizen Agents
+
+Specialized agent personas available on demand via the state-hub MCP.
+
+**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category
+**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them
+
+Common agents:
+
+| Agent | Category | When to use |
+|-------|----------|-------------|
+| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature |
+| `code-refactoring` | quality | Code quality analysis and safe refactoring |
+| `test-maintenance` | testing | Diagnose and fix failing tests |
+| `requirements-engineering` | process | Prevent interface/mock mismatches upfront |
+| `keepaTodofile` | process | Maintain TODO.md during work |
+| `project-management` | process | Track status, determine next steps |
+| `datamodel-optimization` | quality | Optimize dataclasses and data structures |
+
+All 17 agents: call `list_kaizen_agents()` for the full list.
diff --git a/.claude/rules/architecture.md b/.claude/rules/architecture.md
new file mode 100644
index 0000000..4f6c74c
--- /dev/null
+++ b/.claude/rules/architecture.md
@@ -0,0 +1,8 @@
+## Architecture
+
+<!-- TODO: Describe the key design decisions and component structure.
+     Key modules, data flows, external integrations, state machines, etc. -->
+
+## Quick Reference
+
+`~/the-custodian/state-hub/mcp_server/TOOLS.md` — MCP tool reference
diff --git a/.claude/rules/first-session.md b/.claude/rules/first-session.md
new file mode 100644
index 0000000..2513b6f
--- /dev/null
+++ b/.claude/rules/first-session.md
@@ -0,0 +1,38 @@
+## First Session Protocol
+
+Triggered when `get_domain_summary("stack")` shows **no workstreams**.
+The project is registered but work has not yet been structured.
+
+**Step 1 — Read, don't write**
+- `~/the-custodian/canon/projects/stack/project_charter_v0.1.md` — purpose, scope
+- `~/the-custodian/canon/projects/stack/roadmap_v0.1.md` — planned phases
+- Scan repo root: README, directory structure, existing code or docs
+
+**Step 2 — Survey in-progress work**
+Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete.
+
+**Step 3 — Propose workstreams to Bernd**
+Propose 1–3 workstreams — each a coherent strand, weeks to months, anchored to a
+roadmap phase. **Wait for approval before creating.**
+
+**Step 4 — Create workplan file first, then DB record (ADR-001)**
+```
+workplans/ihp-railiance-probe-WP-NNNN-<slug>.md   ← write this first
+```
+Then register in the hub:
+```
+create_workstream(topic_id="(none)", title="...", owner="...", description="...")
+create_task(workstream_id="<id>", title="...", priority="high|medium|low")
+```
+
+**Step 5 — Record the setup**
+```
+add_progress_event(
+    summary="First session: structured stack into N workstreams, M tasks",
+    event_type="milestone",
+    topic_id="(none)",
+    detail={"workstreams": [...], "tasks_created": M}
+)
+```
+
+<!-- Delete or archive this file once past first session -->
diff --git a/.claude/rules/repo-boundary.md b/.claude/rules/repo-boundary.md
new file mode 100644
index 0000000..f0ab07a
--- /dev/null
+++ b/.claude/rules/repo-boundary.md
@@ -0,0 +1,8 @@
+## Repo boundary
+
+This repo owns **ihp-railiance-probe** only. It does not own:
+
+<!-- TODO: List what belongs in adjacent repos, e.g.:
+- SSH key management → railiance-infra/
+- State hub code     → the-custodian/state-hub/
+-->
diff --git a/.claude/rules/repo-identity.md b/.claude/rules/repo-identity.md
new file mode 100644
index 0000000..5dcb307
--- /dev/null
+++ b/.claude/rules/repo-identity.md
@@ -0,0 +1,6 @@
+**Purpose:** ihp-railiance-probe — (fill in purpose)
+
+**Domain:** stack
+**Repo slug:** ihp-railiance-probe
+**Topic slug:** stack
+**Topic ID:** 595afc64-bd28-47bf-aafb-ba230b28371b
diff --git a/.claude/rules/session-protocol.md b/.claude/rules/session-protocol.md
new file mode 100644
index 0000000..5c3dd6d
--- /dev/null
+++ b/.claude/rules/session-protocol.md
@@ -0,0 +1,63 @@
+## Session Protocol
+
+State Hub: http://127.0.0.1:8000
+
+**Step 1 — Orient**
+
+Read the offline-safe brief first — it works without a live hub connection:
+```bash
+cat .custodian-brief.md
+```
+Then call the MCP tool for richer cross-domain context (skip if unreachable):
+```
+get_domain_summary("stack")
+```
+If the hub is offline: `cd ~/the-custodian/state-hub && make api`
+
+**Step 2 — Check inbox**
+```
+get_messages(to_agent="ihp-railiance-probe", unread_only=True)
+```
+Mark read with `mark_message_read(message_id)`. Reply or act on coordination
+requests before proceeding.
+
+**Step 3 — Scan workplans**
+```bash
+ls workplans/
+```
+For each file with `status: active`, note pending `todo`/`in_progress` tasks.
+
+**Step 4 — Present brief**
+
+1. **Active workstreams** for `stack` — title, task counts, blocking decisions
+2. **Pending tasks** from `workplans/` + any `[repo:ihp-railiance-probe]` hub tasks
+3. **Goal guidance** — if `goal_guidance` in summary:
+   - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
+   - `alignment_warnings`: flag if active work is not aligned with current goal
+4. **Suggested next action** — highest-priority open item
+5. **SBOM status** — flag if `last_sbom_at` is unset for this repo
+
+If no workstreams: follow First Session Protocol (`first-session.md`).
+
+**During work:** `record_decision()` · `add_progress_event()` · `resolve_decision()`
+
+> State Hub is a *read model*. Bootstrap tools (`create_workstream`, `create_task`)
+> are First Session Protocol only. Work structure belongs in repo files (ADR-001).
+
+**Session close:**
+```
+add_progress_event(summary="...", topic_id="(none)", workstream_id="<uuid>")
+```
+If workplan files were modified, ensure the local copy is up to date first:
+```bash
+git -C <repo_path> pull --ff-only
+cd ~/the-custodian/state-hub && make fix-consistency REPO=ihp-railiance-probe
+```
+For repos where implementation runs on a remote machine (e.g. CoulombCore),
+use the combined target which pulls before fixing:
+```bash
+cd ~/the-custodian/state-hub && make fix-consistency-remote REPO=ihp-railiance-probe
+```
+**C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
+will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes
+until you pull — intentional to prevent clobbering remote progress.
diff --git a/.claude/rules/stack-and-commands.md b/.claude/rules/stack-and-commands.md
new file mode 100644
index 0000000..dc53ac6
--- /dev/null
+++ b/.claude/rules/stack-and-commands.md
@@ -0,0 +1,19 @@
+## Stack
+
+<!-- TODO: Fill in language, frameworks, and key dependencies -->
+- **Language:**
+- **Key deps:**
+
+## Dev Commands
+
+```bash
+# TODO: Fill in the standard commands for this repo
+
+# Install dependencies
+
+# Run tests
+
+# Lint / type check
+
+# Build / package (if applicable)
+```
diff --git a/.claude/rules/workplan-convention.md b/.claude/rules/workplan-convention.md
new file mode 100644
index 0000000..12a60e3
--- /dev/null
+++ b/.claude/rules/workplan-convention.md
@@ -0,0 +1,22 @@
+## Workplan Convention (ADR-001)
+
+File location: `workplans/ihp-railiance-probe-WP-NNNN-<slug>.md`
+ID prefix: `IHP-WP`
+
+Work items originate as files in this repo **before** being registered in the hub.
+
+Closed workplans may be moved to `workplans/archived/` with a completion-date
+prefix: `YYMMDD-ihp-railiance-probe-WP-NNNN-<slug>.md`. The frontmatter id remains
+unchanged; the prefix is only for quick visual reference.
+
+Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**:
+`workplans/ADHOC-YYYY-MM-DD.md`, workstream slug `adhoc-YYYY-MM-DD`, and task ids
+`ADHOC-YYYY-MM-DD-T01`, `T02`, etc. Use adhocs only for low-risk work completed
+directly. Promote anything requiring analysis, design, approval, dependencies, or
+multiple planned phases into a normal workplan.
+
+Ecosystem todos from other agents arrive as `[repo:ihp-railiance-probe]` hub tasks —
+visible at session start. Pick one up by creating the workplan file, then registering
+the workstream.
+
+<!-- Ralph Loop rules and HEUREKA sequence: ~/.claude/CLAUDE.md — do not duplicate here -->
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..3cd517a
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,11 @@
+# ihp-railiance-probe — Claude Code Instructions
+
+@SCOPE.md
+@.claude/rules/repo-identity.md
+@.claude/rules/session-protocol.md
+@.claude/rules/first-session.md
+@.claude/rules/workplan-convention.md
+@.claude/rules/stack-and-commands.md
+@.claude/rules/architecture.md
+@.claude/rules/repo-boundary.md
+@.claude/rules/agents.md
diff --git a/SCOPE.md b/SCOPE.md
new file mode 100644
index 0000000..d48e39a
--- /dev/null
+++ b/SCOPE.md
@@ -0,0 +1,137 @@
+# SCOPE
+
+> This file helps you quickly understand what this repository is about,
+> when it is relevant, and when it is not.
+> It is intentionally lightweight and may be incomplete.
+
+---
+
+## One-liner
+
+<!-- Describe the purpose of this repository in one precise sentence. -->
+<!-- Example: "Provides a lightweight event router for Kubernetes-native systems." -->
+
+---
+
+## Core Idea
+
+<!-- What is the main capability or idea behind this repository? -->
+<!-- What problem does it try to solve? -->
+
+---
+
+## In Scope
+
+<!-- What this repository is responsible for. -->
+<!-- Be explicit and concrete. -->
+
+-
+-
+-
+
+---
+
+## Out of Scope
+
+<!-- What this repository deliberately does NOT do. -->
+<!-- This is often more important than "In Scope". -->
+
+-
+-
+-
+
+---
+
+## Relevant When
+
+<!-- When should someone consider using or exploring this repository? -->
+
+-
+-
+-
+
+---
+
+## Not Relevant When
+
+<!-- When should someone ignore this repository? -->
+
+-
+-
+-
+
+---
+
+## Current State
+
+<!-- Rough indication of maturity. No strict format required. -->
+
+- Status: <!-- e.g. concept / experimental / active / stable / deprecated -->
+- Implementation: <!-- e.g. idea / partial / substantial / complete -->
+- Stability: <!-- e.g. unstable / evolving / stable -->
+- Usage: <!-- e.g. none / personal / internal / production -->
+
+<!-- Add any notes that help set expectations. -->
+
+---
+
+## How It Fits
+
+<!-- Where does this repository sit in the bigger picture? -->
+
+- Upstream dependencies:
+- Downstream consumers:
+- Often used with:
+
+---
+
+## Terminology
+
+<!-- Terms that are important to understand this repo. -->
+<!-- Especially useful if naming differs from other repos. -->
+
+- Preferred terms:
+- Also known as:
+- Potentially confusing terms:
+
+---
+
+## Related / Overlapping Repositories
+
+<!-- List repositories that have similar or adjacent responsibilities. -->
+<!-- Helps detect duplication and navigate the ecosystem. -->
+
+- <repo-name> — <!-- how it relates -->
+
+---
+
+## Getting Oriented
+
+<!-- If someone decides to look deeper, where should they start? -->
+
+- Start with:
+- Key files / directories:
+- Entry points:
+
+---
+
+## Provided Capabilities
+
+<!-- What can this repo's domain provide to other domains on request? -->
+<!-- Each capability block is parsed by the state-hub capability catalog ingest. -->
+<!-- Remove the examples and add your own, or leave empty if none. -->
+
+<!--
+```capability
+type: infrastructure
+title: Example capability title
+description: What this capability provides, in one or two sentences.
+keywords: [keyword1, keyword2, keyword3]
+```
+-->
+
+---
+
+## Notes
+
+<!-- Anything else worth knowing. Keep it short. -->
diff --git a/workplans/IRP-WP-0001-pipeline-validation.md b/workplans/IRP-WP-0001-pipeline-validation.md
index 0cb50b9..9385bc4 100644
--- a/workplans/IRP-WP-0001-pipeline-validation.md
+++ b/workplans/IRP-WP-0001-pipeline-validation.md
@@ -2,12 +2,13 @@
 id: IRP-WP-0001
 type: workplan
 title: "ihp-railiance-probe — Full Pipeline Validation"
-domain: coulomb
+domain: stack
 repo: ihp-railiance-probe
 status: todo
 owner: tegwick
 created: "2026-05-02"
 updated: "2026-05-02"
+state_hub_workstream_id: "dce43c1c-1a4c-4b8d-aeb1-7755c9243a38"
 ---
 
 # ihp-railiance-probe — Full Pipeline Validation
@@ -43,6 +44,7 @@ to diagnose. See `INTENT.md` and `DeploymentBlueprint.md` for full context.
 id: IRP-WP-0001-T01
 status: todo
 priority: high
+state_hub_task_id: "dfaeada0-97fd-454a-99c6-98186419cbc9"
 ```
 
 Copy `flake.nix` from `inter-hub` as the starting point and strip it down to
@@ -69,6 +71,7 @@ the probe's minimal package set:
 id: IRP-WP-0001-T02
 status: todo
 priority: high
+state_hub_task_id: "d982d0a1-ba48-481f-bb2e-dfc0126d36d9"
 ```
 
 Bootstrap the IHP project skeleton inside the repo:
@@ -95,6 +98,7 @@ welcome page or a minimal home view.
 id: IRP-WP-0001-T03
 status: todo
 priority: high
+state_hub_task_id: "675210b9-0e4e-4c08-882a-09ccc19c1854"
 ```
 
 Define one schema table in `Application/Schema.sql`:
@@ -125,6 +129,7 @@ Steps:
 id: IRP-WP-0001-T04
 status: todo
 priority: high
+state_hub_task_id: "4fba285f-ca9c-4f53-8474-d418ab8b4e1b"
 ```
 
 Add a minimal `/healthz` route that returns `200 OK` with body `"ok"`:
@@ -155,6 +160,7 @@ Add a minimal `/healthz` route that returns `200 OK` with body `"ok"`:
 id: IRP-WP-0001-T05
 status: todo
 priority: high
+state_hub_task_id: "0555d8ec-3179-4f49-9e80-c1a43d37c7fa"
 ```
 
 Write the test *before* adding any Probes CRUD (test-first proof):
@@ -187,6 +193,7 @@ Write the test *before* adding any Probes CRUD (test-first proof):
 id: IRP-WP-0001-T06
 status: todo
 priority: high
+state_hub_task_id: "6007fdde-3b03-4c7a-ae4e-2106cadd6a56"
 ```
 
 First `nix build .#docker` on haskelseed for the probe:
@@ -221,6 +228,7 @@ Monitor with tail; expect 30-50 min on first build (no cache).
 id: IRP-WP-0001-T07
 status: todo
 priority: medium
+state_hub_task_id: "24b892fa-2a81-4606-b7a8-20e493c89441"
 ```
 
 Push the built image to the Gitea container registry:
@@ -248,6 +256,7 @@ skopeo inspect docker://92.205.130.254:32166/coulomb/ihp-railiance-probe:<SHA>
 id: IRP-WP-0001-T08
 status: todo
 priority: medium
+state_hub_task_id: "06eb278b-8ff6-4123-a2e3-856dc44ed275"
 ```
 
 Create a minimal Helm chart in `chart/`:
@@ -282,6 +291,7 @@ Commit the chart.
 id: IRP-WP-0001-T09
 status: todo
 priority: medium
+state_hub_task_id: "97f50f12-3511-408f-a049-9300241344b8"
 ```
 
 Configure k3s to pull from the HTTP (non-TLS) Gitea registry:
@@ -315,6 +325,7 @@ Verify: `sudo k3s crictl pull 92.205.130.254:32166/coulomb/ihp-railiance-probe:<
 id: IRP-WP-0001-T10
 status: todo
 priority: medium
+state_hub_task_id: "7c79c843-5497-4d88-985d-a915145691cd"
 ```
 
 Deploy the probe to the `coulomb` namespace:
@@ -351,6 +362,7 @@ curl http://<cluster-ip>/healthz   # ok
 id: IRP-WP-0001-T11
 status: todo
 priority: medium
+state_hub_task_id: "cb2b1ee7-6c54-48b5-8cd8-b4fcb8fa07ab"
 ```
 
 Verify the full pipeline produced a live application:
@@ -373,6 +385,7 @@ Verify the full pipeline produced a live application:
 id: IRP-WP-0001-T12
 status: todo
 priority: low
+state_hub_task_id: "0bf9c616-54e6-48f3-ae6d-d91a9f7517c9"
 ```
 
 Automate the build → push → deploy pipeline via Gitea Actions: