feat(WP-0009): IHF GAAF Compliance Foundation — type registries, extension manifests, architectural contracts

Implements IHUB-WP-0009: closes four GAAF-2026 gaps before domain hub work begins.
- TypeRegistry helper + controllers/views (hub_kind, hub_capability_manifest)
- HubCapabilityManifest entity with validation and registry linkage
- ARCHITECTURE-LAYERS.md + CI-enforced boundary contracts
- Alembic migration 1743724800, fitness tests (Test/Architecture/)
- GAAF spec, Operational Architecture spec, domain hub extension guide
- Updates to CLAUDE.md, SCOPE.md, Schema.sql, Routes, FrontController, Types

state_hub_sync: pending (tunnel was STALE at completion time; run fix-consistency)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -108,22 +108,40 @@ Key rules:
 
 ## Active Workplan
 
-Phase 5 work is tracked in `workplans/IHUB-WP-0005-ihf-phase5-agent-assisted-distillation.md` (9 tasks, T01–T09). Use `/ralph-workplan workplans/IHUB-WP-0005-ihf-phase5-agent-assisted-distillation.md` to drive implementation loops.
+Phase 9 (External API) work is tracked in `workplans/IHUB-WP-0010-ihf-phase9-external-api.md`. Use `/ralph-workplan workplans/IHUB-WP-0010-ihf-phase9-external-api.md` to drive implementation loops.
 
-Phase 5 exit criteria:
-- AI assistance reduces triage and synthesis burden
-- Human reviewers remain in control
-- AI outputs are auditable and attributable
+Phase 9 entry gates (all satisfied by IHUB-WP-0009):
+- Four type registries seeded and validated in controllers ✓
+- `HubCapabilityManifest` table and activation workflow operational ✓
+- `/contracts/` directory with Core and Functional contract artifacts ✓
+- `ARCHITECTURE-LAYERS.md` scorecard at ≥3.3 ✓ (actual: 3.34)
+- Architectural fitness functions in CI ✓
+- `docs/domain-hub-extension-guide.md` published ✓
 
-Completed workplans: IHUB-WP-0001 (Phase 1), IHUB-WP-0002 (Phase 2), IHUB-WP-0003 (Phase 3), IHUB-WP-0004 (Phase 4).
+Completed workplans: IHUB-WP-0001 (Phase 1), IHUB-WP-0002 (Phase 2), IHUB-WP-0003 (Phase 3), IHUB-WP-0004 (Phase 4), IHUB-WP-0005 (Phase 5), IHUB-WP-0006 (Phase 6), IHUB-WP-0007 (Phase 7), IHUB-WP-0008 (Phase 8), IHUB-WP-0009 (GAAF Compliance Foundation).
+
+## GAAF Architecture Rules (enforced from IHUB-WP-0009)
+
+These rules apply to all code written after Phase 8 completion:
+
+1. **Type discriminator columns** (`widget_type`, `event_type`, `category`, `policy_scope`) must reference a registry table or carry a CHECK constraint. No bare TEXT for new type discriminators.
+2. **New hub-owned types** must be declared in the hub's `HubCapabilityManifest` before use. Register via the Extensions admin UI.
+3. **Core tables** (`widgets`, `interaction_events`, `annotations`, `hubs`, and their Phase 1–4 dependents) must not have new columns added without a corresponding update to `/contracts/core/`.
+4. **Append-only invariant** on `interaction_events` and `outcome_signals` is permanent. Never propose a migration that removes or bypasses those triggers.
 
 ## Key Reference Docs
 
 | File | Purpose |
 |------|---------|
 | `SCOPE.md` | Situational guide — in/out of scope, terminology, entry points |
-| `specs/InteractionHubFrameworkSpecification_v0.1.md` | Full IHF spec (8 phases, risks, design principles) |
+| `ARCHITECTURE-LAYERS.md` | GAAF-2026 layer map, scorecard, and compliance status |
+| `specs/InteractionHubFrameworkSpecification_v0.1.md` | Full IHF spec (Phases 0–8, risks, design principles) |
+| `specs/InteractionHubFrameworkSpecification_v0.2.md` | IHF extension spec (Phases 9–12) with GAAF foundation notes |
+| `specs/GoodSoftwareArchitectureFramework_2026.md` | GAAF-2026 standard — the architectural compliance framework |
 | `specs/TailwindForInteractionHubs_v0.2.md` | Agent-optimized Tailwind coding guide |
+| `contracts/README.md` | Contract catalog — all IHF contracts by layer |
+| `docs/domain-hub-extension-guide.md` | How to register a new domain hub (dev, ops, fin, sec) |
+| `docs/functional-modules.md` | Functional module maturity register |
 | `docs/ihp-overview.md` | IHP v1.5 fundamentals and dev workflow |
 | `docs/ihp-data-and-queries.md` | Schema design, auto-generated types, query builder, migrations |
 | `docs/ihp-controllers-views-forms.md` | Controller patterns, HSX, forms, validation, auth |
@@ -132,6 +150,6 @@ Completed workplans: IHUB-WP-0001 (Phase 1), IHUB-WP-0002 (Phase 2), IHUB-WP-000
 
 ## Related Repositories
 
-- `hub-core` — planned shared base package for domain/capability registration
+- `hub-core` — planned shared Haskell library for domain hub bootstrapping; `HubCapabilityManifest` in inter-hub provides the DB-side registration contract until hub-core is implemented
 - `the-custodian` — State Hub (decision records, workstreams) that IHF governance integrates with
-- Downstream consumers: `dev-hub`, `ops-hub`, `fin-hub`
+- Downstream consumers: `dev-hub`, `ops-hub`, `fin-hub`, `sec-hub` — must register via `HubCapabilityManifest` before creating hub-owned type discriminators