Normalize agent instructions and workplan frontmatter (STATE-WP-0067)

- Align agent files with on-disk workplan prefixes (infer from workplan ids)
- Set workplan domain to registered domain_slug; add topic_slug where applicable
- Repair frontmatter delimiter formatting; migrate legacy task status literals
- Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates

workplans/NET-WP-0017-it-security-readiness-for-user-onboarding.md

@@ -2,7 +2,7 @@
 id: NET-WP-0017
 type: workplan
 title: "IT Security Readiness For User Onboarding"
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: finished
 owner: codex

workplans/NET-WP-0019-t06-adjacent-user-lifecycle-dry-run-polish.md

@@ -2,7 +2,7 @@
 id: NET-WP-0019
 type: workplan
 title: "T06-adjacent Polish: Non-Root User Lifecycle Dry-Run Automation And Control Surface Improvements"
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: finished
 owner: codex
@@ -14,8 +14,7 @@ depends_on:
   - NET-WP-0018
 state_hub_workstream_id: "75d388b6-7ec1-4e1b-8c87-6ff44f953210"
 related:
-  - docs/user-engine-netkingdom-integration-assessment.md (broader user-engine vs net-kingdom fit, gaps, and recommendations)
----
+  - docs/user-engine-netkingdom-integration-assessment.md (broader user-engine vs net-kingdom fit, gaps, and recommendations)---
 
 # NET-WP-0019 - T06-adjacent Polish: Non-Root User Lifecycle Dry-Run Automation And Control Surface Improvements
 

workplans/NET-WP-0020-openbao-unseal-custody-and-ssh-automation.md

@@ -2,7 +2,7 @@
 id: NET-WP-0020
 type: workplan
 title: "OpenBao Unseal Custody Models and SSH Automation Path"
-domain: net-kingdom
+domain: infotech
 repo: net-kingdom
 status: active
 owner: codex

workplans/NK-WP-0001-sso-mfa-platform.md

@@ -2,15 +2,14 @@
 id: NK-WP-0001
 type: workplan
 title: "SSO & MFA Platform — Keycloak + privacyIDEA on Kubernetes"
-domain: netkingdom
+domain: infotech
 status: archived
 owner: worsch
 topic_slug: netkingdom
 state_hub_workstream_id: 39263c4b-ef70-4053-b782-350834b7e1be
 created: "2026-02-28"
 updated: "2026-03-21"
-superseded_by: NK-WP-0003
----
+superseded_by: NK-WP-0003---
 
 # SSO & MFA Platform — Keycloak + privacyIDEA on Kubernetes
 
@@ -148,7 +147,6 @@ systems that do not connect to the cluster Vault.
 deployed in-cluster, secrets migrated, ESO operational and injecting secrets
 into at least one test workload (0b). Encrypted ops bundle exported and
 stored offsite.
-
 ---
 
 ### T02 — Phase 1: K8s foundations (namespaces, NetworkPolicies, cert-manager)
@@ -214,7 +212,7 @@ restore drill passed.
 ```task
 id: NK-WP-0001-T04
 state_hub_task_id: 6ad1296a-a488-4031-b665-f77030e971ed
-status: cancelled
+status: cancel
 priority: high
 note: Cancelled 2026-05-20. privacyIDEA deployment superseded by NK-WP-0003-T04 (privacyIDEA now runs in the live KeyCape stack on RAILIANCE01). This Keycloak-path variant is no longer pursued.
 ```
@@ -262,7 +260,7 @@ pi-admin enrolled with MFA, trigger-admin created, rate-limiting active.
 ```task
 id: NK-WP-0001-T05
 state_hub_task_id: b9f73aa6-9035-4643-9905-64e73a29b298
-status: cancelled
+status: cancel
 priority: high
 note: Migrated to NK-WP-0011 (enterprise federation / SAML). Refined there against the deployed KeyCape stack and the OpenBao/flex-auth architecture.
 ```
@@ -296,7 +294,7 @@ custom image with privacyIDEA JAR deployed and verified.
 ```task
 id: NK-WP-0001-T06
 state_hub_task_id: 3b6379a4-a27b-4d25-82be-bc600879f036
-status: cancelled
+status: cancel
 priority: medium
 note: Migrated to NK-WP-0011 (enterprise federation / SAML).
 ```
@@ -330,7 +328,7 @@ modes handled gracefully.
 ```task
 id: NK-WP-0001-T07
 state_hub_task_id: c7cf902a-b480-4545-a536-293070945206
-status: cancelled
+status: cancel
 priority: medium
 note: Migrated to NK-WP-0011 (enterprise federation / SAML).
 ```
@@ -373,7 +371,7 @@ audit logs flowing, Keycloak resolver configured.
 ```task
 id: NK-WP-0001-T08
 state_hub_task_id: 9cbd1d89-b5bf-491e-9d16-b1c7d57076fb
-status: cancelled
+status: cancel
 priority: medium
 note: Migrated to NK-WP-0011 (enterprise federation / SAML).
 ```

workplans/NK-WP-0002-local-identity.md

@@ -2,7 +2,7 @@
 id: NK-WP-0002
 type: workplan
 title: "Local Identity — Bootstrap User Store & Minimal OIDC"
-domain: netkingdom
+domain: infotech
 status: completed
 owner: worsch
 topic_slug: netkingdom

workplans/NK-WP-0006-recursive-platform-identity-security-architecture.md

@@ -2,7 +2,7 @@
 id: NK-WP-0006
 type: workplan
 title: Recursive platform identity and security architecture
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: done
 owner: Bernd Worsch

workplans/NK-WP-0007-object-storage-sts-credential-vending.md

@@ -2,7 +2,7 @@
 id: NK-WP-0007
 type: workplan
 title: Object Storage STS Credential Vending
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: done
 owner: codex

workplans/NK-WP-0008-it-security-architecture-patterns-infospace.md

@@ -2,7 +2,7 @@
 id: NK-WP-0008
 type: workplan
 title: IT Security Architecture Patterns Infospace
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: done
 owner: codex
@@ -15,8 +15,7 @@ depends_on:
   - NK-WP-0006
 state_hub_workstream_id: "053c6d96-9396-40c9-a2e5-c36531e7810d"
 execution_repo: infospace-bench
-infospace_path: infospaces/patterns-of-it-securita-architecture
----
+infospace_path: infospaces/patterns-of-it-securita-architecture---
 
 # NK-WP-0008 - IT Security Architecture Patterns Infospace
 

workplans/NK-WP-0009-netkingdom-security-pattern-tutorials.md

@@ -2,7 +2,7 @@
 id: NK-WP-0009
 type: workplan
 title: NetKingdom Security Pattern Tutorials
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: proposed
 owner: codex

workplans/NK-WP-0010-genesis-security-pattern-completion.md

@@ -2,7 +2,7 @@
 id: NK-WP-0010
 type: workplan
 title: Genesis Security Pattern Completion
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: done
 owner: codex

workplans/NK-WP-0011-enterprise-federation-saml.md

@@ -2,7 +2,7 @@
 id: NK-WP-0011
 type: workplan
 title: "Enterprise Federation & SAML — Expanded-Mode Keycloak Identity Broker"
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: proposed
 owner: worsch
@@ -18,8 +18,7 @@ supersedes_tasks:
   - NK-WP-0001-T05
   - NK-WP-0001-T06
   - NK-WP-0001-T07
-  - NK-WP-0001-T08
----
+  - NK-WP-0001-T08---
 
 # NK-WP-0011 — Enterprise Federation & SAML (Expanded-Mode Keycloak)
 

workplans/NK-WP-0012-iam-profile-specification.md

@@ -2,7 +2,7 @@
 id: NK-WP-0012
 type: workplan
 title: "NetKingdom IAM Profile Specification"
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: finished
 owner: worsch
@@ -15,8 +15,7 @@ depends_on:
   - NK-WP-0006
 state_hub_workstream_id: 9b8e4afc-eb71-47d9-8750-799a082b320a
 enables:
-  - NK-WP-0011
----
+  - NK-WP-0011---
 
 # NK-WP-0012 — NetKingdom IAM Profile Specification
 

workplans/NK-WP-0013-playbook-capability-contract.md

@@ -2,7 +2,7 @@
 id: NK-WP-0013
 type: workplan
 title: "Playbook Capability Contract"
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: finished
 owner: worsch

workplans/NK-WP-0014-user-engine-preparation-boundary-contracts.md

@@ -2,7 +2,7 @@
 id: NK-WP-0014
 type: workplan
 title: "User Engine Preparation And Boundary Contracts"
-domain: netkingdom
+domain: infotech
 repo: net-kingdom
 status: finished
 owner: codex