diff --git a/.claude/rules/agents.md b/.claude/rules/agents.md
new file mode 100644
index 0000000..0e8a5d9
--- /dev/null
+++ b/.claude/rules/agents.md
@@ -0,0 +1,20 @@
+## Kaizen Agents
+
+Specialized agent personas available on demand via the state-hub MCP.
+
+**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category
+**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them
+
+Common agents:
+
+| Agent | Category | When to use |
+|-------|----------|-------------|
+| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature |
+| `code-refactoring` | quality | Code quality analysis and safe refactoring |
+| `test-maintenance` | testing | Diagnose and fix failing tests |
+| `requirements-engineering` | process | Prevent interface/mock mismatches upfront |
+| `keepaTodofile` | process | Maintain TODO.md during work |
+| `project-management` | process | Track status, determine next steps |
+| `datamodel-optimization` | quality | Optimize dataclasses and data structures |
+
+All 17 agents: call `list_kaizen_agents()` for the full list.
diff --git a/.claude/rules/architecture.md b/.claude/rules/architecture.md
new file mode 100644
index 0000000..7c2a645
--- /dev/null
+++ b/.claude/rules/architecture.md
@@ -0,0 +1,8 @@
+## Architecture
+
+<!-- TODO: Describe the key design decisions and component structure.
+     Key modules, data flows, external integrations, state machines, etc. -->
+
+## Quick Reference
+
+`~/state-hub/mcp_server/TOOLS.md` — MCP tool reference
diff --git a/.claude/rules/first-session.md b/.claude/rules/first-session.md
new file mode 100644
index 0000000..47cd872
--- /dev/null
+++ b/.claude/rules/first-session.md
@@ -0,0 +1,38 @@
+## First Session Protocol
+
+Triggered when `get_domain_summary("financials")` shows **no workstreams**.
+The project is registered but work has not yet been structured.
+
+**Step 1 — Read, don't write**
+- `~/the-custodian/canon/projects/financials/project_charter_v0.1.md` — purpose, scope
+- `~/the-custodian/canon/projects/financials/roadmap_v0.1.md` — planned phases
+- Scan repo root: README, directory structure, existing code or docs
+
+**Step 2 — Survey in-progress work**
+Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete.
+
+**Step 3 — Propose workstreams to Bernd**
+Propose 1–3 workstreams — each a coherent strand, weeks to months, anchored to a
+roadmap phase. **Wait for approval before creating.**
+
+**Step 4 — Create workplan file first, then DB record (ADR-001)**
+```
+workplans/FORGE-WP-NNNN-<slug>.md   ← write this first
+```
+Then register in the hub:
+```
+create_workstream(topic_id="ca369340-a64e-442e-98f1-a4fa7dc74a38", title="...", owner="...", description="...")
+create_task(workstream_id="<id>", title="...", priority="high|medium|low")
+```
+
+**Step 5 — Record the setup**
+```
+add_progress_event(
+    summary="First session: structured financials into N workstreams, M tasks",
+    event_type="milestone",
+    topic_id="ca369340-a64e-442e-98f1-a4fa7dc74a38",
+    detail={"workstreams": [...], "tasks_created": M}
+)
+```
+
+<!-- Delete or archive this file once past first session -->
diff --git a/.claude/rules/repo-boundary.md b/.claude/rules/repo-boundary.md
new file mode 100644
index 0000000..c285418
--- /dev/null
+++ b/.claude/rules/repo-boundary.md
@@ -0,0 +1,8 @@
+## Repo boundary
+
+This repo owns **railiance-forge** only. It does not own:
+
+<!-- TODO: List what belongs in adjacent repos, e.g.:
+- SSH key management → railiance-infra/
+- State hub code     → state-hub/
+-->
diff --git a/.claude/rules/repo-identity.md b/.claude/rules/repo-identity.md
new file mode 100644
index 0000000..84122df
--- /dev/null
+++ b/.claude/rules/repo-identity.md
@@ -0,0 +1,5 @@
+**Purpose:** Railiance forge and artifact infrastructure: current Gitea operation, future Forgejo migration, container/package registries, runner substrate, artifact lifecycle, and forge operating evidence.
+
+**Domain:** financials
+**Repo slug:** railiance-forge
+**Topic ID:** ca369340-a64e-442e-98f1-a4fa7dc74a38
diff --git a/.claude/rules/session-protocol.md b/.claude/rules/session-protocol.md
new file mode 100644
index 0000000..fe2f48d
--- /dev/null
+++ b/.claude/rules/session-protocol.md
@@ -0,0 +1,85 @@
+## Session Protocol
+
+Dev Hub (State Hub API): http://127.0.0.1:8000
+MCP server name in `~/.claude.json`: `dev-hub`
+
+**Step 1 — Orient**
+
+Read the offline-safe brief first — it works without a live hub connection:
+```bash
+cat .custodian-brief.md
+```
+Then call the MCP tool for richer cross-domain context when MCP tools are exposed:
+```
+get_domain_summary("financials")
+```
+If MCP tools are unavailable in the current agent session, use the REST API:
+```bash
+curl -s "http://127.0.0.1:8000/state/summary" | python3 -m json.tool
+```
+If the hub is offline: `cd ~/state-hub && make api`
+
+**Step 2 — Check inbox**
+With MCP tools:
+```
+get_messages(to_agent="railiance-forge", unread_only=True)
+```
+Mark read with `mark_message_read(message_id)`. Reply or act on coordination
+requests before proceeding.
+
+Without MCP tools:
+```bash
+curl -s "http://127.0.0.1:8000/messages/?to_agent=railiance-forge&unread_only=true" \
+  | python3 -m json.tool
+curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
+  -H "Content-Type: application/json" -d '{}'
+```
+
+**Step 3 — Scan workplans**
+```bash
+ls workplans/
+```
+For each file with `status: ready`, `active`, or `blocked`, note pending
+`wait`/`todo`/`progress` tasks.
+
+**Step 4 — Present brief**
+
+1. **Active workstreams** for `financials` — title, task counts, blocking decisions
+2. **Pending tasks** from `workplans/` + any `[repo:railiance-forge]` hub tasks
+3. **Goal guidance** — if `goal_guidance` in summary:
+   - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
+   - `alignment_warnings`: flag if active work is not aligned with current goal
+4. **Suggested next action** — highest-priority open item
+5. **SBOM status** — flag if `last_sbom_at` is unset for this repo
+
+If no workstreams: follow First Session Protocol (`first-session.md`).
+
+**During work:** `record_decision()` · `add_progress_event()` · `resolve_decision()`
+
+> State Hub is a *read model*. Bootstrap tools (`create_workstream`, `create_task`)
+> are First Session Protocol only. Work structure belongs in repo files (ADR-001).
+
+**Session close:**
+With MCP tools:
+```
+add_progress_event(summary="...", topic_id="ca369340-a64e-442e-98f1-a4fa7dc74a38", workstream_id="<uuid>")
+```
+Without MCP tools:
+```bash
+curl -s -X POST http://127.0.0.1:8000/progress/ \
+  -H "Content-Type: application/json" \
+  -d '{"topic_id":"ca369340-a64e-442e-98f1-a4fa7dc74a38","workstream_id":"<uuid>","event_type":"note","summary":"what changed","author":"codex"}'
+```
+If workplan files were modified, ensure the local copy is up to date first:
+```bash
+git -C <repo_path> pull --ff-only
+cd ~/state-hub && make fix-consistency REPO=railiance-forge
+```
+For repos where implementation runs on a remote machine (e.g. CoulombCore),
+use the combined target which pulls before fixing:
+```bash
+cd ~/state-hub && make fix-consistency-remote REPO=railiance-forge
+```
+**C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
+will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes
+until you pull — intentional to prevent clobbering remote progress.
diff --git a/.claude/rules/stack-and-commands.md b/.claude/rules/stack-and-commands.md
new file mode 100644
index 0000000..dc53ac6
--- /dev/null
+++ b/.claude/rules/stack-and-commands.md
@@ -0,0 +1,19 @@
+## Stack
+
+<!-- TODO: Fill in language, frameworks, and key dependencies -->
+- **Language:**
+- **Key deps:**
+
+## Dev Commands
+
+```bash
+# TODO: Fill in the standard commands for this repo
+
+# Install dependencies
+
+# Run tests
+
+# Lint / type check
+
+# Build / package (if applicable)
+```
diff --git a/.claude/rules/workplan-convention.md b/.claude/rules/workplan-convention.md
new file mode 100644
index 0000000..dcd3bb9
--- /dev/null
+++ b/.claude/rules/workplan-convention.md
@@ -0,0 +1,40 @@
+## Workplan Convention (ADR-001)
+
+File location: `workplans/FORGE-WP-NNNN-<slug>.md`
+ID prefix: `FORGE-WP-`
+
+Work items originate as files in this repo **before** being registered in the hub.
+
+Canonical workplan/workstream frontmatter statuses are:
+`proposed`, `ready`, `active`, `blocked`, `backlog`, `finished`, `archived`.
+Use `proposed` for a newly drafted plan, `ready` after review against current
+repo state, and `finished` when implementation is complete. `stalled` and
+`needs_review` are derived health labels, not stored statuses.
+
+Closed workplans may be moved to `workplans/archived/` with a completion-date
+prefix: `YYMMDD-FORGE-WP-NNNN-<slug>.md`. The frontmatter id remains
+unchanged; the prefix is only for quick visual reference.
+
+Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**:
+`workplans/ADHOC-YYYY-MM-DD.md`, workstream slug `adhoc-YYYY-MM-DD`, and task ids
+`ADHOC-YYYY-MM-DD-T01`, `T02`, etc. Use adhocs only for low-risk work completed
+directly. Promote anything requiring analysis, design, approval, dependencies, or
+multiple planned phases into a normal workplan.
+
+Ecosystem todos from other agents arrive as `[repo:railiance-forge]` hub tasks —
+visible at session start. Pick one up by creating the workplan file, then registering
+the workstream.
+
+Task blocks use this shape:
+
+```task
+id: FORGE-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+```
+
+Status progression is `todo` → `progress` → `done`; use `wait` for waiting or
+blocked work and `cancel` for stopped work.
+
+<!-- Ralph Loop rules and HEUREKA sequence: ~/.claude/CLAUDE.md — do not duplicate here -->
diff --git a/AGENTS.md b/AGENTS.md
index 3a89c44..ed75642 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,12 +1,10 @@
-# railiance-forge - Agent Instructions
+# railiance-forge — Agent Instructions
 
 ## Repo Identity
 
-**Purpose:** Railiance forge and artifact infrastructure - source forge runtime,
-container/package registries, forge-backed runner substrate, artifact lifecycle,
-and future Forgejo migration.
+**Purpose:** Railiance forge and artifact infrastructure: current Gitea operation, future Forgejo migration, container/package registries, runner substrate, artifact lifecycle, and forge operating evidence.
 
-**Domain:** railiance
+**Domain:** financials
 **Repo slug:** railiance-forge
 **Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38`
 **Workplan prefix:** `FORGE-WP-`
@@ -15,7 +13,7 @@ and future Forgejo migration.
 
 ## State Hub Integration
 
-The Custodian State Hub tracks work across all domains. Interact via HTTP REST -
+The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
 there is no MCP server for Codex agents.
 
 | Context | URL |
@@ -26,23 +24,25 @@ there is no MCP server for Codex agents.
 ### Orient at session start
 
 ```bash
+# Offline brief — works without hub connection
 cat .custodian-brief.md
 
+# Active workstreams for this domain
 curl -s "http://127.0.0.1:8000/workstreams/?topic_id=ca369340-a64e-442e-98f1-a4fa7dc74a38&status=active" \
   | python3 -m json.tool
 
+# Check inbox
 curl -s "http://127.0.0.1:8000/messages/?to_agent=railiance-forge&unread_only=true" \
   | python3 -m json.tool
 ```
 
 Mark a message read:
-
 ```bash
 curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
   -H "Content-Type: application/json" -d '{}'
 ```
 
-### Log progress at session close
+### Log progress (required at session close)
 
 ```bash
 curl -s -X POST http://127.0.0.1:8000/progress/ \
@@ -64,10 +64,9 @@ Omit `workstream_id` / `task_id` when not applicable.
 curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
   -H "Content-Type: application/json" \
   -d '{"status": "progress"}'
+# values: wait | todo | progress | done | cancel
 ```
 
-Canonical task values: `wait | todo | progress | done | cancel`.
-
 ### Flag a task for human review
 
 ```bash
@@ -81,46 +80,24 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
 ## Session Protocol
 
 **Start:**
-
-1. `cat .custodian-brief.md` - domain goal and open workstreams.
-2. Check inbox:
-   `GET /messages/?to_agent=railiance-forge&unread_only=true`; mark read.
-3. Scan workplans: `ls workplans/` and note `ready`, `active`, or `blocked`
-   workplans and open tasks.
-4. Check blocked tasks: `GET /tasks/?needs_human=true`.
+1. `cat .custodian-brief.md` — domain goal and open workstreams (offline-safe)
+2. Check inbox: `GET /messages/?to_agent=railiance-forge&unread_only=true`; mark read
+3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
+4. Check human-needed tasks: `GET /tasks/?needs_human=true`
 
 **During work:**
-
-- Update task statuses in workplan files as tasks progress.
-- Record significant decisions via `POST /decisions/`.
-- Keep forge responsibilities separate from S4 templates and S5 app releases.
-
-## Verification Commands
-
-This repo currently contains documentation, workplans, and read-only operator
-entry points. There is no app build, package install, or unit-test command yet.
-
-Use these checks for ordinary edits:
-
-```bash
-git diff --check
-make registry-docs
-make check-tools
-make -C /home/worsch/state-hub fix-consistency REPO=railiance-forge
-```
-
-`make gitea-status` is read-only but requires a kubeconfig pointed at a
-representative Railiance cluster.
+- Update task statuses in workplan files as tasks progress
+- Record significant decisions via `POST /decisions/`
 
 **Close:**
-
-1. Update workplan file task statuses.
-2. Log progress with `POST /progress/`.
-3. After workplan file changes, run from `~/state-hub`:
-
+1. Update workplan file task statuses to reflect progress
+2. Log: `POST /progress/` with a summary of what changed
+3. Note for the custodian operator: after workplan file changes, run from
+   `~/state-hub`:
    ```bash
    make fix-consistency REPO=railiance-forge
    ```
+   This syncs task status from files into the hub DB.
 
 ---
 
@@ -174,70 +151,69 @@ every repo's agent instructions because it is high-frequency, high-risk, and eas
 get wrong.
 
 **Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
+
+<!-- REPO-AGENTS-EXTENSIONS -->
+<!-- Append repo-specific agent instructions below this marker.
+     The state-hub template sync preserves content after this line. -->
+
 ---
 
-## Workplan Convention
+## Workplan Convention (ADR-001)
 
-Work items originate as files in this repo. State Hub indexes those files as
-workstreams and task blocks.
+Work items originate as files in this repo — not in the hub. The hub is a
+read/cache/index layer that rebuilds from files.
 
-**File location:** `workplans/FORGE-WP-NNNN-<slug>.md`
+**File location:** `workplans/RAILIANCE-WP-NNNN-<slug>.md`
 
-**Archived location:** `workplans/archived/YYMMDD-FORGE-WP-NNNN-<slug>.md`
+**Archived location:** finished workplans may move to
+`workplans/archived/YYMMDD-RAILIANCE-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
+the completion/archive date; the frontmatter `id` does not change.
+
+**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
+`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use
+this only for low-risk work completed directly; create a normal workplan for
+anything needing analysis, design, approval, dependencies, or multiple phases.
 
 **Frontmatter:**
 
 ```yaml
 ---
-id: FORGE-WP-NNNN
+id: RAILIANCE-WP-NNNN
 type: workplan
 title: "..."
-domain: railiance
+domain: financials
 repo: railiance-forge
 status: proposed | ready | active | blocked | backlog | finished | archived
 owner: codex
-topic_slug: railiance
+topic_slug: ...
 created: "YYYY-MM-DD"
 updated: "YYYY-MM-DD"
-state_hub_workstream_id: "<uuid>"   # written by fix-consistency - do not edit
+state_hub_workstream_id: "<uuid>"   # written by fix-consistency — do not edit
 ---
 ```
 
-**Task block format:**
+Use `proposed` for a new draft, `ready` after review against current repo
+state, and `finished` after implementation. `stalled` and `needs_review` are
+derived health labels, not frontmatter statuses.
 
-````text
+**Task block format** (one per `##` section):
+
+```
 ## Task Title
 
-```task
-id: FORGE-WP-NNNN-T01
-status: todo | progress | done | wait | cancel
+` ` `task
+id: RAILIANCE-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
 priority: high | medium | low
-state_hub_task_id: "<uuid>"         # written by fix-consistency - do not edit
-```
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+` ` `
 
 Task description text.
-````
+```
 
-Status progression: `todo` -> `progress` -> `done`, or `wait` / `cancel`.
+Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.
 
 To create a new workplan:
-
-1. Write the file following the format above.
-2. Run from `~/state-hub`:
-
-   ```bash
-   make fix-consistency REPO=railiance-forge
-   ```
-
----
-
-## Repository Boundaries
-
-This repo owns forge runtime and artifact infrastructure. It does not own:
-
-- OS/host provisioning (`railiance-infra`);
-- Kubernetes runtime primitives (`railiance-cluster`);
-- shared database/storage/secret platforms (`railiance-platform`);
-- generic CI/CD templates and developer portal paths (`railiance-enablement`);
-- user-facing application releases (`railiance-apps`);
-- source application code.
+1. Write the file following the format above
+2. Notify the custodian operator to run `make fix-consistency REPO=railiance-forge`
+   (or send a message to the hub agent via `POST /messages/`)
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..aa1d61e
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,12 @@
+# railiance-forge — Claude Code Instructions
+
+@SCOPE.md
+@.claude/rules/repo-identity.md
+@.claude/rules/session-protocol.md
+@.claude/rules/first-session.md
+@.claude/rules/workplan-convention.md
+@.claude/rules/stack-and-commands.md
+@.claude/rules/architecture.md
+@.claude/rules/repo-boundary.md
+@.claude/rules/credential-routing.md
+@.claude/rules/agents.md
diff --git a/workplans/FORGE-WP-0001-repository-foundation.md b/workplans/FORGE-WP-0001-repository-foundation.md
index b34676e..7cb765c 100644
--- a/workplans/FORGE-WP-0001-repository-foundation.md
+++ b/workplans/FORGE-WP-0001-repository-foundation.md
@@ -2,7 +2,7 @@
 id: FORGE-WP-0001
 type: workplan
 title: "railiance-forge repository foundation"
-domain: railiance
+domain: financials
 repo: railiance-forge
 status: finished
 owner: codex
diff --git a/workplans/FORGE-WP-0002-registry-docs-and-readonly-ops.md b/workplans/FORGE-WP-0002-registry-docs-and-readonly-ops.md
index bf21513..c97127a 100644
--- a/workplans/FORGE-WP-0002-registry-docs-and-readonly-ops.md
+++ b/workplans/FORGE-WP-0002-registry-docs-and-readonly-ops.md
@@ -2,7 +2,7 @@
 id: FORGE-WP-0002
 type: workplan
 title: "Canonical registry docs and read-only forge operations"
-domain: railiance
+domain: financials
 repo: railiance-forge
 status: finished
 owner: codex
diff --git a/workplans/FORGE-WP-0003-actions-runner-substrate.md b/workplans/FORGE-WP-0003-actions-runner-substrate.md
index 16779fc..9a28b1b 100644
--- a/workplans/FORGE-WP-0003-actions-runner-substrate.md
+++ b/workplans/FORGE-WP-0003-actions-runner-substrate.md
@@ -2,7 +2,7 @@
 id: FORGE-WP-0003
 type: workplan
 title: "Gitea Actions runner substrate for Railiance workloads"
-domain: railiance
+domain: financials
 repo: railiance-forge
 status: finished
 owner: codex
diff --git a/workplans/FORGE-WP-0004-public-gitea-root-endpoint.md b/workplans/FORGE-WP-0004-public-gitea-root-endpoint.md
index cf86955..b510fa9 100644
--- a/workplans/FORGE-WP-0004-public-gitea-root-endpoint.md
+++ b/workplans/FORGE-WP-0004-public-gitea-root-endpoint.md
@@ -2,7 +2,7 @@
 id: FORGE-WP-0004
 type: workplan
 title: "Standard public Gitea HTTPS root endpoint"
-domain: railiance
+domain: financials
 repo: railiance-forge
 status: finished
 owner: codex
diff --git a/workplans/FORGE-WP-0005-remove-gitea-nodeport-side-door.md b/workplans/FORGE-WP-0005-remove-gitea-nodeport-side-door.md
index f2cfb1d..a914b86 100644
--- a/workplans/FORGE-WP-0005-remove-gitea-nodeport-side-door.md
+++ b/workplans/FORGE-WP-0005-remove-gitea-nodeport-side-door.md
@@ -2,7 +2,7 @@
 id: FORGE-WP-0005
 type: workplan
 title: "Remove public Gitea NodePort side door"
-domain: railiance
+domain: financials
 repo: railiance-forge
 status: finished
 owner: codex