Finish REUSE-WP-0011: document hub workflow and close workplan

Hub deployed at reuse.coulomb.social (image cb7a6e4). Dogfood registration
verified; update RegistryFederation, SCOPE, and gap analysis.

docs/IntentScopeGapAnalysis.md

@@ -282,7 +282,7 @@ core commands. Individual registered capabilities may carry their own evidence
 
 | Priority | Gap | Suggested outcome | Status |
 |---|---|---|---|
-| 17 | Hosted federation hub | Hub service on `railiance01` + `reuse-surface hub` CLI | Active (WP-0011) |
+| 17 | Hosted federation hub | Hub service on `railiance01` + `reuse-surface hub` CLI | Closed (WP-0011) |
 
 ---
 
@@ -309,4 +309,5 @@ core commands. Individual registered capabilities may carry their own evidence
 | 2026-06-15 | REUSE-WP-0008 closed priority 16 (graph explorer) |
 | 2026-06-15 | REUSE-WP-0009 added pytest suite and CI fail-on-warnings; vector R3 |
 | 2026-06-15 | REUSE-WP-0010 closed priority 15 (HTTP remote federation + cache) |
-| 2026-06-15 | REUSE-WP-0011 proposed for priority 17 (hosted hub on railiance01) |
+| 2026-06-15 | REUSE-WP-0011 proposed for priority 17 (hosted hub on railiance01) |
+| 2026-06-15 | REUSE-WP-0011 closed priority 17; hub live at reuse.coulomb.social (TLS pending DNS) |

docs/RegistryFederation.md

@@ -88,20 +88,59 @@ remote sources without cache fail compose with a clear error.
 `warn` (default): duplicate IDs across sources are kept but reported as
 warnings. Consumers must inspect `source_repo` before choosing an entry.
 
+## Hosted federation hub
+
+Production hub: **`https://reuse.coulomb.social`** (Railiance `railiance01`,
+companion deploy **RAILIANCE-WP-0007**).
+
+The hub stores **repo registrations** (index URLs and metadata) and serves a
+composed federated index at `GET /v1/federated`. It does not host capability
+entry bodies — only coordinates which published indexes participate.
+
+### Register and discover via CLI
+
+```bash
+export REUSE_SURFACE_URL=https://reuse.coulomb.social
+export REUSE_SURFACE_TOKEN=<write-token>   # cluster secret reuse-surface-env
+
+reuse-surface hub status
+reuse-surface hub list
+reuse-surface hub register --repo reuse-surface \
+  --url https://gitea.coulomb.social/coulomb/reuse-surface/raw/main/registry/indexes/capabilities.yaml \
+  --domain helix_forge
+curl -fsS "$REUSE_SURFACE_URL/v1/federated" | jq '.capabilities | length'
+```
+
+Read endpoints are public; writes require `REUSE_SURFACE_TOKEN` (Bearer). API
+spec: `specs/FederationHubAPI.md`.
+
+### Hub vs local `sources.yaml`
+
+| Workflow | When to use |
+|---|---|
+| **Hub** | Shared membership across agents and repos; no per-machine `sources.yaml` edits |
+| **Local compose** | Offline development, CI with checked-in sources, or hub unavailable |
+
+Local `registry/federation/sources.yaml` remains valid for `reuse-surface
+federation compose`. Optional future: `reuse-surface hub sync` to materialize
+`sources.yaml` from hub state.
+
 ## Agent query pattern
 
-1. Run `reuse-surface federation compose` after manifest or sibling index changes.
-2. Read `registry/indexes/federated.yaml` for cross-repo discovery.
+1. **Hub path:** `GET /v1/federated` or `reuse-surface hub list` for registered
+   repos; fetch composed capabilities from the hub.
+2. **Local path:** Run `reuse-surface federation compose` after manifest or
+   sibling index changes; read `registry/indexes/federated.yaml`.
 3. Open `path` in the source repo for full entry detail when local; follow
    `source_url` / `source_index` when remote.
 4. Run `reuse-surface graph --check` before relying on relation navigation.
 
 ### Cross-repo discovery without local checkout
 
-Enable a `url` source pointing at a published raw index (Gitea, GitHub, static
-host). Set `auth_env` when the endpoint requires a token. Agents on machines
-without sibling repo clones can still compose a federated view from HTTP sources
-plus the local `reuse-surface` index.
+Register published raw index URLs on the hub, or enable a `url` source in
+`sources.yaml` pointing at Gitea/GitHub/static hosts. Set `auth_env` when the
+endpoint requires a token. Agents without sibling repo clones can discover
+capabilities from the hub or from HTTP sources plus the local index.
 
 ## Relation graphs