feat(federation): register config-atlas and reserve surface.* namespace

Add config-atlas as a federation source (capability index) and to the local
repo roster. Document surface.* as a distinct id namespace owned by
config-atlas (typed sibling of capability.*, not federated here) under a new
"Id namespace ownership" section. Raw URL currently 303 (required:false), same
publish block as state-hub/feature-control. Recompose federated.yaml.

Supports config-atlas ATLAS-WP-0002-T05.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/RegistryFederation.md

@@ -159,9 +159,9 @@ Copy `templates/Makefile.registry.fragment` for `make registry-maintain` /
 5. Optionally `reuse-surface hub sync --merge` to refresh local `sources.yaml`.
 
 **Current blocks (2026-06-16):** `state-hub`, `feature-control`,
-`identity-canon`, and `shard-wiki` raw URLs return **303** (not published).
-See `history/2026-06-16-hub-registration-blocks.md` for probe evidence and owner
-follow-ups.
+`identity-canon`, `shard-wiki`, and `config-atlas` raw URLs return **303** (not
+published). See `history/2026-06-16-hub-registration-blocks.md` for probe evidence
+and owner follow-ups.
 
 ## Compose workflow
 
@@ -191,6 +191,19 @@ remote sources without cache fail compose with a clear error.
 `warn` (default): duplicate IDs across sources are kept but reported as
 warnings. Consumers must inspect `source_repo` before choosing an entry.
 
+### Id namespace ownership
+
+Federation aggregates `capability.*` ids. A few repos own **distinct id families**
+that are *not* capability indexes and therefore never collide with `capability.*`:
+
+| Namespace | Owner repo | Index (not federated here) |
+|---|---|---|
+| `surface.*` (configuration surfaces) | `config-atlas` | `registry/indexes/surfaces.yaml` |
+
+config-atlas federates only its `capabilities.yaml` (the atlas capability itself);
+its `surface.*` registry is a typed sibling. The `surface.*` namespace is reserved
+for config-atlas so the two id families stay orthogonal under `collision_policy`.
+
 ### Owner migration and deduplication
 
 After REUSE-WP-0014, many capabilities remain in both `reuse-surface` and their

registry/federation/local-repo-roster.yaml

@@ -1,17 +1,17 @@
 version: 1
-updated: '2026-06-16'
+updated: '2026-06-26'
 workstation_root: /home/worsch
 definition: All git repositories one level under the workstation home directory (e.g.
   /home/worsch/<slug> with a .git directory). Excludes nested worktrees and non-git
   folders.
 summary:
-  total: 60
-  established: 60
+  total: 61
+  established: 61
   pending: 0
   with_reuse_surface_seed: 8
-  hub_registered: 60
+  hub_registered: 61
   publish_pass: 60
-  publish_fail: 0
+  publish_fail: 1
   publish_sweep: '2026-06-16'
 repos:
 - slug: activity-core
@@ -87,6 +87,17 @@ repos:
   hub_registered: true
   publish_check: pass
   batch: B01
+- slug: config-atlas
+  path: /home/worsch/config-atlas
+  status: established
+  capability_count: 1
+  seed_from_reuse_surface: false
+  seed_capability_ids:
+  - capability.infotech.config-surface-atlas
+  hub_registered: true
+  publish_check: fail
+  publish_note: 303 not published (same block as state-hub/feature-control)
+  batch: B02
 - slug: coordination-engine
   path: /home/worsch/coordination-engine
   status: established

registry/federation/sources.yaml

@@ -58,6 +58,18 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: config-atlas
+  url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
+  enabled: true
+  required: false
+  domain: helix_forge
+  description: >-
+    Configuration Surface Atlas. Owns the `surface.*` id namespace (configuration
+    surfaces in registry/indexes/surfaces.yaml) as a typed sibling of `capability.*`;
+    only its capability index is federated here. Raw URL returns 303 until publish
+    is resolved (same block as state-hub/feature-control).
+  cache_ttl_seconds: 86400
+  auth_header: Authorization
 - repo: coordination-engine
   url: https://gitea.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
   enabled: true

registry/indexes/federated.yaml

@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-06-18'
+updated: '2026-06-26'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -37,6 +37,10 @@ sources:
   count: 0
   url: https://gitea.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/citation-work.yaml
+- repo: config-atlas
+  count: 1
+  url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
+  cache: registry/federation/cache/config-atlas.yaml
 - repo: coordination-engine
   count: 0
   url: https://gitea.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
@@ -82,7 +86,7 @@ sources:
   url: https://gitea.coulomb.social/coulomb/hub-core/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/hub-core.yaml
 - repo: human-resources
-  count: 0
+  count: 1
   url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/human-resources.yaml
 - repo: identity-canon
@@ -202,7 +206,7 @@ sources:
   url: https://gitea.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/repo-scoping.yaml
 - repo: repo-seed
-  count: 0
+  count: 1
   url: https://gitea.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/repo-seed.yaml
 - repo: reuse-surface
@@ -355,6 +359,25 @@ capabilities:
   source_repo: feature-control
   source_url: https://gitea.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/feature-control.yaml
+- id: capability.hr.workflow-catalog
+  name: HR Workflow Catalog
+  summary: Markdown-first registry of HR planning workflows with an iterative assessment
+    loop tied to INTENT phases.
+  vector: D3 / A1 / C1 / R0
+  domain: consumer
+  status: draft
+  owner: human-resources
+  path: registry/capabilities/capability.hr.workflow-catalog.md
+  tags:
+  - hr
+  - workflows
+  - assessment
+  - planning
+  consumption_modes:
+  - informational
+  source_repo: human-resources
+  source_url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/human-resources.yaml
 - id: capability.identity.subject-resolution
   name: Identity Subject Resolution
   summary: Resolve who or what is acting by mapping principals, accounts, actors,
@@ -391,6 +414,48 @@ capabilities:
   source_repo: identity-canon
   source_url: https://gitea.coulomb.social/coulomb/identity-canon/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/identity-canon.yaml
+- id: capability.infotech.config-surface-atlas
+  name: Configuration Surface Atlas
+  summary: "Read-first, cross-kind map and evidence layer for configuration surfaces\
+    \ \u2014 what configures a system, who owns it, its scope, and where the source\
+    \ of truth lives."
+  vector: D5 / A0 / C2 / R2
+  domain: infotech
+  status: draft
+  owner: config-atlas
+  path: registry/capabilities/capability.infotech.config-surface-atlas.md
+  tags:
+  - configuration
+  - registry
+  - control-plane
+  - effective-config
+  - evidence
+  consumption_modes:
+  - informational
+  - source module
+  source_repo: config-atlas
+  source_url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/config-atlas.yaml
+- id: capability.infotech.repo-template
+  name: Coulomb Repository Template
+  summary: Bootstrap new git repositories with agent instructions, registry scaffold,
+    and State Hub onboarding conventions.
+  vector: D3 / A3 / C2 / R2
+  domain: infotech
+  status: draft
+  owner: repo-seed
+  path: registry/capabilities/capability.infotech.repo-template.md
+  tags:
+  - template
+  - bootstrap
+  - state-hub
+  - onboarding
+  consumption_modes:
+  - git clone
+  - informational
+  source_repo: repo-seed
+  source_url: https://gitea.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/repo-seed.yaml
 - id: capability.registry.register
   name: Capability Registration
   summary: Register a new capability so it becomes visible for planning and implementation