diff --git a/registry/federation/local-repo-roster.yaml b/registry/federation/local-repo-roster.yaml
index 90bce2c..298c2bd 100644
--- a/registry/federation/local-repo-roster.yaml
+++ b/registry/federation/local-repo-roster.yaml
@@ -9,10 +9,10 @@ summary:
   established: 61
   pending: 0
   with_reuse_surface_seed: 8
-  hub_registered: 60
+  hub_registered: 61
   publish_pass: 61
   publish_fail: 0
-  publish_sweep: '2026-07-06'
+  publish_sweep: '2026-07-07'
   capability_status_has: 48
   capability_status_none: 13
   capability_status_pending: 0
@@ -111,14 +111,11 @@ repos:
   seed_from_reuse_surface: false
   seed_capability_ids:
   - capability.infotech.config-surface-atlas
-  hub_registered: false
+  hub_registered: true
   publish_check: pass
-  publish_note: local publish-check now passes (2026-07-06); Gitea's raw-URL
-    303 redirect (/raw/main/... -> /raw/branch/main/...) is followed
-    correctly by the current establish --publish-check code. hub_registered
-    corrected to false -- config-atlas is absent from the 60 sources in
-    https://reuse.coulomb.social/v1/federated; registration blocked on
-    REUSE_SURFACE_TOKEN (see REUSE-WP-0017-T06).
+  publish_note: local publish-check passes; hub registration completed
+    2026-07-07 (config-atlas now present among the 61 sources at
+    https://reuse.coulomb.social/v1/federated). REUSE-WP-0017-T06 closed.
   batch: B02
 - slug: coordination-engine
   path: /home/worsch/coordination-engine
diff --git a/workplans/REUSE-WP-0017-capability-coverage-campaign.md b/workplans/REUSE-WP-0017-capability-coverage-campaign.md
index 36d6d2b..5388a70 100644
--- a/workplans/REUSE-WP-0017-capability-coverage-campaign.md
+++ b/workplans/REUSE-WP-0017-capability-coverage-campaign.md
@@ -205,7 +205,7 @@ state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
 
 ```task
 id: REUSE-WP-0017-T06
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "1a04b60a-b982-4b5f-ae20-955bc88d4204"
 ```
@@ -229,17 +229,21 @@ state_hub_task_id: "1a04b60a-b982-4b5f-ae20-955bc88d4204"
    the hub. Corrected the roster's `hub_registered` to `false` for
    config-atlas (summary count 61 -> 60) to reflect reality.
 
-**Blocked on a credential I should not obtain informally:** completing the
-hub registration needs `reuse-surface hub register --repo config-atlas
---url ... REUSE_SURFACE_TOKEN=<write-token>`. No catalog entry exists yet
-in `~/ops-warden/registry/routing/catalog.yaml` for this token (checked via
-`warden route find`) — it isn't a generic OpenBao/Vault lane, it's
-reuse-surface's own hub write credential. **Needs Bernd to either provide
-the token or point at where it's routed.**
+**Resolved 2026-07-07.** A routing catalog entry
+(`reuse-surface-hub-write-token`) appeared in
+`~/ops-warden/registry/routing/catalog.yaml` pointing at the token's actual
+home: a Kubernetes Secret (`reuse-surface-env` in namespace `reuse` on the
+Railiance01 cluster), not an OpenBao/Vault lane. Registration was completed
+through that channel (by a separate concurrent session, not this one — this
+session verified the *result*, not the credential itself, per the
+credential-routing rule against exploring live cluster secrets directly).
+config-atlas is now present among the 61 sources at
+`https://reuse.coulomb.social/v1/federated`. Roster corrected:
+`hub_registered: true`, publish_sweep 2026-07-07.
 
 - [x] Diagnose the 303 (resolved — not a current blocker, code already follows the redirect)
 - [x] Local publish-check target: 61/61 pass
-- [ ] Complete hub registration for config-atlas (blocked on `REUSE_SURFACE_TOKEN`)
+- [x] Complete hub registration for config-atlas — done 2026-07-07, 61/61 hub-registered
 
 ## Closeout: Coverage Metrics, Docs, SCOPE Update