diff --git a/history/2026-07-07-t05-review-checkpoint.md b/history/2026-07-07-t05-review-checkpoint.md
new file mode 100644
index 0000000..cc87402
--- /dev/null
+++ b/history/2026-07-07-t05-review-checkpoint.md
@@ -0,0 +1,67 @@
+# REUSE-WP-0017-T05 review checkpoint
+
+Started 2026-07-07. Extends `history/2026-07-06-t04-review-summary.md`.
+
+## Mechanical status (before human sign-off)
+
+| Check | Status |
+| --- | --- |
+| Roster coverage | 62/62 (`has` or `none`) |
+| Publish pass | 62/62 |
+| Sibling unpushed registry commits | 0 (spot-check); `railiance-apps` has 1 unrelated unpushed commit |
+| Production federated compose | **61 capabilities** / 61 enabled sources (2026-07-07, after Forgejo URL fixes) |
+| `core-hub` hub registered | yes (Forgejo URL) |
+| `inter-hub` hub disabled | yes |
+| Stale Gitea hub URLs (Forgejo origin) | **8 repos fixed** on hub + production compose refreshed |
+
+### Eight repos needing hub URL migration
+
+These publish capability indexes on **Forgejo** but the hub still points at
+**Gitea** raw URLs (empty/scaffold indexes):
+
+- `hub-core`
+- `issue-core`
+- `key-cape`
+- `railiance-apps`
+- `railiance-cluster`
+- `railiance-enablement`
+- `railiance-infra`
+- `railiance-platform`
+
+Target URL pattern:
+
+`https://forgejo.coulomb.social/coulomb/<slug>/raw/branch/main/registry/indexes/capabilities.yaml`
+
+Broader Gitea→Forgejo migration for the remaining ~53 registrations is
+**REUSE-WP-0019-T01**; these eight are the ones blocking federated compose
+from picking up T04 drafts today.
+
+## Human review queue (from T04 — still applies)
+
+Review before calling T05 done:
+
+1. **`the-custodian`** — NDA boundary; entry scoped to `runtime/` + `tools/` only.
+2. **`vergabe-teilnahme`** — unfilled SCOPE.md; honestly low vector.
+3. **`markitect-main`** — superseded-legacy framing.
+4. **`issue-core`** — migrated pre-existing manifest; confirm nothing lost.
+5. **`inter-hub`** — now `deprecated` / retired; hub disabled 2026-07-07.
+6. **`core-hub`** — Gen-3 successor; self-authored entry, not T04 draft.
+7. Stale repo-seed READMEs (`open-reuse`, `vantage-point`) — separate cleanup.
+
+## Per-entry review commands
+
+```bash
+cd ~/<repo-slug>
+git log -1 --stat -- registry/
+cat registry/capabilities/*.md   # or registry/NO_CAPABILITIES.md
+reuse-surface validate --root .
+```
+
+## T05 exit criteria
+
+- [ ] Human sign-off on flagged entries (or documented edits)
+- [x] Hub URLs corrected for Forgejo-migrated repos with T04 content
+- [x] Production `POST /v1/federated/compose` — **61** capabilities
+- [x] `hub sync` + local `federation compose --refresh` in reuse-surface
+- [x] `reuse-surface catalog` + `graph` regenerated
+- [ ] Task → `done`; T07 closeout can follow
\ No newline at end of file
diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml
index 97c2105..bbce8a4 100644
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -143,7 +143,7 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: hub-core
-  url: https://gitea.coulomb.social/coulomb/hub-core/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -185,7 +185,7 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: issue-core
-  url: https://gitea.coulomb.social/coulomb/issue-core/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -199,7 +199,7 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: key-cape
-  url: https://gitea.coulomb.social/coulomb/key-cape/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -297,21 +297,21 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-apps
-  url: https://gitea.coulomb.social/coulomb/railiance-apps/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-cluster
-  url: https://gitea.coulomb.social/coulomb/railiance-cluster/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-enablement
-  url: https://gitea.coulomb.social/coulomb/railiance-enablement/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -332,14 +332,14 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-infra
-  url: https://gitea.coulomb.social/coulomb/railiance-infra/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-platform
-  url: https://gitea.coulomb.social/coulomb/railiance-platform/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index e8d2891..2575968 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -86,8 +86,8 @@ sources:
   url: https://gitea.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/helix-forge.yaml
 - repo: hub-core
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/hub-core/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/hub-core.yaml
 - repo: human-resources
   count: 1
@@ -110,16 +110,16 @@ sources:
   url: https://gitea.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/infospace-bench.yaml
 - repo: issue-core
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/issue-core/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/issue-core.yaml
 - repo: kaizen-agentic
   count: 1
   url: https://gitea.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/kaizen-agentic.yaml
 - repo: key-cape
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/key-cape/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/key-cape.yaml
 - repo: kontextual-engine
   count: 1
@@ -174,16 +174,16 @@ sources:
   url: https://gitea.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/phase-memory.yaml
 - repo: railiance-apps
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/railiance-apps/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-apps.yaml
 - repo: railiance-cluster
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/railiance-cluster/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-cluster.yaml
 - repo: railiance-enablement
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/railiance-enablement/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-enablement.yaml
 - repo: railiance-fabric
   count: 1
@@ -194,12 +194,12 @@ sources:
   url: https://gitea.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-forge.yaml
 - repo: railiance-infra
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/railiance-infra/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-infra.yaml
 - repo: railiance-platform
-  count: 0
-  url: https://gitea.coulomb.social/coulomb/railiance-platform/raw/main/registry/indexes/capabilities.yaml
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-platform.yaml
 - repo: repo-scoping
   count: 1
@@ -675,6 +675,26 @@ capabilities:
   source_repo: human-resources
   source_url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/human-resources.yaml
+- id: capability.iam.key-cape
+  name: KeyCape Lightweight IAM (NetKingdom Profile)
+  summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned
+    OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications
+    integrate against the profile, not against implementation internals.
+  vector: D4 / A2 / C2 / R1
+  domain: infotech
+  status: draft
+  owner: key-cape
+  path: registry/capabilities/capability.iam.key-cape.md
+  tags:
+  - iam
+  - oidc
+  - netkingdom
+  - security
+  consumption_modes:
+  - service (self-hosted deployment)
+  source_repo: key-cape
+  source_url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/key-cape.yaml
 - id: capability.identity.subject-resolution
   name: Identity Subject Resolution
   summary: Resolve who or what is acting by mapping principals, accounts, actors,
@@ -871,6 +891,45 @@ capabilities:
   source_repo: email-connect
   source_url: https://gitea.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/email-connect.yaml
+- id: capability.infotech.hub-core-library
+  name: Reusable FOS Hub Core Primitives
+  summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State
+    Hub for use by other FOS (Federation of Services) hubs.
+  vector: D2 / A1 / C1 / R1
+  domain: infotech
+  status: draft
+  owner: hub-core
+  path: registry/capabilities/capability.infotech.hub-core-library.md
+  tags:
+  - hub
+  - fastapi
+  - sqlalchemy
+  - mcp
+  consumption_modes:
+  - library import
+  source_repo: hub-core
+  source_url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/hub-core.yaml
+- id: capability.infotech.issue-tracking
+  name: Universal Issue Tracking Coordination
+  summary: Unified Python/CLI interface for issue tracking across Gitea, GitHub, and
+    GitLab, preventing direct platform API usage and credential sprawl for coordinating
+    agents.
+  vector: D4 / A2 / C2 / R1
+  domain: infotech
+  status: draft
+  owner: issue-core
+  path: registry/capabilities/capability.infotech.issue-tracking.md
+  tags:
+  - issue-tracking
+  - coordination
+  - multi-platform
+  consumption_modes:
+  - cli
+  - library import
+  source_repo: issue-core
+  source_url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/issue-core.yaml
 - id: capability.infotech.oss-integration-continuity
   name: Managed Continuity For OSS Integrations
   summary: Turns proven open-source integrations into structured, maintainable, continuously
@@ -968,6 +1027,48 @@ capabilities:
   source_repo: vergabe-teilnahme
   source_url: https://gitea.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/vergabe-teilnahme.yaml
+- id: capability.railiance.ci-enablement
+  name: Railiance Developer Enablement And CI/CD Templates
+  summary: "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable\
+    \ CI/CD workflow templates, developer portal paths, platform templates, SDKs,\
+    \ and buildpacks, using forge capabilities without owning forge runtime."
+  vector: D3 / A2 / C2 / R1
+  domain: financials
+  status: draft
+  owner: railiance-enablement
+  path: registry/capabilities/capability.railiance.ci-enablement.md
+  tags:
+  - railiance
+  - ci-cd
+  - developer-enablement
+  - forgejo
+  consumption_modes:
+  - ci workflow template (copy/reference)
+  - cli (promote-repo-to-forgejo.sh)
+  source_repo: railiance-enablement
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-enablement.yaml
+- id: capability.railiance.cluster-bootstrap
+  name: Railiance Cluster Runtime Bootstrap
+  summary: 'Cluster runtime entry point of the Railiance Infrastructure-as-Code framework:
+    from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated
+    Kubernetes-based environment.'
+  vector: D3 / A2 / C1 / R0
+  domain: financials
+  status: draft
+  owner: railiance-cluster
+  path: registry/capabilities/capability.railiance.cluster-bootstrap.md
+  tags:
+  - railiance
+  - kubernetes
+  - iac
+  - bootstrap
+  consumption_modes:
+  - cli
+  - ansible playbook
+  source_repo: railiance-cluster
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-cluster.yaml
 - id: capability.railiance.fabric-graph
   name: Railiance Fabric Ecosystem Graph
   summary: 'Models the durable infrastructure-responsibility graph of the Railiance
@@ -1011,6 +1112,68 @@ capabilities:
   source_repo: railiance-forge
   source_url: https://gitea.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/railiance-forge.yaml
+- id: capability.railiance.infra-provisioning
+  name: RailianceHosts Infrastructure Provisioning
+  summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud
+    using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets
+    and a servers.yaml inventory as source of truth.
+  vector: D4 / A2 / C2 / R1
+  domain: financials
+  status: draft
+  owner: railiance-infra
+  path: registry/capabilities/capability.railiance.infra-provisioning.md
+  tags:
+  - railiance
+  - terraform
+  - ansible
+  - infrastructure
+  consumption_modes:
+  - cli (terraform/ansible)
+  - gitops
+  source_repo: railiance-infra
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-infra.yaml
+- id: capability.railiance.platform-services
+  name: Railiance Platform Services
+  summary: "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster\
+    \ services: PostgreSQL HA, Valkey cache, secret management, identity integration,\
+    \ and object storage."
+  vector: D3 / A2 / C1 / R0
+  domain: financials
+  status: draft
+  owner: railiance-platform
+  path: registry/capabilities/capability.railiance.platform-services.md
+  tags:
+  - railiance
+  - platform
+  - secrets
+  - postgres
+  consumption_modes:
+  - cli (shell/python scripts)
+  source_repo: railiance-platform
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-platform.yaml
+- id: capability.railiance.workload-deployment-tooling
+  name: Railiance Application Workload Deployment Tooling
+  summary: "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack\
+    \ \u2014 application Helm releases, Kubernetes workload manifests, deployment\
+    \ guardrails, and smoke-test/check tooling for user-facing services."
+  vector: D3 / A2 / C1 / R1
+  domain: financials
+  status: draft
+  owner: railiance-apps
+  path: registry/capabilities/capability.railiance.workload-deployment-tooling.md
+  tags:
+  - railiance
+  - kubernetes
+  - helm
+  - deployment
+  consumption_modes:
+  - cli (shell scripts)
+  - helm/kubernetes deployment
+  source_repo: railiance-apps
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-apps.yaml
 - id: capability.registry.register
   name: Capability Registration
   summary: Register a new capability so it becomes visible for planning and implementation
diff --git a/workplans/REUSE-WP-0017-capability-coverage-campaign.md b/workplans/REUSE-WP-0017-capability-coverage-campaign.md
index 5388a70..ef998d1 100644
--- a/workplans/REUSE-WP-0017-capability-coverage-campaign.md
+++ b/workplans/REUSE-WP-0017-capability-coverage-campaign.md
@@ -8,7 +8,7 @@ status: active
 owner: claude-code
 topic_slug: helix-forge
 created: "2026-07-06"
-updated: "2026-07-06"
+updated: "2026-07-07"
 state_hub_workstream_id: "a2d83504-fcd0-4561-8688-b77a01cb7f06"
 ---
 
@@ -191,7 +191,7 @@ Notable calls in this cohort:
 
 ```task
 id: REUSE-WP-0017-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
 ```
@@ -201,6 +201,16 @@ state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
   hub registrations refreshed where raw URLs changed
 - `reuse-surface federation compose` + catalog + graph regeneration in this repo
 
+**Started 2026-07-07.** Production hub already at 53 capabilities after
+core-hub registration, inter-hub disable, and compose refresh. Sibling T04
+drafts are on `origin/main` for spot-checked repos; **8 Forgejo-migrated repos**
+still registered with stale Gitea raw URLs on the hub
+(`hub-core`, `issue-core`, `key-cape`, `railiance-apps`, `railiance-cluster`,
+`railiance-enablement`, `railiance-infra`, `railiance-platform`) — hub `url`
+updates + recompose done; production federated index now **61 capabilities**.
+Human review checklist:
+`history/2026-07-07-t05-review-checkpoint.md` (extends T04 summary).
+
 ## Fix config-atlas Publish Blocker
 
 ```task