Start REUSE-WP-0017-T05: Forgejo hub URL fixes and compose refresh.

Migrate eight stale Gitea hub registrations to Forgejo raw URLs,
recompose production and local federated indexes to 61 capabilities,
and add the T05 human-review checkpoint document.

history/2026-07-07-t05-review-checkpoint.md

@@ -0,0 +1,67 @@
+# REUSE-WP-0017-T05 review checkpoint
+
+Started 2026-07-07. Extends `history/2026-07-06-t04-review-summary.md`.
+
+## Mechanical status (before human sign-off)
+
+| Check | Status |
+| --- | --- |
+| Roster coverage | 62/62 (`has` or `none`) |
+| Publish pass | 62/62 |
+| Sibling unpushed registry commits | 0 (spot-check); `railiance-apps` has 1 unrelated unpushed commit |
+| Production federated compose | **61 capabilities** / 61 enabled sources (2026-07-07, after Forgejo URL fixes) |
+| `core-hub` hub registered | yes (Forgejo URL) |
+| `inter-hub` hub disabled | yes |
+| Stale Gitea hub URLs (Forgejo origin) | **8 repos fixed** on hub + production compose refreshed |
+
+### Eight repos needing hub URL migration
+
+These publish capability indexes on **Forgejo** but the hub still points at
+**Gitea** raw URLs (empty/scaffold indexes):
+
+- `hub-core`
+- `issue-core`
+- `key-cape`
+- `railiance-apps`
+- `railiance-cluster`
+- `railiance-enablement`
+- `railiance-infra`
+- `railiance-platform`
+
+Target URL pattern:
+
+`https://forgejo.coulomb.social/coulomb/<slug>/raw/branch/main/registry/indexes/capabilities.yaml`
+
+Broader Gitea→Forgejo migration for the remaining ~53 registrations is
+**REUSE-WP-0019-T01**; these eight are the ones blocking federated compose
+from picking up T04 drafts today.
+
+## Human review queue (from T04 — still applies)
+
+Review before calling T05 done:
+
+1. **`the-custodian`** — NDA boundary; entry scoped to `runtime/` + `tools/` only.
+2. **`vergabe-teilnahme`** — unfilled SCOPE.md; honestly low vector.
+3. **`markitect-main`** — superseded-legacy framing.
+4. **`issue-core`** — migrated pre-existing manifest; confirm nothing lost.
+5. **`inter-hub`** — now `deprecated` / retired; hub disabled 2026-07-07.
+6. **`core-hub`** — Gen-3 successor; self-authored entry, not T04 draft.
+7. Stale repo-seed READMEs (`open-reuse`, `vantage-point`) — separate cleanup.
+
+## Per-entry review commands
+
+```bash
+cd ~/<repo-slug>
+git log -1 --stat -- registry/
+cat registry/capabilities/*.md   # or registry/NO_CAPABILITIES.md
+reuse-surface validate --root .
+```
+
+## T05 exit criteria
+
+- [ ] Human sign-off on flagged entries (or documented edits)
+- [x] Hub URLs corrected for Forgejo-migrated repos with T04 content
+- [x] Production `POST /v1/federated/compose` — **61** capabilities
+- [x] `hub sync` + local `federation compose --refresh` in reuse-surface
+- [x] `reuse-surface catalog` + `graph` regenerated
+- [ ] Task → `done`; T07 closeout can follow

registry/federation/sources.yaml

@@ -143,7 +143,7 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: hub-core
-  url: https://gitea.coulomb.social/coulomb/hub-core/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -185,7 +185,7 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: issue-core
-  url: https://gitea.coulomb.social/coulomb/issue-core/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -199,7 +199,7 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: key-cape
-  url: https://gitea.coulomb.social/coulomb/key-cape/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -297,21 +297,21 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-apps
-  url: https://gitea.coulomb.social/coulomb/railiance-apps/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-cluster
-  url: https://gitea.coulomb.social/coulomb/railiance-cluster/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-enablement
-  url: https://gitea.coulomb.social/coulomb/railiance-enablement/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
@@ -332,14 +332,14 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-infra
-  url: https://gitea.coulomb.social/coulomb/railiance-infra/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: railiance-platform
-  url: https://gitea.coulomb.social/coulomb/railiance-platform/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
   required: false
   domain: helix_forge

registry/indexes/federated.yaml

@@ -86,8 +86,8 @@ sources:
   url: https://gitea.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/helix-forge.yaml
 - repo: hub-core
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/hub-core/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/hub-core.yaml
 - repo: human-resources
   count: 1
@@ -110,16 +110,16 @@ sources:
   url: https://gitea.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/infospace-bench.yaml
 - repo: issue-core
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/issue-core/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/issue-core.yaml
 - repo: kaizen-agentic
   count: 1
   url: https://gitea.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/kaizen-agentic.yaml
 - repo: key-cape
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/key-cape/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/key-cape.yaml
 - repo: kontextual-engine
   count: 1
@@ -174,16 +174,16 @@ sources:
   url: https://gitea.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/phase-memory.yaml
 - repo: railiance-apps
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/railiance-apps/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-apps.yaml
 - repo: railiance-cluster
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/railiance-cluster/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-cluster.yaml
 - repo: railiance-enablement
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/railiance-enablement/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-enablement.yaml
 - repo: railiance-fabric
   count: 1
@@ -194,12 +194,12 @@ sources:
   url: https://gitea.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-forge.yaml
 - repo: railiance-infra
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/railiance-infra/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-infra.yaml
 - repo: railiance-platform
-  count: 0
+  count: 1
-  url: https://gitea.coulomb.social/coulomb/railiance-platform/raw/main/registry/indexes/capabilities.yaml
+  url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/railiance-platform.yaml
 - repo: repo-scoping
   count: 1
@@ -675,6 +675,26 @@ capabilities:
   source_repo: human-resources
   source_url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/human-resources.yaml
+- id: capability.iam.key-cape
+  name: KeyCape Lightweight IAM (NetKingdom Profile)
+  summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned
+    OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications
+    integrate against the profile, not against implementation internals.
+  vector: D4 / A2 / C2 / R1
+  domain: infotech
+  status: draft
+  owner: key-cape
+  path: registry/capabilities/capability.iam.key-cape.md
+  tags:
+  - iam
+  - oidc
+  - netkingdom
+  - security
+  consumption_modes:
+  - service (self-hosted deployment)
+  source_repo: key-cape
+  source_url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/key-cape.yaml
 - id: capability.identity.subject-resolution
   name: Identity Subject Resolution
   summary: Resolve who or what is acting by mapping principals, accounts, actors,
@@ -871,6 +891,45 @@ capabilities:
   source_repo: email-connect
   source_url: https://gitea.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/email-connect.yaml
+- id: capability.infotech.hub-core-library
+  name: Reusable FOS Hub Core Primitives
+  summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State
+    Hub for use by other FOS (Federation of Services) hubs.
+  vector: D2 / A1 / C1 / R1
+  domain: infotech
+  status: draft
+  owner: hub-core
+  path: registry/capabilities/capability.infotech.hub-core-library.md
+  tags:
+  - hub
+  - fastapi
+  - sqlalchemy
+  - mcp
+  consumption_modes:
+  - library import
+  source_repo: hub-core
+  source_url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/hub-core.yaml
+- id: capability.infotech.issue-tracking
+  name: Universal Issue Tracking Coordination
+  summary: Unified Python/CLI interface for issue tracking across Gitea, GitHub, and
+    GitLab, preventing direct platform API usage and credential sprawl for coordinating
+    agents.
+  vector: D4 / A2 / C2 / R1
+  domain: infotech
+  status: draft
+  owner: issue-core
+  path: registry/capabilities/capability.infotech.issue-tracking.md
+  tags:
+  - issue-tracking
+  - coordination
+  - multi-platform
+  consumption_modes:
+  - cli
+  - library import
+  source_repo: issue-core
+  source_url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/issue-core.yaml
 - id: capability.infotech.oss-integration-continuity
   name: Managed Continuity For OSS Integrations
   summary: Turns proven open-source integrations into structured, maintainable, continuously
@@ -968,6 +1027,48 @@ capabilities:
   source_repo: vergabe-teilnahme
   source_url: https://gitea.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/vergabe-teilnahme.yaml
+- id: capability.railiance.ci-enablement
+  name: Railiance Developer Enablement And CI/CD Templates
+  summary: "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable\
+    \ CI/CD workflow templates, developer portal paths, platform templates, SDKs,\
+    \ and buildpacks, using forge capabilities without owning forge runtime."
+  vector: D3 / A2 / C2 / R1
+  domain: financials
+  status: draft
+  owner: railiance-enablement
+  path: registry/capabilities/capability.railiance.ci-enablement.md
+  tags:
+  - railiance
+  - ci-cd
+  - developer-enablement
+  - forgejo
+  consumption_modes:
+  - ci workflow template (copy/reference)
+  - cli (promote-repo-to-forgejo.sh)
+  source_repo: railiance-enablement
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-enablement.yaml
+- id: capability.railiance.cluster-bootstrap
+  name: Railiance Cluster Runtime Bootstrap
+  summary: 'Cluster runtime entry point of the Railiance Infrastructure-as-Code framework:
+    from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated
+    Kubernetes-based environment.'
+  vector: D3 / A2 / C1 / R0
+  domain: financials
+  status: draft
+  owner: railiance-cluster
+  path: registry/capabilities/capability.railiance.cluster-bootstrap.md
+  tags:
+  - railiance
+  - kubernetes
+  - iac
+  - bootstrap
+  consumption_modes:
+  - cli
+  - ansible playbook
+  source_repo: railiance-cluster
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-cluster.yaml
 - id: capability.railiance.fabric-graph
   name: Railiance Fabric Ecosystem Graph
   summary: 'Models the durable infrastructure-responsibility graph of the Railiance
@@ -1011,6 +1112,68 @@ capabilities:
   source_repo: railiance-forge
   source_url: https://gitea.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/railiance-forge.yaml
+- id: capability.railiance.infra-provisioning
+  name: RailianceHosts Infrastructure Provisioning
+  summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud
+    using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets
+    and a servers.yaml inventory as source of truth.
+  vector: D4 / A2 / C2 / R1
+  domain: financials
+  status: draft
+  owner: railiance-infra
+  path: registry/capabilities/capability.railiance.infra-provisioning.md
+  tags:
+  - railiance
+  - terraform
+  - ansible
+  - infrastructure
+  consumption_modes:
+  - cli (terraform/ansible)
+  - gitops
+  source_repo: railiance-infra
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-infra.yaml
+- id: capability.railiance.platform-services
+  name: Railiance Platform Services
+  summary: "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster\
+    \ services: PostgreSQL HA, Valkey cache, secret management, identity integration,\
+    \ and object storage."
+  vector: D3 / A2 / C1 / R0
+  domain: financials
+  status: draft
+  owner: railiance-platform
+  path: registry/capabilities/capability.railiance.platform-services.md
+  tags:
+  - railiance
+  - platform
+  - secrets
+  - postgres
+  consumption_modes:
+  - cli (shell/python scripts)
+  source_repo: railiance-platform
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-platform.yaml
+- id: capability.railiance.workload-deployment-tooling
+  name: Railiance Application Workload Deployment Tooling
+  summary: "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack\
+    \ \u2014 application Helm releases, Kubernetes workload manifests, deployment\
+    \ guardrails, and smoke-test/check tooling for user-facing services."
+  vector: D3 / A2 / C1 / R1
+  domain: financials
+  status: draft
+  owner: railiance-apps
+  path: registry/capabilities/capability.railiance.workload-deployment-tooling.md
+  tags:
+  - railiance
+  - kubernetes
+  - helm
+  - deployment
+  consumption_modes:
+  - cli (shell scripts)
+  - helm/kubernetes deployment
+  source_repo: railiance-apps
+  source_url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/railiance-apps.yaml
 - id: capability.registry.register
   name: Capability Registration
   summary: Register a new capability so it becomes visible for planning and implementation

workplans/REUSE-WP-0017-capability-coverage-campaign.md

@@ -8,7 +8,7 @@ status: active
 owner: claude-code
 topic_slug: helix-forge
 created: "2026-07-06"
-updated: "2026-07-06"
+updated: "2026-07-07"
 state_hub_workstream_id: "a2d83504-fcd0-4561-8688-b77a01cb7f06"
 ---
 
@@ -191,7 +191,7 @@ Notable calls in this cohort:
 
 ```task
 id: REUSE-WP-0017-T05
-status: wait
+status: progress
 priority: high
 state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
 ```
@@ -201,6 +201,16 @@ state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
   hub registrations refreshed where raw URLs changed
 - `reuse-surface federation compose` + catalog + graph regeneration in this repo
 
+**Started 2026-07-07.** Production hub already at 53 capabilities after
+core-hub registration, inter-hub disable, and compose refresh. Sibling T04
+drafts are on `origin/main` for spot-checked repos; **8 Forgejo-migrated repos**
+still registered with stale Gitea raw URLs on the hub
+(`hub-core`, `issue-core`, `key-cape`, `railiance-apps`, `railiance-cluster`,
+`railiance-enablement`, `railiance-infra`, `railiance-platform`) — hub `url`
+updates + recompose done; production federated index now **61 capabilities**.
+Human review checklist:
+`history/2026-07-07-t05-review-checkpoint.md` (extends T04 summary).
+
 ## Fix config-atlas Publish Blocker
 
 ```task