WP-0016 finished: interactive registry maintain with llm-connect automation

Closes the registry maintenance loop from inside each domain repo:
interactive prompting for judgment calls, full automation for safe and
high-confidence changes, both backed by the llm-connect HTTP bridge.

- New modules: maintain.py, maintain_llm.py, patches.py, interactive.py
- Schema: schemas/registry-patch.schema.json
- CLI: reuse-surface maintain; establish --scaffold --hook
- Sibling templates: Makefile fragment, pre-commit hook
- Deterministic signal collectors extended; validate cwd auto-detect
- Docs, gap priority 28, SCOPE update
- Tests: test_maintain.py, test_interactive.py (59 pytest total)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

registry/README.md

@@ -50,6 +50,33 @@ Discover drafts start at low maturity with explicit auto-draft risks in
 `known_reliability_risks`. Promote only with evidence per
 `specs/CapabilityMaturityStandard.md`.
 
+## Maintain session checklist (REUSE-WP-0016)
+
+After code or doc changes in the owning repo:
+
+```bash
+reuse-surface maintain --all --from-git-since origin/main
+reuse-surface validate
+git add registry/ && git commit -m "registry: maintain session"
+git push origin main
+```
+
+Automation (CI or pre-commit):
+
+```bash
+reuse-surface maintain --all --auto --no-llm
+```
+
+With llm-connect for maturity suggestions:
+
+```bash
+export LLM_CONNECT_URL=http://127.0.0.1:8088
+reuse-surface maintain --all --from-git-since HEAD~5
+```
+
+Review every non-deterministic patch before merge; promotions require evidence
+citations on disk per `specs/CapabilityMaturityStandard.md`.
+
 ## Manual validation checklist
 
 Use this checklist until an automated CLI validator exists.

registry/indexes/federated.yaml

@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-06-16'
+updated: '2026-06-18'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -162,7 +162,7 @@ sources:
   url: https://gitea.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/ops-hub.yaml
 - repo: ops-warden
-  count: 0
+  count: 1
   url: https://gitea.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/ops-warden.yaml
 - repo: phase-memory
@@ -430,6 +430,29 @@ capabilities:
   source_repo: reuse-surface
   source_url: https://gitea.coulomb.social/coulomb/reuse-surface/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/reuse-surface.yaml
+- id: capability.security.ssh-certificate-issuance
+  name: SSH Certificate Issuance
+  summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors
+    through a stable cert_command CLI interface; steward NetKingdom operational access
+    routing.
+  vector: D4 / A3 / C3 / R2
+  domain: helix_forge
+  status: draft
+  owner: ops-warden
+  path: registry/capabilities/capability.security.ssh-certificate-issuance.md
+  tags:
+  - ssh
+  - certificate
+  - ca
+  - ops-warden
+  - openbao
+  - security
+  consumption_modes:
+  - CLI
+  - cert_command subprocess
+  source_repo: ops-warden
+  source_url: https://gitea.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/ops-warden.yaml
 - id: capability.statehub.progress-log
   name: Work Progress Logging
   summary: Record progress events, decisions, and session notes against workstreams