Complete WP-0006 through WP-0009: registry expansion, catalog, graph, tests

Register six new capabilities (12 total), add searchable catalog UI and graph
explorer, introduce pytest suite with CI fail-on-warnings, and close gap
analysis priorities 13 and 16. WP-0010 remains backlog for network federation.

docs/CapabilityCatalog.md

@@ -2,12 +2,45 @@
 
 **Domain:** helix_forge  
 **Updated:** 2026-06-15  
-**Entries:** 6
+**Entries:** 12
 
 Generated by `reuse-surface catalog`. Do not edit manually.
 
 ## helix_forge
 
+### Organizational Event Coordination
+
+- **ID:** `capability.activity.event-coordinate`
+- **Vector:** D3 / A1 / C1 / R0
+- **Owner:** activity-core
+- **Path:** `registry/capabilities/capability.activity.event-coordinate.md`
+- **Summary:** Coordinate structured responses to cross-domain events through activity workflows and automation.
+
+**Known limitations:**
+- early discovery stage
+
+### Audit Event Retention
+
+- **ID:** `capability.audit.event-retain`
+- **Vector:** D4 / A2 / C2 / R1
+- **Owner:** audit-core
+- **Path:** `registry/capabilities/capability.audit.event-retain.md`
+- **Summary:** Collect, normalize, retain, and search audit events with integrity evidence across tenants.
+
+**Known limitations:**
+- consumer evidence not yet collected in registry
+
+### Authorization Policy Evaluation
+
+- **ID:** `capability.authorization.policy-evaluate`
+- **Vector:** D4 / A2 / C2 / R1
+- **Owner:** flex-auth
+- **Path:** `registry/capabilities/capability.authorization.policy-evaluate.md`
+- **Summary:** Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.
+
+**Known limitations:**
+- maturity evidence is registry-external today
+
 ### Feature Availability Evaluation
 
 - **ID:** `capability.feature-control.evaluate`
@@ -26,18 +59,29 @@ Generated by `reuse-surface catalog`. Do not edit manually.
 - **Vector:** D4 / A2 / C2 / R1
 - **Owner:** feature-control
 - **Path:** `registry/capabilities/capability.feature-control.rollout.md`
-- **Summary:** Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules and staged availability.
+- **Summary:** Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules.
 
 **Known limitations:**
 - distinguish carefully from capability.feature-control.evaluate
 
+### Feature Visibility Control
+
+- **ID:** `capability.feature-control.visibility`
+- **Vector:** D4 / A2 / C2 / R1
+- **Owner:** feature-control
+- **Path:** `registry/capabilities/capability.feature-control.visibility.md`
+- **Summary:** Control whether features are visible or hidden for subjects without changing entitlement or authorization.
+
+**Known limitations:**
+- implementation may be bundled with evaluate SDK today
+
 ### Identity Subject Resolution
 
 - **ID:** `capability.identity.subject-resolution`
 - **Vector:** D3 / A0 / C1 / R0
 - **Owner:** identity-canon
 - **Path:** `registry/capabilities/capability.identity.subject-resolution.md`
-- **Summary:** Resolve who or what is acting in a context by mapping principals, accounts, actors, and identifiers to a stable subject model.
+- **Summary:** Resolve who or what is acting by mapping principals, accounts, actors, and identifiers to a stable subject model.
 
 **Known limitations:**
 - resolver artifacts are not yet available
@@ -48,7 +92,7 @@ Generated by `reuse-surface catalog`. Do not edit manually.
 - **Vector:** D4 / A0 / C2 / R0
 - **Owner:** identity-canon
 - **Path:** `registry/capabilities/capability.identity.vocabulary-canonicalize.md`
-- **Summary:** Define and maintain an implementation-neutral vocabulary for identity-related concepts across overlapping domains.
+- **Summary:** Define an implementation-neutral vocabulary for identity-related concepts across overlapping domains.
 
 **Known limitations:**
 - source-note backfill is incomplete
@@ -66,13 +110,35 @@ Generated by `reuse-surface catalog`. Do not edit manually.
 - manual index updates are required after adding an entry
 - duplicate detection is guidance-only in the MVP
 
+### Registry Entry Validation
+
+- **ID:** `capability.registry.validate`
+- **Vector:** D4 / A3 / C3 / R2
+- **Owner:** reuse-surface
+- **Path:** `registry/capabilities/capability.registry.validate.md`
+- **Summary:** Validate capability registry entries against schema, index consistency, and relation integrity.
+
+**Known limitations:**
+- warnings do not fail CI unless --fail-on-warnings is set
+
+### Work Progress Logging
+
+- **ID:** `capability.statehub.progress-log`
+- **Vector:** D4 / A4 / C3 / R2
+- **Owner:** state-hub
+- **Path:** `registry/capabilities/capability.statehub.progress-log.md`
+- **Summary:** Record progress events, decisions, and session notes against workstreams and tasks in State Hub.
+
+**Known limitations:**
+- hub must be running locally or via tunnel
+
 ### Workstream And Task Coordination
 
 - **ID:** `capability.statehub.workstream-coordinate`
 - **Vector:** D4 / A4 / C3 / R2
 - **Owner:** state-hub
 - **Path:** `registry/capabilities/capability.statehub.workstream-coordinate.md`
-- **Summary:** Track active workstreams, tasks, progress, and consistency across domain repositories through a local-first coordination service.
+- **Summary:** Track active workstreams, tasks, progress, and consistency across domain repositories.
 
 **Known limitations:**
 - requires running State Hub locally or via tunnel