chore(consistency): sync task status from DB [auto]

Updated by fix-consistency on 2026-07-07: - update .custodian-brief.md for reuse-surface
REUSE-WP-0017-T06: config-atlas hub registration completed
2026-07-07 01:16:20 +02:00 · 2026-07-07 01:14:41 +02:00 · 2026-07-07 00:58:27 +02:00 · 2026-07-07 00:57:18 +02:00 · 2026-07-06 20:18:12 +02:00 · 2026-07-06 20:16:59 +02:00
40 changed files with 2551 additions and 287 deletions
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -1,18 +1,42 @@
 <!-- custodian-brief: generated by fix-consistency — do not edit manually -->
 # Custodian Brief — reuse-surface
-**Domain:** helix_forge  
+**Domain:** infotech  
-**Last synced:** 2026-06-16 19:38 UTC  
+**Last synced:** 2026-07-06 23:16 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 ## Active Workstreams
-*(none — repo may need first-session setup)*
+### Capability coverage campaign: seed or explicitly close all empty scaffolds
 Progress: 4/7 done  |  workstream_id: `a2d83504-fcd0-4561-8688-b77a01cb7f06`
 **Open tasks:**
 - ! Mark No-Capability Repos  `3465cebf`
 - ! Human Review And Publish Pass  `56b68b6f`
 - ! Closeout: Coverage Metrics, Docs, SCOPE Update  `24ac37bf`
 ### plan-check: close the consumption loop for capability reuse
 Progress: 4/6 done  |  workstream_id: `cd8683ff-6e6c-4f6c-a62f-565bd55113ea`
 **Open tasks:**
 - ! Ecosystem Rollout: Session-Protocol Integration  `c232a669`
 - · Add llm-connect Semantic Rerank  `9040505a`
 ### Forgejo-native federation automation and reuse telemetry
 Progress: 0/6 done  |  workstream_id: `569be717-34f8-4039-bb26-497685f60159`
 **Open tasks:**
 - ! Forgejo Webhook Rollout And Scheduled Fallback  `aa9e9f80`
 - ! Telemetry Aggregation Into R-Axis Evidence  `f0282cfa`
 - · Forge Host Abstraction And URL Migration Inventory  `4a187b56`
 - · Hub Recompose Endpoint And Webhook Receiver  `691eb32a`
 - · Reuse Telemetry Store And Recording  `c8e9064e`
 - · Freshness Monitoring, Docs, SCOPE  `a9f44d45`
 ---
 ## MCP Orientation (when available)
 If the state-hub MCP server is reachable, call:
-`get_domain_summary("helix_forge")`
+`get_domain_summary("infotech")`
 This provides richer cross-domain context.
 If the MCP call fails, use this file as your orientation source.
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -49,5 +49,8 @@ jobs:
      - name: Registry gap report (informational)
        run: reuse-surface report gaps || true
      - name: Plan-check smoke test (informational)
        run: reuse-surface plan-check --intent "smoke test" --format json || true
      - name: Run tests
        run: pytest -q
--- a/.repo-classification.yaml
+++ b/.repo-classification.yaml
@@ -0,0 +1,25 @@
 repo_classification:
  standard: Repo Classification Standard
  version: '1.0'
  classified_at: '2026-06-22'
  classified_by: human
  category: product
  domain: infotech
  secondary_domains:
  - agents
  capability_tags:
  - capability-registry
  - discovery
  - reuse
  - maturity
  - evidence
  business_stake:
  - technology
  - product
  - intelligence
  - automation
  business_mechanics:
  - intention
  - control
  - adaptation
  notes: Reuse discovery surface; standard §13.7 — human confirmed.
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,7 +4,7 @@
 **Purpose:** Capability registry for planning and implementation reuse based on discovery and delivery maturity.
-**Domain:** helix_forge
+**Domain:** infotech
 **Repo slug:** reuse-surface
 **Topic ID:** `f39fa2a3-c491-414c-a91b-b4c5fcc6139c`
 **Workplan prefix:** `REUSE-WP-`
@@ -101,159 +101,6 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
 ---
 ## Local Developer Workflow
 The repository is primarily documentation-first with a small Python CLI for
 registry validate, query, and export. There is no long-running service.
 ### Install
 ```bash
 python3 -m venv .venv
 .venv/bin/pip install -e .
 ```
 ### Build
 No separate build step. Treat Markdown, YAML, and workplan edits as source
 artifacts.
 ### Test / lint
 ```bash
 # Registry validation (schema + index drift)
 .venv/bin/reuse-surface validate
 # Overlap, catalog, federation, and graph
 .venv/bin/reuse-surface overlaps
 .venv/bin/reuse-surface catalog
 .venv/bin/reuse-surface federation compose
 .venv/bin/reuse-surface graph --check
 # Federation service (local)
 # REUSE_SURFACE_TOKEN=dev-token reuse-surface serve
 # Hub CLI (against deployed or local service)
 # REUSE_SURFACE_URL=http://127.0.0.1:8000 reuse-surface hub status
 # Automated tests
 .venv/bin/pytest -q
 # Repository hygiene
 rg --files
 git diff --check
 ```
 When workplan files change, sync ADR-001 file state into State Hub:
 ```bash
 curl -s -X POST "http://127.0.0.1:8000/repos/reuse-surface/sync?fix=true" \
  | python3 -m json.tool
 ```
 If the HTTP sync endpoint is unavailable, run the consistency script from the
 State Hub checkout:
 ```bash
 cd ~/state-hub
 .venv/bin/python scripts/consistency_check.py --repo reuse-surface --fix
 .venv/bin/python scripts/consistency_check.py --repo reuse-surface
 ```
 The generated instruction in older workplans says `make fix-consistency
 REPO=reuse-surface`; that is still valid when `uv` is installed and on PATH.
 On this workstation, the `.venv/bin/python` fallback has been verified.
 CI runs `reuse-surface validate` on push and pull requests via
 `.gitea/workflows/ci.yml`.
 ### Run
 There is no local service to run from this repository.
 ### Documentation Review Checklist
 - Keep `INTENT.md`, `SCOPE.md`, and `specs/` aligned on the registry-first
  reuse boundary.
 - Keep maturity definitions in `specs/CapabilityMaturityStandard.md` consistent
  with `INTENT.md` and `specs/ProductRequirementsDocument.md`.
 - Keep registry entries, indexes, and schemas in `registry/`, `schemas/`, and
  `templates/` current when capabilities change.
 - Record implementation ideas in workplans, not as premature runtime code in
  this repository.
 ---
 ## Capability Registry
 Before building or documenting a new reusable behavior, query the registry to
 avoid duplication and to select the best existing capability for planning or
 implementation reuse.
 ### Orient
 ```bash
 # Fast discovery surface — read federated index when multi-repo
 cat registry/indexes/federated.yaml
 cat registry/indexes/capabilities.yaml
 # CLI discovery and export
 .venv/bin/reuse-surface query --discovery-min D4
 .venv/bin/reuse-surface export --format yaml
 # Authoring template and schema
 cat templates/capability-entry.template.md
 cat schemas/capability.schema.yaml
 # Validation and search guidance
 cat registry/README.md
 cat tools/README.md
 ```
 ### Query workflow
 1. Run `.venv/bin/reuse-surface query` with filters, or read the index directly.
 2. Filter by `vector`, `tags`, `consumption_modes`, `domain`, or `summary`.
 3. Open only matching files under `registry/capabilities/`.
 4. Compare candidates using `discovery`, `external_evidence`, `availability`,
   and `relations` from the entry front matter.
 5. Prefer planning reuse when discovery is strong (`D3+`, especially `D5+`).
 6. Prefer implementation reuse only when availability is consumable (`A2+` code,
   `A3+` CLI, `A4+` API/SDK).
 ### Add a new capability
 1. Search the index for overlap (UC-RS-015) before creating a new entry.
 2. Copy `templates/capability-entry.template.md` to
   `registry/capabilities/capability.<domain>.<name>.md`.
 3. Start at `D0 / A0 / C0 / R0` when evidence is minimal; keep gaps explicit.
 4. Add the entry to `registry/indexes/capabilities.yaml`.
 5. Run `.venv/bin/reuse-surface validate`.
 ### Promote a capability
 1. Attach evidence required by `specs/CapabilityMaturityStandard.md` for the
   target level.
 2. Update `maturity` for discovery/availability and `external_evidence` for
   completeness/reliability separately.
 3. Refresh the index `vector` and record rationale in the entry body.
 4. Do not treat higher availability as proof of reliability or completeness.
 ### MVP acceptance mapping
 | Acceptance criterion | Registry surface |
 |---|---|
 | Add D0/A0/C0/R0 with minimal friction | template + index + registry README |
 | Promote through discovery levels | entry front matter + maturity standard |
 | Identify current consumption mode | `availability` + index `consumption_modes` |
 | Record expectations and broken expectations | `external_evidence.completeness` |
 | Record reliability evidence | `external_evidence.reliability` |
 | Search by maturity and availability | `reuse-surface query` or index filters |
 | Compare candidates | entry vectors + relations + README guidance |
 | Avoid duplicate capabilities | index search before add |
 ---
 ## Credential and access routing
 **Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
@@ -304,6 +151,11 @@ every repo's agent instructions because it is high-frequency, high-risk, and eas
 get wrong.
 **Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
 <!-- REPO-AGENTS-EXTENSIONS -->
 <!-- Append repo-specific agent instructions below this marker.
     The state-hub template sync preserves content after this line. -->
 ---
 ## Workplan Convention (ADR-001)
@@ -329,7 +181,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
 id: REUSE-WP-NNNN
 type: workplan
 title: "..."
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: proposed | ready | active | blocked | backlog | finished | archived
 owner: codex
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,17 +1,12 @@
-{
+# reuse-surface — Claude Code Instructions
-  "agents": {
+
-    "coach": {
+@SCOPE.md
-      "path": "agents/agent-coach.md",
+@.claude/rules/repo-identity.md
-      "enabled": true
+@.claude/rules/session-protocol.md
-    },
+@.claude/rules/first-session.md
-    "optimization": {
+@.claude/rules/workplan-convention.md
-      "path": "agents/agent-optimization.md",
+@.claude/rules/stack-and-commands.md
-      "enabled": true
+@.claude/rules/architecture.md
-    },
+@.claude/rules/repo-boundary.md
    "scope-analyst": {
      "path": "agents/agent-scope-analyst.md",
      "enabled": true
    }
  }
 }
@.claude/rules/credential-routing.md
@.claude/rules/agents.md
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -75,6 +75,11 @@ The MVP registry foundation, CLI tooling (REUSE-WP-0003), federation stack
 - **Explore relations interactively** at `docs/graph/index.html`
 - **Avoid duplicates** by querying the index and checking overlaps before adding
  entries
 - **Check before building** with `reuse-surface plan-check` (REUSE-WP-0018) —
  match a draft workplan or free-text intent against the federated index and
  get a reuse/extend/new verdict; `--file-request` bridges a `new` verdict to
  a State Hub capability request; `report gaps --check-capability-requests`
  surfaces open requests with no matching capability
 Registry **tooling** availability is **A4** (CLI plus hosted hub HTTP API).
 Registry **authoring** remains Markdown-first; consumption combines entries, the
--- a/docs/IntentScopeGapAnalysis.md
+++ b/docs/IntentScopeGapAnalysis.md
@@ -202,9 +202,11 @@ See §4 and archived workplans `workplans/archived/`.
 | 26 | Federated ID deduplication | Per-owner removal from reuse-surface index | **Closed** (WP-0015-T02) |
 | 27 | Planning analytics + standardization | Gap report or standardization tracker | **Partial** — gap report shipped (T03); tracker deferred |
 | 28 | Registry maintenance automation | Interactive `maintain` + `--auto` with llm-connect | **Closed** (WP-0016) |
 | 29 | Consumption loop (query-before-build) | `plan-check` command + State Hub capability-request bridge | **Partial** — deterministic matching (T02) and the request bridge (T04) shipped; LLM semantic rerank (T03) and ecosystem session-protocol rollout (T05) remain open, T05 gated on REUSE-WP-0017 coverage reaching the *published* federated index, not just local drafts |
 **Workplan:** `workplans/REUSE-WP-0016-interactive-registry-maintain.md` (priority 28);
-`workplans/REUSE-WP-0015-federation-polish-and-planning-analytics.md` (25–27)  
+`workplans/REUSE-WP-0015-federation-polish-and-planning-analytics.md` (25–27);
 `workplans/REUSE-WP-0018-plan-check-consumption-loop.md` (priority 29)  
 **Assessment:** `history/2026-06-16-intent-scope-assessment.md`
 **Follow-up docs:**
@@ -236,3 +238,4 @@ See §4 and archived workplans `workplans/archived/`.
 | 2026-06-16 | **SCOPE refresh + full INTENT success-criteria mapping**; priorities 25–27 proposed |
 | 2026-06-16 | Assessment persisted; **REUSE-WP-0015** created for priorities 25–27 |
 | 2026-06-16 | **REUSE-WP-0016** closed priority 28 (interactive `maintain`, `--auto`, templates) |
 | 2026-07-07 | **REUSE-WP-0018** partially closed priority 29 (`plan-check` deterministic matching + State Hub capability-request bridge; LLM rerank and ecosystem rollout remain open) |
--- a/docs/RegistryFederation.md
+++ b/docs/RegistryFederation.md
@@ -159,9 +159,9 @@ Copy `templates/Makefile.registry.fragment` for `make registry-maintain` /
 5. Optionally `reuse-surface hub sync --merge` to refresh local `sources.yaml`.
 **Current blocks (2026-06-16):** `state-hub`, `feature-control`,
-`identity-canon`, and `shard-wiki` raw URLs return **303** (not published).
+`identity-canon`, `shard-wiki`, and `config-atlas` raw URLs return **303** (not
-See `history/2026-06-16-hub-registration-blocks.md` for probe evidence and owner
+published). See `history/2026-06-16-hub-registration-blocks.md` for probe evidence
-follow-ups.
+and owner follow-ups.
 ## Compose workflow
@@ -191,6 +191,19 @@ remote sources without cache fail compose with a clear error.
 `warn` (default): duplicate IDs across sources are kept but reported as
 warnings. Consumers must inspect `source_repo` before choosing an entry.
 ### Id namespace ownership
 Federation aggregates `capability.*` ids. A few repos own **distinct id families**
 that are *not* capability indexes and therefore never collide with `capability.*`:
 | Namespace | Owner repo | Index (not federated here) |
 |---|---|---|
 | `surface.*` (configuration surfaces) | `config-atlas` | `registry/indexes/surfaces.yaml` |
 config-atlas federates only its `capabilities.yaml` (the atlas capability itself);
 its `surface.*` registry is a typed sibling. The `surface.*` namespace is reserved
 for config-atlas so the two id families stay orthogonal under `collision_policy`.
 ### Owner migration and deduplication
 After REUSE-WP-0014, many capabilities remain in both `reuse-surface` and their
@@ -284,6 +297,23 @@ Register published raw index URLs on the hub, or enable a `url` source in
 endpoint requires a token. Agents without sibling repo clones can discover
 capabilities from the hub or from HTTP sources plus the local index.
 ### Query before building (`plan-check`)
 Before drafting a new workplan, run `reuse-surface plan-check` (REUSE-WP-0018)
 against a draft workplan file or a free-text intent. It matches your intent
 against `registry/indexes/federated.yaml` and returns a `reuse | extend | new`
 verdict — advisory only, never a gate:
 ```bash
 reuse-surface plan-check workplans/XXX-WP-NNNN-something.md
 reuse-surface plan-check --intent "parse invoices and file evidence"
 ```
 On a `new` verdict, `--file-request` bridges the gap to a State Hub
 capability request so other domains can see the unmet need; `report gaps
 --check-capability-requests` surfaces open requests with no matching
 federated capability. See `specs/PlanCheck.md` for the full design.
 ## Relation graphs
 ```bash
--- a/history/2026-07-06-coverage-classification.md
+++ b/history/2026-07-06-coverage-classification.md
@@ -0,0 +1,106 @@
 # Coverage classification sweep (REUSE-WP-0017-T02)
 Classification of the 51 empty-scaffold repos identified in the 2026-07-06
 gap report, bucketed into `has-capability` (candidate for a drafted registry
 entry) vs `no-capability` (candidate for an explicit
 `registry/NO_CAPABILITIES.md` marker). Produced by an Explore-agent survey of
 each repo's INTENT/SCOPE/README and top-level layout; rationale is grounded
 in what was actually read, not guessed.
 **Status: confirmed by Bernd 2026-07-06.** Proceeding to T03/T04 with the two
 data-quality adjustments noted below applied.
 **Summary:** 37 has-capability, 13 no-capability, 0 missing (all 51
 directories exist and are valid git repos).
 | Repo | Bucket | Rationale | Candidate capability id |
 |---|---|---|---|
 | agentic-resources | no-capability | INTENT/SCOPE are aspirational HR-for-agents vision prose; no src/, no package manifest, only docs/registry/workplans | |
 | artifact-store | has-capability | Real Python service (67 files, pyproject, migrations, schemas) implementing a generic artifact registry/storage gateway with provenance & retention | `capability.artifact.store` |
 | can-you-assist | has-capability | Real `cya` CLI package (45 files, pyproject) — console-native LLM assistant with history/memory | `capability.cli.assistant` |
 | citation-engine | has-capability | TS package (45 files) implementing the citation-evidence domain model/API contracts | `capability.citation.engine` |
 | citation-evidence | has-capability | TS/Vite app (90 files) — integration shell/reference implementation coordinating the citation-evidence subsystems | `capability.citation.evidence-workspace` |
 | citation-work | no-capability | Only INTENT/SCOPE/registry/workplans; no src or code implementing the described review workbench | |
 | coordination-engine | no-capability | Ambitious framework prose in INTENT, but only history/spec/registry dirs — no runtime code | |
 | domain-tree | no-capability | Only registry/workplans; SCOPE explicitly defers ownership to State Hub, no implementation | |
 | email-connect | has-capability | Real Python service (24 files, pyproject, config, spec) — headless email send/track/evidence service with coordination-engine adapter contract | `capability.email.connector` |
 | evidence-anchor | no-capability | Only INTENT/SCOPE/registry/workplans; anchoring/highlighting layer described but not implemented | |
 | evidence-binder | no-capability | Only INTENT/SCOPE/registry/workplans; binding model described but not implemented | |
 | evidence-source | no-capability | Only INTENT/SCOPE/registry/workplans; ingestion/extraction layer described but not implemented | |
 | guide-board | has-capability | Real Python package (40 files, pyproject, extensions, profiles) — certification/compliance evidence framework with extension architecture | `capability.compliance.evidence-framework` |
 | helix-forge | no-capability | Draft-status (intent_version 0.1.0) capability-ecosystem vision; only design assets, standards docs, and one bootstrap script, no packaged implementation | |
 | hub-core | has-capability | Real Python library (81 files, pyproject) providing reusable FastAPI/SQLAlchemy/MCP primitives shared across FOS hub services | `capability.hub.core-library` |
 | human-resources | no-capability | Only aspirational HR-for-humans intent prose plus registry/workplans; no implementation | |
 | ihp-railiance-probe | no-capability | Self-described in its own INTENT as "a probe — not a product," purely a pipeline-validation canary app | |
 | info-tech-canon | has-capability | Real Python service (18 files, pyproject, canon.yaml) implementing a concrete "infospace" service surface (CLI, importable functions, read-only HTTP API) on top of the canon corpus | `capability.canon.info-tech` |
 | infospace-bench | has-capability | Real Python workspace/CLI (75 files, pyproject, examples) for creating/evaluating structured "infospaces" | `capability.knowledge.infospace-workspace` |
 | inter-hub | has-capability | Haskell/IHP app implementing the Interaction Hub Framework (IHF) — governed interaction substrate with Main.hs, Application, Web, contracts, specs | `capability.hub.interaction-framework` |
 | issue-core | has-capability | Real Python package (45 files) already carrying its own `CAPABILITY-issue-tracking.yaml` and `.capability/` dir — issue-tracking service | `capability.issue.tracking` |
 | kaizen-agentic | has-capability | Real Python package (57 files, pyproject) — 18-agent library plus agency/memory/coordination framework for deployed project agents | `capability.agent.kaizen-framework` |
 | key-cape | has-capability | Real Python service (56 files, spec, config) implementing the lightweight-mode NetKingdom IAM profile (OIDC/PKCE via Authelia/LLDAP/privacyIDEA) | `capability.iam.key-cape` |
 | kontextual-engine | has-capability | Large Python package (123 files, pyproject, tpsc.yaml) — context engine with examples/docs | `capability.context.engine` |
 | llm-connect | has-capability | Real Python package (62 files, pyproject, contracts) — provider-neutral LLM connector library | `capability.llm.connector` |
 | markitect-filter | has-capability | Small but real Python package (10 files, pyproject, examples) — markdown filtering component of the Markitect family | `capability.markitect.filter` |
 | markitect-main | has-capability | Large legacy platform (application/domain/services dirs, pyproject, package.json) — markitect umbrella product, now being split into successor repos | `capability.markitect.platform` |
 | markitect-quarkdown | has-capability | Small real Python package (adapter.py, pyproject) — Quarkdown integration adapter for Markitect | `capability.markitect.quarkdown-adapter` |
 | markitect-tool | has-capability | Large Python package (144 files, pyproject, sbom-tools.yaml) — markdown-native toolkit/CLI, syntax-layer successor to markitect-main | `capability.markitect.tool` |
 | net-kingdom | has-capability | Real tooling under tools/ (playbook-capability-contract, security-bootstrap-console, iam-profile-conformance, each with README+py) plus canon schemas — IAM/security tooling suite, despite no top-level src/pyproject | `capability.security.iam-tooling` |
 | open-cmis-tck | has-capability | Real Python package (14 files, pyproject, adapters/runners/runtime) — CMIS technology compatibility kit | `capability.cmis.tck` |
 | open-reuse | has-capability | Real Python package (cli.py, registry.py, validate.py) — reuse-registry CLI/validator (the tool underlying this very classification workflow) | `capability.reuse.registry-cli` |
 | ops-bridge | has-capability | Real Python CLI (36 files, pyproject) — SSH reverse-tunnel lifecycle manager keeping remote nodes connected to the State Hub (matches the "bridge" skill) | `capability.ops.tunnel-bridge` |
 | ops-hub | no-capability | Only a single diagnostic bootstrap-API probe script (interhub_gate_probe.py) exists; the described "operational truth surface" (hosts/services/incidents/runbooks) isn't implemented yet | |
 | phase-memory | has-capability | Real Python package (59 files, pyproject) — profile-driven memory operating layer producing deterministic dry-run retention/compaction actions | `capability.memory.phase-store` |
 | railiance-apps | has-capability | Real helm charts, k8s manifests, and reusable smoke-test/check tooling (tools/*.sh) for deploying/verifying Railiance workloads | `capability.railiance.k8s-deploy-tooling` |
 | railiance-cluster | has-capability | Real bin/railiance CLI, lib/ scripts, and ansible playbooks (bootstrap/harden) for standing up Railiance cluster nodes | `capability.railiance.cluster-bootstrap` |
 | railiance-enablement | has-capability | Real promote-repo-to-forgejo.sh tool plus reusable CI workflow templates (container-build-push, ci-smoke) | `capability.railiance.ci-enablement` |
 | railiance-fabric | has-capability | Real Python package (44 files, pyproject, schemas) — railiance_fabric catalog/export tooling | `capability.railiance.fabric-catalog` |
 | railiance-forge | has-capability | Real runner-management tools/scripts (gitea/forgejo runner status/activation) and helm values for the CI runner substrate | `capability.railiance.runner-ops` |
 | railiance-infra | has-capability | Real ansible/terraform/scripts (Hetzner provisioning, SSH CA bootstrap, playbooks) plus a capabilities/ playbooks dir — infra-as-code automation | `capability.railiance.infra-automation` |
 | railiance-platform | has-capability | Extensive real scripts/ (OpenBao/Vault apply/verify, credential-change Python tooling) — secrets/credential platform automation | `capability.railiance.secrets-platform` |
 | repo-scoping | has-capability | Real Python package (88 files, pyproject, migrations) — repo scoping/classification service | `capability.repo.scoping` |
 | repo-seed | has-capability | Already publishes a real capability entry (`registry/capabilities/capability.infotech.repo-template.md`) — git repo template with State Hub onboarding scaffold | `capability.infotech.repo-template` |
 | tegwick-control | no-capability | Personal life/company planning notes (areas/, agent-tasks/) — a private portfolio-tracking meta-repo, not a reusable component | |
 | the-custodian | has-capability | Real Python runtime (runtime/agent.py + pyproject) and tools/ scripts (classification batching, Gitea SSH inventory) — the custodian control-plane agent | `capability.custodian.runtime-agent` |
 | user-engine | has-capability | Real Python package (36 files, pyproject, migrations) — user/identity domain service | `capability.identity.user-engine` |
 | vantage-point | has-capability | Substantial draft protocol spec (nbgm-spec-v0.1.md) defining the Network-Based Graph Model — a well-defined, versioned data model spec, even without code yet | `capability.graph.nbgm-spec` |
 | vergabe-teilnahme | has-capability | Full Django application (413 files, manage.py, vergabe_teilnahme package, vite frontend) for German public-procurement (Vergabe) tender participation | `capability.procurement.vergabe-teilnahme` |
 | whynot-control | no-capability | Business-signal/beta-tracking scaffolding (betas/, prototypes/, offers/, signals/) with only README stubs — no independent reusable component | |
 | whynot-design | has-capability | Real JS design-system package (9+ src files: elements/atoms, chrome, layout, icons, styles) with adapters/tokens — cross-framework design system | `capability.design.whynot-system` |
 ## Notes on borderline calls
 - **repo-seed** already has a capability entry (`capability.infotech.repo-template`)
  in the federated index — it shouldn't have been in the empty-scaffold list at
  all; the roster's `capability_count` for it is stale. Flag as a data-quality
  fix alongside T03/T04, not a fresh draft.
 - **issue-core** already carries its own `CAPABILITY-issue-tracking.yaml` and
  `.capability/` directory outside the standard `registry/` layout — likely a
  pre-existing capability description in a non-standard location that needs
  migrating into `registry/capabilities/`, not a from-scratch draft.
 - **vantage-point** has no code yet, only a versioned protocol spec — flagged
  `has-capability` on the strength of the spec itself (D-axis can be honest
  and non-zero for a documented model; A-axis should stay low/A0 until there's
  an implementation).
 - **net-kingdom** and **railiance-*** repos generally lack a top-level
  `pyproject.toml`/package manifest but do have real, runnable tooling under
  `tools/`/`scripts/` — maturity vectors for these should reflect
  script-level availability (likely A1–A2), not assume packaged distribution.
 - 13 no-capability repos cluster into two patterns: **vision-only** (INTENT/SCOPE
  prose with no implementation — agentic-resources, citation-work,
  coordination-engine, domain-tree, evidence-anchor, evidence-binder,
  evidence-source, human-resources, helix-forge, ops-hub) and **explicitly
  out-of-scope for reuse** (ihp-railiance-probe is a self-described probe,
  tegwick-control and whynot-control are personal/business tracking, not
  product components).
 ## Next steps (blocked on review)
 - **T03** (mark no-capability): write `registry/NO_CAPABILITIES.md` into the
  13 confirmed no-capability repos, set `capability_status: none` in the
  roster.
 - **T04** (draft entries): run `establish --discover` for the 37 (35, net of
  the two data-quality fixes above) confirmed has-capability repos in cohorts
  of ~10, honest low-maturity first pass.
 **Awaiting Bernd's confirmation of this bucket split before T03/T04 proceed**,
 per the workplan's human-review-checkpoint design principle.
--- a/history/2026-07-06-t04-review-summary.md
+++ b/history/2026-07-06-t04-review-summary.md
@@ -0,0 +1,164 @@
 # REUSE-WP-0017-T04 review summary
 Prepared for the T05 human-review-and-publish-pass checkpoint. Everything
 below is generated from the actual files committed in each sibling repo
 (not from drafting notes), so it reflects what would actually get pushed
 and published.
 **Coverage: 61/61.** 48 repos have a capability entry, 13 have an explicit
 `registry/NO_CAPABILITIES.md` marker, 0 remain unclassified.
 **What's new this session (T02–T04):** 30 sibling repos got a first commit —
 13 no-capability markers (T03) and 17 newly drafted capability entries
 (the first two T04 cohorts + this final cohort — see per-cohort commit
 messages in `workplans/REUSE-WP-0017-capability-coverage-campaign.md` for
 the exact 10/10/17 split). The other 18 `has` rows below already existed
 before this workplan (activity-core, audit-core, config-atlas,
 feature-control, flex-auth, identity-canon, ops-warden, repo-seed,
 reuse-surface, shard-wiki, state-hub, plus the ones drafted in cohorts
 1–2 — see the table for the full picture; cohort provenance is in the
 workplan file, not repeated here).
 **Everything below is committed locally only.** Nothing has been pushed to
 any sibling repo's remote. T05 is where you review, then push +
 publish-check + hub refresh + `federation compose` happen.
 ## How to review a single entry
 ```bash
 cd ~/<repo-slug>
 git log -1 --stat          # see exactly what was added
 git show HEAD               # full diff
 cat registry/capabilities/<id>.md   # or registry/NO_CAPABILITIES.md
 ```
 To push everything after review (per-repo, once you're satisfied):
 ```bash
 git -C ~/<repo-slug> push origin main
 ```
 ## Things worth a closer look before pushing
 1. **`the-custodian`** — the repo root carries an NDA/confidentiality
   notice. The entry (`capability.agents.custodian-runtime-tooling`) is
   deliberately scoped to only the non-confidential `runtime/` agent
   framework and `tools/` repo-classification scripts; canon/memory content
   is explicitly excluded in `discovery.excludes` and
   `consumer_guidance.not_recommended_for`. Please double-check this
   scoping is exactly right before pushing — this is the one entry where
   getting the boundary wrong has real consequences.
 2. **`vergabe-teilnahme`** — its own `SCOPE.md` is an unfilled template, so
   the entry is honestly low (D1/A1/C0/R0) with a limitation note that
   filling in SCOPE.md should happen before further promotion.
 3. **`markitect-main`** — registered as a *superseded legacy platform*,
   with `consumer_guidance.not_recommended_for` pointing new consumers at
   its three successors (`markitect-tool`, `infospace-bench`,
   `kontextual-engine`). Worth confirming that's the framing you want on
   the record.
 4. **`issue-core`** — migrated its own pre-existing
   `CAPABILITY-issue-tracking.yaml` (a rich, non-standard capability
   manifest with 109 tests / 61% coverage documented) into the standard
   `registry/capabilities/` location, rather than drafting fresh. Worth
   confirming nothing was lost in translation.
 5. **Stale repo-seed-template READMEs** — `inter-hub`, `open-reuse`, and
   `vantage-point` all still show the generic `repo-seed` bootstrap README
   at their repo root; I used each repo's `SCOPE.md`/`INTENT.md` instead
   (noted in each entry's discovery rationale) since those are accurate.
   The stale READMEs themselves are a small, separate cleanup — not fixed
   here, out of scope for this workplan.
 6. **Forgejo-transition tooling surfaced along the way** — `railiance-enablement`
   (`tools/promote-repo-to-forgejo.sh`), `railiance-apps`
   (`tools/forgejo-smoke.sh`), and `the-custodian`
   (`tools/patch-forgejo-remote-urls.sh`) all ship tooling directly relevant
   to REUSE-WP-0019's host-migration inventory (T01) — worth cross-referencing
   when that workplan starts.
 7. **Two pre-existing roster rows had a stale `seed_capability_ids: []`**
   despite having real, already-published entries: `activity-core`
   (`capability.activity.event-coordinate`) and `ops-warden`
   (`capability.security.ssh-certificate-issuance`). Fixed as a small
   incidental correction in the roster — not new drafts, just a bookkeeping
   gap from before this workplan.
 8. **`config-atlas`** remains `publish_check: fail` (303 error) — tracked
   separately as REUSE-WP-0017-T06, likely related to the Gitea→Forgejo
   transition (REUSE-WP-0019-T01).
 ## All 48 capability entries
 | Repo | Capability ID | Vector (D/A/C/R) | Summary |
 |---|---|---|---|
 | `activity-core` | `capability.activity.event-coordinate` | D3/A1/C1/R0 | Coordinate structured responses to cross-domain events through activity workflows and automation. |
 | `artifact-store` | `capability.infotech.artifact-store` | D3/A1/C1/R0 | Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts. |
 | `audit-core` | `capability.audit.event-retain` | D4/A2/C2/R1 | Collect, normalize, retain, and search audit events with integrity evidence across tenants. |
 | `can-you-assist` | `capability.agents.cli-assistant` | D2/A2/C1/R0 | Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help. |
 | `citation-engine` | `capability.infotech.citation-engine` | D3/A1/C1/R0 | Core domain model and engine services for the citation-evidence ecosystem — shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers. |
 | `citation-evidence` | `capability.infotech.citation-evidence-workspace` | D4/A1/C1/R0 | Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations — the umbrella application over the citation-evidence six-package design. |
 | `config-atlas` | `capability.infotech.config-surface-atlas` | D5/A0/C2/R2 | Read-first, cross-kind map and evidence layer for configuration surfaces — what configures a system, who owns it, its scope, and where the source of truth lives. |
 | `email-connect` | `capability.infotech.email-connector` | D2/A1/C1/R0 | Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports. |
 | `feature-control` | `capability.feature-control.evaluate` | D5/A4/C3/R3 | Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context. |
 | `flex-auth` | `capability.authorization.policy-evaluate` | D4/A2/C2/R1 | Evaluate access decisions from policy-as-code rules for subjects, resources, and actions. |
 | `guide-board` | `capability.communication.compliance-evidence-framework` | D2/A2/C1/R0 | Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture. |
 | `hub-core` | `capability.infotech.hub-core-library` | D2/A1/C1/R1 | Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs. |
 | `identity-canon` | `capability.identity.subject-resolution` | D3/A0/C1/R0 | Resolve who or what is acting in a context by mapping principals, accounts, actors, and identifiers to a stable subject model. |
 | `info-tech-canon` | `capability.infotech.canon-service` | D2/A2/C1/R0 | Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon information-processing infospace, backed by infospace-bench. |
 | `infospace-bench` | `capability.communication.infospace-workspace` | D3/A1/C2/R1 | Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main. |
 | `inter-hub` | `capability.infotech.interaction-hub-framework` | D3/A1/C1/R0 | Specification and reference implementation of a governed, observable interaction substrate connecting rendered UI widgets to structured feedback, requirements, decisions, implementation changes, and observed outcomes. |
 | `issue-core` | `capability.infotech.issue-tracking` | D4/A2/C2/R1 | Unified Python/CLI interface for issue tracking across Gitea, GitHub, and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents. |
 | `kaizen-agentic` | `capability.agents.kaizen-framework` | D3/A2/C1/R0 | AI agency framework providing 18 specialized deployable agent instruction sets plus persistent, project-scoped memory and cross-agent coordination via a Coach meta-agent. |
 | `key-cape` | `capability.iam.key-cape` | D4/A2/C2/R1 | Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against implementation internals. |
 | `kontextual-engine` | `capability.communication.context-engine` | D4/A1/C1/R0 | Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge. |
 | `llm-connect` | `capability.agents.llm-connector` | D3/A2/C2/R1 | Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers. |
 | `markitect-filter` | `capability.communication.markitect-source-adapters` | D2/A1/C1/R0 | Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract. |
 | `markitect-main` | `capability.communication.markitect-legacy-platform` | D3/A1/C1/R0 | Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine. |
 | `markitect-quarkdown` | `capability.communication.markitect-quarkdown-adapter` | D3/A1/C1/R0 | Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown. |
 | `markitect-tool` | `capability.communication.markitect-toolkit` | D4/A2/C2/R1 | Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main. |
 | `net-kingdom` | `capability.security.iam-tooling-suite` | D3/A2/C1/R1 | Dynamic, self-optimizing security platform for Kubernetes-deployed IT infrastructure; owns canonical IAM/security standards and executable conformance tooling (IAM profile conformance, playbook capability contract validation, security bootstrap console). |
 | `open-cmis-tck` | `capability.cmis.tck` | D2/A1/C1/R0 | CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework. |
 | `open-reuse` | `capability.infotech.oss-integration-continuity` | D2/A1/C1/R0 | Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves. |
 | `ops-bridge` | `capability.ops.tunnel-bridge` | D3/A2/C2/R1 | CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events. |
 | `ops-warden` | `capability.security.ssh-certificate-issuance` | D4/A3/C3/R2 | Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward operational access routing across NetKingdom security lanes. |
 | `phase-memory` | `capability.memory.phase-planning` | D3/A1/C1/R0 | Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation. |
 | `railiance-apps` | `capability.railiance.workload-deployment-tooling` | D3/A2/C1/R1 | S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack — application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services. |
 | `railiance-cluster` | `capability.railiance.cluster-bootstrap` | D3/A2/C1/R0 | Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment. |
 | `railiance-enablement` | `capability.railiance.ci-enablement` | D3/A2/C2/R1 | S4 Developer Enablement layer of the Railiance OAS Stack — reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime. |
 | `railiance-fabric` | `capability.railiance.fabric-graph` | D3/A1/C1/R0 | Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings. |
 | `railiance-forge` | `capability.railiance.forge-infrastructure` | D3/A1/C1/R0 | Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate. |
 | `railiance-infra` | `capability.railiance.infra-provisioning` | D4/A2/C2/R1 | Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth. |
 | `railiance-platform` | `capability.railiance.platform-services` | D3/A2/C1/R0 | S3 Platform Services layer of the Railiance OAS Stack — shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage. |
 | `repo-scoping` | `capability.agents.repo-scoping-service` | D2/A2/C1/R0 | Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI. |
 | `repo-seed` | `capability.infotech.repo-template` | D3/A3/C2/R2 | Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions. |
 | `reuse-surface` | `capability.registry.register` | D3/A4/C2/R3 | Register a new capability so it becomes visible for planning and implementation reuse. |
 | `shard-wiki` | `capability.wiki.shard-orchestration` | D5/A2/C2/R1 | Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history. |
 | `state-hub` | `capability.statehub.progress-log` | D4/A4/C3/R3 | Record progress events, decisions, and session notes against workstreams and tasks in State Hub. |
 | `the-custodian` | `capability.agents.custodian-runtime-tooling` | D2/A1/C1/R0 | Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos. |
 | `user-engine` | `capability.identity.user-engine` | D4/A1/C2/R0 | Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys. |
 | `vantage-point` | `capability.graph.nbgm-spec` | D2/A0/C1/R0 | Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains. |
 | `vergabe-teilnahme` | `capability.procurement.vergabe-teilnahme` | D1/A1/C0/R0 | Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation — Ausschreibungs- und Teilnahme-Management-System. |
 | `whynot-design` | `capability.design.whynot-system` | D3/A2/C2/R1 | Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters. |
 ## All 13 explicit no-capability markers
 | Repo | Reason |
 |---|---|
 | `agentic-resources` | INTENT/SCOPE are aspirational HR-for-agents vision prose; no src/, no package manifest — vision-stage only, nothing implemented to reuse. |
 | `citation-work` | Only INTENT/SCOPE/registry/workplans describing a review workbench; no source implementing it yet. |
 | `coordination-engine` | Ambitious coordination-framework prose in INTENT, but only history/spec/registry dirs exist — no runtime code yet. |
 | `domain-tree` | Only registry/workplans; SCOPE explicitly defers ownership of implementation to State Hub. |
 | `evidence-anchor` | Only INTENT/SCOPE/registry/workplans; the anchoring/highlighting layer is described but not implemented. |
 | `evidence-binder` | Only INTENT/SCOPE/registry/workplans; the binding model is described but not implemented. |
 | `evidence-source` | Only INTENT/SCOPE/registry/workplans; the ingestion/extraction layer is described but not implemented. |
 | `helix-forge` | Draft-status (intent_version 0.1.0) capability-ecosystem vision; only design assets and standards docs exist, no packaged implementation. |
 | `human-resources` | Aspirational HR-for-humans intent prose plus registry/workplans; no implementation. |
 | `ihp-railiance-probe` | Self-described in its own INTENT as a probe, not a product — a pipeline-validation canary app, not intended for reuse. |
 | `ops-hub` | Only a single diagnostic bootstrap-API probe script exists; the described operational-truth surface (hosts/services/incidents/runbooks) isn't implemented yet. |
 | `tegwick-control` | Personal life/company planning notes (areas/, agent-tasks/) — a private portfolio-tracking meta-repo, not a reusable product component. |
 | `whynot-control` | Business-signal/beta-tracking scaffolding (betas/, prototypes/, offers/, signals/) with only README stubs — no independent reusable component. |
 ## Next steps (T05)
 1. Review the flagged items above, especially #1 (the-custodian confidentiality scoping).
 2. Spot-check a sample of entries against the actual repos if you want deeper confidence beyond this summary.
 3. Push the sibling-repo commits (30 repos have new commits this session; see `git log --oneline -1` in each).
 4. `establish --publish-check` per repo where the raw URL needs confirming.
 5. `reuse-surface federation compose` + catalog + graph regeneration in this repo.
 6. Then T06 (config-atlas 303 fix) can proceed independently.
--- a/registry/federation/local-repo-roster.yaml
+++ b/registry/federation/local-repo-roster.yaml
@@ -1,25 +1,30 @@
 version: 1
-updated: '2026-06-16'
+updated: '2026-06-26'
 workstation_root: /home/worsch
 definition: All git repositories one level under the workstation home directory (e.g.
  /home/worsch/<slug> with a .git directory). Excludes nested worktrees and non-git
  folders.
 summary:
-  total: 60
+  total: 61
-  established: 60
+  established: 61
  pending: 0
  with_reuse_surface_seed: 8
-  hub_registered: 60
+  hub_registered: 61
-  publish_pass: 60
+  publish_pass: 61
  publish_fail: 0
-  publish_sweep: '2026-06-16'
+  publish_sweep: '2026-07-07'
  capability_status_has: 48
  capability_status_none: 13
  capability_status_pending: 0
 repos:
 - slug: activity-core
  path: /home/worsch/activity-core
  status: established
  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.activity.event-coordinate
  hub_registered: true
  publish_check: pass
  batch: B01
@@ -27,6 +32,7 @@ repos:
  path: /home/worsch/agentic-resources
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -35,9 +41,11 @@ repos:
 - slug: artifact-store
  path: /home/worsch/artifact-store
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.artifact-store
  hub_registered: true
  publish_check: pass
  batch: B01
@@ -45,6 +53,7 @@ repos:
  path: /home/worsch/audit-core
  status: established
  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.audit.event-retain
@@ -54,27 +63,33 @@ repos:
 - slug: can-you-assist
  path: /home/worsch/can-you-assist
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.agents.cli-assistant
  hub_registered: true
  publish_check: pass
  batch: B01
 - slug: citation-engine
  path: /home/worsch/citation-engine
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.citation-engine
  hub_registered: true
  publish_check: pass
  batch: B01
 - slug: citation-evidence
  path: /home/worsch/citation-evidence
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.citation-evidence-workspace
  hub_registered: true
  publish_check: pass
  batch: B01
@@ -82,15 +97,31 @@ repos:
  path: /home/worsch/citation-work
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
  publish_check: pass
  batch: B01
 - slug: config-atlas
  path: /home/worsch/config-atlas
  status: established
  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
  seed_capability_ids:
  - capability.infotech.config-surface-atlas
  hub_registered: true
  publish_check: pass
  publish_note: local publish-check passes; hub registration completed
    2026-07-07 (config-atlas now present among the 61 sources at
    https://reuse.coulomb.social/v1/federated). REUSE-WP-0017-T06 closed.
  batch: B02
 - slug: coordination-engine
  path: /home/worsch/coordination-engine
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -100,6 +131,7 @@ repos:
  path: /home/worsch/domain-tree
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -108,9 +140,11 @@ repos:
 - slug: email-connect
  path: /home/worsch/email-connect
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.email-connector
  hub_registered: true
  publish_check: pass
  batch: B02
@@ -118,6 +152,7 @@ repos:
  path: /home/worsch/evidence-anchor
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -127,6 +162,7 @@ repos:
  path: /home/worsch/evidence-binder
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -136,6 +172,7 @@ repos:
  path: /home/worsch/evidence-source
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -145,6 +182,7 @@ repos:
  path: /home/worsch/feature-control
  status: established
  capability_count: 3
  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.feature-control.evaluate
@@ -157,6 +195,7 @@ repos:
  path: /home/worsch/flex-auth
  status: established
  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.authorization.policy-evaluate
@@ -166,9 +205,11 @@ repos:
 - slug: guide-board
  path: /home/worsch/guide-board
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.communication.compliance-evidence-framework
  hub_registered: true
  publish_check: pass
  batch: B02
@@ -176,6 +217,7 @@ repos:
  path: /home/worsch/helix-forge
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -184,9 +226,11 @@ repos:
 - slug: hub-core
  path: /home/worsch/hub-core
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.hub-core-library
  hub_registered: true
  publish_check: pass
  batch: B02
@@ -194,6 +238,7 @@ repos:
  path: /home/worsch/human-resources
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -203,6 +248,7 @@ repos:
  path: /home/worsch/identity-canon
  status: established
  capability_count: 2
  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.identity.subject-resolution
@@ -214,6 +260,7 @@ repos:
  path: /home/worsch/ihp-railiance-probe
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -222,144 +269,176 @@ repos:
 - slug: info-tech-canon
  path: /home/worsch/info-tech-canon
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.canon-service
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: infospace-bench
  path: /home/worsch/infospace-bench
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.communication.infospace-workspace
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: inter-hub
  path: /home/worsch/inter-hub
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.interaction-hub-framework
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: issue-core
  path: /home/worsch/issue-core
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.issue-tracking
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: kaizen-agentic
  path: /home/worsch/kaizen-agentic
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.agents.kaizen-framework
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: key-cape
  path: /home/worsch/key-cape
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.iam.key-cape
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: kontextual-engine
  path: /home/worsch/kontextual-engine
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.communication.context-engine
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: llm-connect
  path: /home/worsch/llm-connect
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.agents.llm-connector
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: markitect-filter
  path: /home/worsch/markitect-filter
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.communication.markitect-source-adapters
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: markitect-main
  path: /home/worsch/markitect-main
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.communication.markitect-legacy-platform
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: markitect-quarkdown
  path: /home/worsch/markitect-quarkdown
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.communication.markitect-quarkdown-adapter
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: markitect-tool
  path: /home/worsch/markitect-tool
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.communication.markitect-toolkit
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: net-kingdom
  path: /home/worsch/net-kingdom
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.security.iam-tooling-suite
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: open-cmis-tck
  path: /home/worsch/open-cmis-tck
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.cmis.tck
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: open-reuse
  path: /home/worsch/open-reuse
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.oss-integration-continuity
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: ops-bridge
  path: /home/worsch/ops-bridge
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.ops.tunnel-bridge
  hub_registered: true
  publish_check: pass
  batch: B04
@@ -367,6 +446,7 @@ repos:
  path: /home/worsch/ops-hub
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -376,53 +456,65 @@ repos:
  path: /home/worsch/ops-warden
  status: established
  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.security.ssh-certificate-issuance
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: phase-memory
  path: /home/worsch/phase-memory
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.memory.phase-planning
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: railiance-apps
  path: /home/worsch/railiance-apps
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.railiance.workload-deployment-tooling
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: railiance-cluster
  path: /home/worsch/railiance-cluster
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.railiance.cluster-bootstrap
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-enablement
  path: /home/worsch/railiance-enablement
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.railiance.ci-enablement
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-fabric
  path: /home/worsch/railiance-fabric
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.railiance.fabric-graph
  hub_registered: true
  publish_check: pass
  batch: B05
@@ -430,45 +522,55 @@ repos:
 - slug: railiance-forge
  path: /home/worsch/railiance-forge
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.railiance.forge-infrastructure
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-infra
  path: /home/worsch/railiance-infra
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.railiance.infra-provisioning
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-platform
  path: /home/worsch/railiance-platform
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.railiance.platform-services
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: repo-scoping
  path: /home/worsch/repo-scoping
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.agents.repo-scoping-service
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: repo-seed
  path: /home/worsch/repo-seed
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.infotech.repo-template
  hub_registered: true
  publish_check: pass
  batch: B05
@@ -476,6 +578,7 @@ repos:
  path: /home/worsch/reuse-surface
  status: established
  capability_count: 3
  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.registry.register
@@ -487,6 +590,7 @@ repos:
  path: /home/worsch/shard-wiki
  status: established
  capability_count: 8
  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.wiki.shard-orchestration
@@ -504,6 +608,7 @@ repos:
  path: /home/worsch/state-hub
  status: established
  capability_count: 2
  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.statehub.progress-log
@@ -515,6 +620,7 @@ repos:
  path: /home/worsch/tegwick-control
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -523,36 +629,44 @@ repos:
 - slug: the-custodian
  path: /home/worsch/the-custodian
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.agents.custodian-runtime-tooling
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: user-engine
  path: /home/worsch/user-engine
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.identity.user-engine
  hub_registered: true
  publish_check: pass
  batch: B06
 - slug: vantage-point
  path: /home/worsch/vantage-point
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.graph.nbgm-spec
  hub_registered: true
  publish_check: pass
  batch: B06
 - slug: vergabe-teilnahme
  path: /home/worsch/vergabe-teilnahme
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.procurement.vergabe-teilnahme
  hub_registered: true
  publish_check: pass
  batch: B06
@@ -560,6 +674,7 @@ repos:
  path: /home/worsch/whynot-control
  status: established
  capability_count: 0
  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -568,9 +683,11 @@ repos:
 - slug: whynot-design
  path: /home/worsch/whynot-design
  status: established
-  capability_count: 0
+  capability_count: 1
  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
  - capability.design.whynot-system
  hub_registered: true
  publish_check: pass
  batch: B06
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -58,6 +58,18 @@ sources:
  domain: helix_forge
  cache_ttl_seconds: 86400
  auth_header: Authorization
 - repo: config-atlas
  url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
  enabled: true
  required: false
  domain: helix_forge
  description: >-
    Configuration Surface Atlas. Owns the `surface.*` id namespace (configuration
    surfaces in registry/indexes/surfaces.yaml) as a typed sibling of `capability.*`;
    only its capability index is federated here. Raw URL returns 303 until publish
    is resolved (same block as state-hub/feature-control).
  cache_ttl_seconds: 86400
  auth_header: Authorization
 - repo: coordination-engine
  url: https://gitea.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
  enabled: true
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-06-18'
+updated: '2026-06-26'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -37,6 +37,10 @@ sources:
  count: 0
  url: https://gitea.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/citation-work.yaml
 - repo: config-atlas
  count: 1
  url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/config-atlas.yaml
 - repo: coordination-engine
  count: 0
  url: https://gitea.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
@@ -82,7 +86,7 @@ sources:
  url: https://gitea.coulomb.social/coulomb/hub-core/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/hub-core.yaml
 - repo: human-resources
-  count: 0
+  count: 1
  url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/human-resources.yaml
 - repo: identity-canon
@@ -202,7 +206,7 @@ sources:
  url: https://gitea.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/repo-scoping.yaml
 - repo: repo-seed
-  count: 0
+  count: 1
  url: https://gitea.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/repo-seed.yaml
 - repo: reuse-surface
@@ -355,6 +359,25 @@ capabilities:
  source_repo: feature-control
  source_url: https://gitea.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
  source_index: registry/federation/cache/feature-control.yaml
 - id: capability.hr.workflow-catalog
  name: HR Workflow Catalog
  summary: Markdown-first registry of HR planning workflows with an iterative assessment
    loop tied to INTENT phases.
  vector: D3 / A1 / C1 / R0
  domain: consumer
  status: draft
  owner: human-resources
  path: registry/capabilities/capability.hr.workflow-catalog.md
  tags:
  - hr
  - workflows
  - assessment
  - planning
  consumption_modes:
  - informational
  source_repo: human-resources
  source_url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
  source_index: registry/federation/cache/human-resources.yaml
 - id: capability.identity.subject-resolution
  name: Identity Subject Resolution
  summary: Resolve who or what is acting by mapping principals, accounts, actors,
@@ -391,6 +414,48 @@ capabilities:
  source_repo: identity-canon
  source_url: https://gitea.coulomb.social/coulomb/identity-canon/raw/main/registry/indexes/capabilities.yaml
  source_index: registry/federation/cache/identity-canon.yaml
 - id: capability.infotech.config-surface-atlas
  name: Configuration Surface Atlas
  summary: "Read-first, cross-kind map and evidence layer for configuration surfaces\
    \ \u2014 what configures a system, who owns it, its scope, and where the source\
    \ of truth lives."
  vector: D5 / A0 / C2 / R2
  domain: infotech
  status: draft
  owner: config-atlas
  path: registry/capabilities/capability.infotech.config-surface-atlas.md
  tags:
  - configuration
  - registry
  - control-plane
  - effective-config
  - evidence
  consumption_modes:
  - informational
  - source module
  source_repo: config-atlas
  source_url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
  source_index: registry/federation/cache/config-atlas.yaml
 - id: capability.infotech.repo-template
  name: Coulomb Repository Template
  summary: Bootstrap new git repositories with agent instructions, registry scaffold,
    and State Hub onboarding conventions.
  vector: D3 / A3 / C2 / R2
  domain: infotech
  status: draft
  owner: repo-seed
  path: registry/capabilities/capability.infotech.repo-template.md
  tags:
  - template
  - bootstrap
  - state-hub
  - onboarding
  consumption_modes:
  - git clone
  - informational
  source_repo: repo-seed
  source_url: https://gitea.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
  source_index: registry/federation/cache/repo-seed.yaml
 - id: capability.registry.register
  name: Capability Registration
  summary: Register a new capability so it becomes visible for planning and implementation
--- a/reuse_surface/cli.py
+++ b/reuse_surface/cli.py
@@ -20,6 +20,16 @@ from reuse_surface.hub_sync import (
    write_sources_manifest,
 )
 from reuse_surface.overlaps import find_overlaps
 from reuse_surface.statehub_bridge import list_open_capability_requests
 from reuse_surface.plan_check import (
    format_plan_check_json,
    format_plan_check_markdown,
    load_query_from_intent,
    load_query_from_workplan,
    maybe_file_capability_request,
    record_outcome,
    run_plan_check,
 )
 from reuse_surface.reports import (
    cohort_filters_from_args,
    collect_gap_report,
@@ -578,16 +588,85 @@ def cmd_report_cohorts(args: argparse.Namespace) -> int:
    return 0
 def cmd_plan_check(args: argparse.Namespace) -> int:
    if args.workplan and args.intent:
        print("error: pass either a workplan file or --intent, not both", file=sys.stderr)
        return 1
    if args.workplan:
        path = Path(args.workplan).resolve()
        if not path.exists():
            print(f"error: workplan not found: {path}", file=sys.stderr)
            return 1
        query = load_query_from_workplan(path)
    elif args.intent:
        query = load_query_from_intent(args.intent)
    else:
        print("error: provide a workplan file or --intent", file=sys.stderr)
        return 1
    result = run_plan_check(
        query,
        reuse_threshold=args.reuse_threshold,
        extend_threshold=args.extend_threshold,
    )
    if args.record_outcome:
        record_outcome(result, args.record_outcome, consumer_repo=args.consumer_repo)
    filed = None
    if args.file_request and result["verdict"] == "new":
        filed = maybe_file_capability_request(
            result,
            requesting_domain=args.requesting_domain,
            requesting_agent=args.consumer_repo,
        )
    if args.format == "json":
        if filed is not None:
            result["filed_capability_request"] = filed
        print(format_plan_check_json(result))
    else:
        print(format_plan_check_markdown(result), end="")
        if args.file_request and result["verdict"] == "new":
            if filed:
                print(f"\nFiled State Hub capability request: {filed.get('id')}")
            else:
                print("\nState Hub unreachable — capability request not filed.")
    return 0
 def cmd_report_gaps(args: argparse.Namespace) -> int:
    roster_path = Path(args.roster).resolve() if args.roster else default_roster_path()
    if not roster_path.exists():
        print(f"error: roster not found: {roster_path}", file=sys.stderr)
        return 1
    report = collect_gap_report(roster_path)
    if args.check_capability_requests:
        open_requests = list_open_capability_requests()
        report["open_capability_requests"] = (
            [
                {"id": r["id"], "title": r["title"], "requesting_domain": r.get("requesting_domain_slug")}
                for r in open_requests
            ]
            if open_requests is not None
            else None
        )
    if args.format == "json":
        print(format_gap_json(report))
    else:
        print(format_gap_markdown(report), end="")
        if args.check_capability_requests:
            requests_ = report["open_capability_requests"]
            print("\n## Open State Hub capability requests (no matching federated capability)\n")
            if requests_ is None:
                print("_State Hub unreachable — skipped._\n")
            elif not requests_:
                print("- none\n")
            else:
                for r in requests_:
                    print(f"- `{r['id']}` ({r['requesting_domain']}): {r['title']}")
    return 0
@@ -697,6 +776,44 @@ def main(argv: list[str] | None = None) -> int:
    )
    overlaps.set_defaults(func=cmd_overlaps)
    plan_check = subparsers.add_parser(
        "plan-check",
        help="match a draft workplan or intent against the federated capability index",
    )
    plan_check.add_argument(
        "workplan", nargs="?", help="path to a workplan file (frontmatter + body)"
    )
    plan_check.add_argument("--intent", help="free-text intent instead of a workplan file")
    plan_check.add_argument(
        "--format", choices=["markdown", "json"], default="markdown"
    )
    plan_check.add_argument(
        "--reuse-threshold", type=float, default=0.45,
        help="score at or above which the verdict is 'reuse'",
    )
    plan_check.add_argument(
        "--extend-threshold", type=float, default=0.22,
        help="score at or above which the verdict is 'extend'",
    )
    plan_check.add_argument(
        "--record-outcome",
        choices=["reused", "extended", "new", "skipped"],
        help="append this outcome to registry/telemetry/plan-check-events.jsonl",
    )
    plan_check.add_argument(
        "--consumer-repo", default="reuse-surface",
        help="repo slug recorded with --record-outcome and --file-request",
    )
    plan_check.add_argument(
        "--file-request", action="store_true",
        help="on a 'new' verdict, file a State Hub capability request for the gap",
    )
    plan_check.add_argument(
        "--requesting-domain", default="infotech",
        help="domain slug recorded on a filed capability request",
    )
    plan_check.set_defaults(func=cmd_plan_check)
    catalog = subparsers.add_parser(
        "catalog", help="generate human-readable capability catalog"
    )
@@ -808,6 +925,12 @@ def main(argv: list[str] | None = None) -> int:
        choices=["markdown", "json"],
        default="markdown",
    )
    gaps.add_argument(
        "--check-capability-requests",
        action="store_true",
        help="also list open State Hub capability requests with no matching "
        "federated capability (requires State Hub reachable at 127.0.0.1:8000)",
    )
    gaps.set_defaults(func=cmd_report_gaps)
    stats = subparsers.add_parser("stats", help="registry maturity and federation stats")
--- a/reuse_surface/plan_check.py
+++ b/reuse_surface/plan_check.py
@@ -0,0 +1,299 @@
 from __future__ import annotations
 import json
 import re
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
 import yaml
 from reuse_surface.federation import FEDERATED_INDEX_PATH
 from reuse_surface.overlaps import TOKEN_RE
 from reuse_surface.registry import ROOT, load_index
 from reuse_surface.statehub_bridge import file_capability_request
 TELEMETRY_PATH = ROOT / "registry" / "telemetry" / "plan-check-events.jsonl"
 STALE_DAYS = 14
 DEFAULT_REUSE_THRESHOLD = 0.45
 DEFAULT_EXTEND_THRESHOLD = 0.22
 DEFAULT_TIE_WINDOW = 0.05
@dataclass
 class MatchQuery:
    source: str
    text: str
    workplan_id: str | None = None
    workplan_path: str | None = None
    tokens: set[str] = field(default_factory=set)
@dataclass
 class Match:
    id: str
    score: float
    kind: str
    vector: str | None = None
    owner: str | None = None
    summary: str | None = None
 def _tokens(text: str) -> set[str]:
    return set(TOKEN_RE.findall(text.lower()))
 def load_query_from_workplan(path: Path) -> MatchQuery:
    text = path.read_text(encoding="utf-8")
    match = re.match(r"^---\n(.*?)\n---\n?(.*)$", text, re.DOTALL)
    if not match:
        raise ValueError(f"{path}: missing YAML front matter")
    front = yaml.safe_load(match.group(1)) or {}
    body = match.group(2)
    parts = [str(front.get("title") or front.get("id") or path.stem)]
    for heading in ("Core Idea", "Problem statement", "One-liner"):
        section = re.search(
            rf"^##\s+{re.escape(heading)}\s*\n(.*?)(?:\n##\s|\Z)",
            body,
            re.DOTALL | re.MULTILINE,
        )
        if section:
            parts.append(section.group(1).strip())
    if len(parts) == 1:
        intro = body.strip().split("\n\n", 1)[0]
        parts.append(intro)
    blob = "\n".join(p for p in parts if p)
    return MatchQuery(
        source="workplan",
        text=blob,
        workplan_id=front.get("id"),
        workplan_path=str(path),
        tokens=_tokens(blob),
    )
 def load_query_from_intent(intent: str) -> MatchQuery:
    return MatchQuery(source="intent", text=intent, tokens=_tokens(intent))
 def _federated_entry_blob(item: dict[str, Any]) -> str:
    parts = [
        item.get("name", ""),
        item.get("summary", ""),
        " ".join(item.get("tags", [])),
    ]
    return " ".join(str(p) for p in parts if p)
 def load_federated_capabilities() -> tuple[list[dict[str, Any]], str | None]:
    """Returns (capabilities, updated_date). Falls back to the local index
    if the composed federated index doesn't exist yet."""
    if FEDERATED_INDEX_PATH.exists():
        data = yaml.safe_load(FEDERATED_INDEX_PATH.read_text(encoding="utf-8"))
        return data.get("capabilities", []), data.get("updated")
    data = load_index()
    return data.get("capabilities", []), data.get("updated")
 def _staleness_warning(updated: str | None) -> str | None:
    if not updated:
        return None
    try:
        updated_date = datetime.strptime(updated, "%Y-%m-%d").replace(
            tzinfo=timezone.utc
        )
    except ValueError:
        return None
    age_days = (datetime.now(timezone.utc) - updated_date).days
    if age_days > STALE_DAYS:
        return f"federated index is {age_days} days old (last composed {updated})"
    return None
 def _vector_rank(vector: str | None) -> tuple[int, int]:
    """Higher discovery/availability levels rank first among near-tied scores."""
    if not vector:
        return (0, 0)
    m = re.match(r"D(\d+)\s*/\s*A(\d+)", vector)
    if not m:
        return (0, 0)
    return (int(m.group(1)), int(m.group(2)))
 def match_query(
    query: MatchQuery,
    capabilities: list[dict[str, Any]],
    *,
    tie_window: float = DEFAULT_TIE_WINDOW,
 ) -> list[Match]:
    if not query.tokens or not capabilities:
        return []
    scored: list[Match] = []
    for item in capabilities:
        blob = _federated_entry_blob(item)
        tokens = _tokens(blob)
        if not tokens:
            continue
        score = len(query.tokens & tokens) / len(query.tokens | tokens)
        if score <= 0:
            continue
        scored.append(
            Match(
                id=item["id"],
                score=round(score, 4),
                kind="deterministic",
                vector=item.get("vector"),
                owner=item.get("owner"),
                summary=item.get("summary"),
            )
        )
    if not scored:
        return []
    scored.sort(key=lambda m: m.score, reverse=True)
    top_score = scored[0].score
    tied = [m for m in scored if top_score - m.score <= tie_window]
    rest = [m for m in scored if top_score - m.score > tie_window]
    tied.sort(key=lambda m: (_vector_rank(m.vector), m.score), reverse=True)
    return tied + rest
 def verdict_for_score(
    top_score: float,
    *,
    reuse_threshold: float = DEFAULT_REUSE_THRESHOLD,
    extend_threshold: float = DEFAULT_EXTEND_THRESHOLD,
 ) -> str:
    if top_score >= reuse_threshold:
        return "reuse"
    if top_score >= extend_threshold:
        return "extend"
    return "new"
 def run_plan_check(
    query: MatchQuery,
    *,
    reuse_threshold: float = DEFAULT_REUSE_THRESHOLD,
    extend_threshold: float = DEFAULT_EXTEND_THRESHOLD,
    tie_window: float = DEFAULT_TIE_WINDOW,
    top_n: int = 5,
 ) -> dict[str, Any]:
    capabilities, updated = load_federated_capabilities()
    matches = match_query(query, capabilities, tie_window=tie_window)
    top_score = matches[0].score if matches else 0.0
    verdict = verdict_for_score(
        top_score, reuse_threshold=reuse_threshold, extend_threshold=extend_threshold
    )
    return {
        "query": {
            "source": query.source,
            "text": query.text,
            "workplan_id": query.workplan_id,
            "workplan_path": query.workplan_path,
        },
        "verdict": verdict,
        "top_score": top_score,
        "matches": [
            {
                "id": m.id,
                "score": m.score,
                "vector": m.vector,
                "owner": m.owner,
                "summary": m.summary,
                "kind": m.kind,
            }
            for m in matches[:top_n]
        ],
        "federated_index_updated": updated,
        "federated_index_stale_warning": _staleness_warning(updated),
    }
 def format_plan_check_markdown(result: dict[str, Any]) -> str:
    lines = [f"# Plan check: {result['verdict']}", ""]
    query = result["query"]
    label = query.get("workplan_id") or query["text"][:80]
    lines.append(f"**Query ({query['source']}):** {label}")
    lines.append("")
    matches = result.get("matches", [])
    if matches:
        lines.append("## Matches")
        for m in matches:
            vec = f" ({m['vector']})" if m.get("vector") else ""
            owner = f" — {m['owner']}" if m.get("owner") else ""
            lines.append(f"- `{m['id']}`{vec}{owner} — score {m['score']:.2f} [{m['kind']}]")
            if m.get("summary"):
                lines.append(f"  > {m['summary']}")
    else:
        lines.append("_No matches found in the federated index._")
    lines.append("")
    verdict = result["verdict"]
    if verdict == "reuse":
        lines.append("**Verdict: REUSE** — an existing capability already covers this; link it instead of building new.")
    elif verdict == "extend":
        lines.append("**Verdict: EXTEND** — scope overlaps closely enough that extending the top match is likely cheaper than a new capability.")
    else:
        lines.append("**Verdict: NEW** — no close match in the federated index; proceed.")
    warning = result.get("federated_index_stale_warning")
    if warning:
        lines.append("")
        lines.append(f"⚠ {warning}")
    return "\n".join(lines) + "\n"
 def format_plan_check_json(result: dict[str, Any]) -> str:
    return json.dumps(result, indent=2, sort_keys=True)
 def maybe_file_capability_request(
    result: dict[str, Any],
    *,
    requesting_domain: str,
    requesting_agent: str,
 ) -> dict[str, Any] | None:
    """On a 'new' verdict, file a State Hub capability request for the gap.
    Returns None (and does nothing) for any other verdict, or if the hub is
    unreachable -- this never blocks plan-check's primary output."""
    if result["verdict"] != "new":
        return None
    query = result["query"]
    title = (query.get("workplan_id") or query["text"])[:120]
    return file_capability_request(
        title=f"plan-check gap: {title}",
        description=query["text"],
        requesting_domain=requesting_domain,
        requesting_agent=requesting_agent,
        requesting_workplan_id=query.get("workplan_id"),
    )
 def record_outcome(
    result: dict[str, Any],
    outcome: str,
    *,
    consumer_repo: str = "reuse-surface",
 ) -> Path:
    TELEMETRY_PATH.parent.mkdir(parents=True, exist_ok=True)
    top_match = result["matches"][0]["id"] if result.get("matches") else None
    event = {
        "ts": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
        "consumer_repo": consumer_repo,
        "capability_id": top_match,
        "verdict": result["verdict"],
        "outcome": outcome,
        "source": "plan-check",
    }
    with TELEMETRY_PATH.open("a", encoding="utf-8") as handle:
        handle.write(json.dumps(event, sort_keys=True) + "\n")
    return TELEMETRY_PATH
--- a/reuse_surface/reports.py
+++ b/reuse_surface/reports.py
@@ -110,6 +110,9 @@ def collect_gap_report(
        r for r in repos
        if r.get("status") == "established" and r.get("capability_count", 0) == 0
    ]
    unclassified = [r for r in empty_scaffolds if r.get("capability_status", "pending") == "pending"]
    explicit_none = [r for r in empty_scaffolds if r.get("capability_status") == "none"]
    covered = [r for r in repos if r.get("capability_status") in ("has", "none")]
    seeded = [r for r in repos if r.get("seed_from_reuse_surface")]
    dedup_pending = [
        {
@@ -133,6 +136,11 @@ def collect_gap_report(
        ],
        "empty_scaffold_count": len(empty_scaffolds),
        "empty_scaffolds": [r["slug"] for r in empty_scaffolds],
        "unclassified_count": len(unclassified),
        "unclassified": [r["slug"] for r in unclassified],
        "explicit_none_count": len(explicit_none),
        "explicit_none": [r["slug"] for r in explicit_none],
        "coverage_ratio": f"{len(covered)}/{len(repos)}" if repos else "0/0",
        "seeded_repos": [
            {
                "slug": r["slug"],
@@ -180,11 +188,23 @@ def format_gap_markdown(report: dict[str, Any]) -> str:
        lines.append("- none (owner rows migrated to canonical repos)")
    lines.append("")
-    empty_count = report.get("empty_scaffold_count", 0)
+    lines.append(f"**Capability coverage:** {report.get('coverage_ratio', '?')} "
-    lines.append(f"## Empty scaffolds ({empty_count})")
+                 "(repos with a capability or an explicit no-capability marker)")
-    slugs = report.get("empty_scaffolds", [])
+    lines.append("")
-    if slugs:
+
-        for slug in slugs:
+    unclassified = report.get("unclassified", [])
    lines.append(f"## Unclassified scaffolds ({report.get('unclassified_count', len(unclassified))})")
    if unclassified:
        for slug in unclassified:
            lines.append(f"- `{slug}`")
    else:
        lines.append("- none")
    lines.append("")
    explicit_none = report.get("explicit_none", [])
    lines.append(f"## Explicitly no-capability ({report.get('explicit_none_count', len(explicit_none))})")
    if explicit_none:
        for slug in explicit_none:
            lines.append(f"- `{slug}`")
    else:
        lines.append("- none")
--- a/reuse_surface/statehub_bridge.py
+++ b/reuse_surface/statehub_bridge.py
@@ -0,0 +1,103 @@
 from __future__ import annotations
 import json
 import urllib.error
 import urllib.parse
 import urllib.request
 from typing import Any
 DEFAULT_BASE_URL = "http://127.0.0.1:8000"
 TIMEOUT_SECONDS = 5
 LIST_TIMEOUT_SECONDS = 20
 # Observed status vocabulary (2026-07): "requested", "completed". No fixed
 # enum is published by the API (free-form string field) -- treat anything
 # not in this terminal set as still-open rather than assuming a closed list.
 TERMINAL_STATUSES = {"completed", "cancelled", "rejected", "resolved", "closed"}
 def _request(
    method: str,
    path: str,
    base_url: str,
    *,
    body: dict[str, Any] | None = None,
    params: dict[str, str] | None = None,
    timeout: int = TIMEOUT_SECONDS,
 ) -> dict[str, Any] | list[Any]:
    url = f"{base_url.rstrip('/')}{path}"
    if params:
        query = "&".join(
            f"{k}={urllib.parse.quote(v)}" for k, v in params.items() if v
        )
        if query:
            url = f"{url}?{query}"
    data = json.dumps(body).encode("utf-8") if body is not None else None
    request = urllib.request.Request(
        url,
        data=data,
        method=method,
        headers={"Content-Type": "application/json", "User-Agent": "reuse-surface/0.1"},
    )
    with urllib.request.urlopen(request, timeout=timeout) as response:
        return json.loads(response.read().decode("utf-8"))
 def state_hub_reachable(base_url: str = DEFAULT_BASE_URL) -> bool:
    try:
        _request("GET", "/state/health", base_url)
        return True
    except (urllib.error.URLError, TimeoutError, OSError):
        return False
 def file_capability_request(
    *,
    title: str,
    description: str,
    requesting_domain: str,
    requesting_agent: str,
    capability_type: str = "reuse-surface-new-verdict",
    requesting_workplan_id: str | None = None,
    base_url: str = DEFAULT_BASE_URL,
 ) -> dict[str, Any] | None:
    """Files a State Hub capability request for a plan-check 'new' verdict.
    Returns the created request record, or None if the hub is unreachable
    (degrades gracefully -- plan-check never blocks on this)."""
    if not state_hub_reachable(base_url):
        return None
    body = {
        "title": title,
        "description": description,
        "capability_type": capability_type,
        "requesting_domain": requesting_domain,
        "requesting_agent": requesting_agent,
        "requesting_workplan_id": requesting_workplan_id,
    }
    try:
        return _request("POST", "/capability-requests/", base_url, body=body)
    except (urllib.error.URLError, TimeoutError, OSError):
        return None
 def list_open_capability_requests(
    base_url: str = DEFAULT_BASE_URL,
 ) -> list[dict[str, Any]] | None:
    """Returns capability requests whose status is not terminal (see
    TERMINAL_STATUSES), or None if the hub is unreachable. A request can
    carry a catalog_entry_id while still 'requested' (routed, not
    fulfilled), so status -- not catalog_entry_id presence -- is the open
    signal. The list endpoint can be slow (observed ~7s with a handful of
    rows); a longer timeout than the health check is used deliberately."""
    if not state_hub_reachable(base_url):
        return None
    try:
        requests_ = _request(
            "GET", "/capability-requests/", base_url, timeout=LIST_TIMEOUT_SECONDS
        )
    except (urllib.error.URLError, TimeoutError, OSError):
        return None
    if not isinstance(requests_, list):
        return []
    return [r for r in requests_ if r.get("status") not in TERMINAL_STATUSES]
--- a/schemas/plan-check-result.schema.json
+++ b/schemas/plan-check-result.schema.json
@@ -0,0 +1,54 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://reuse-surface.local/schemas/plan-check-result.schema.json",
  "title": "PlanCheckResult",
  "type": "object",
  "additionalProperties": false,
  "required": ["query", "verdict", "top_score", "matches"],
  "properties": {
    "query": {
      "type": "object",
      "additionalProperties": false,
      "required": ["source", "text"],
      "properties": {
        "source": {"type": "string", "enum": ["workplan", "intent"]},
        "text": {"type": "string", "minLength": 1},
        "workplan_id": {"type": ["string", "null"]},
        "workplan_path": {"type": ["string", "null"]}
      }
    },
    "verdict": {
      "type": "string",
      "enum": ["reuse", "extend", "new"]
    },
    "top_score": {
      "type": "number",
      "minimum": 0,
      "maximum": 1
    },
    "matches": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": false,
        "required": ["id", "score", "kind"],
        "properties": {
          "id": {
            "type": "string",
            "pattern": "^capability\\.[a-z0-9]+(\\.[a-z0-9-]+)+$"
          },
          "score": {"type": "number", "minimum": 0, "maximum": 1},
          "vector": {"type": ["string", "null"]},
          "owner": {"type": ["string", "null"]},
          "summary": {"type": ["string", "null"]},
          "kind": {
            "type": "string",
            "enum": ["deterministic", "llm", "related"]
          }
        }
      }
    },
    "federated_index_updated": {"type": ["string", "null"]},
    "federated_index_stale_warning": {"type": ["string", "null"]}
  }
 }
--- a/schemas/reuse-event.schema.json
+++ b/schemas/reuse-event.schema.json
@@ -0,0 +1,29 @@
 {
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://reuse-surface.local/schemas/reuse-event.schema.json",
  "title": "ReuseEvent",
  "description": "One line of registry/telemetry/plan-check-events.jsonl, or one POST /v1/reuse-events body (REUSE-WP-0019-T04). Shared schema so plan-check's local fallback and the hub's telemetry store never diverge.",
  "type": "object",
  "additionalProperties": false,
  "required": ["ts", "consumer_repo", "verdict", "source"],
  "properties": {
    "ts": {"type": "string", "format": "date-time"},
    "consumer_repo": {"type": "string", "minLength": 1},
    "capability_id": {
      "type": ["string", "null"],
      "pattern": "^capability\\.[a-z0-9]+(\\.[a-z0-9-]+)+$"
    },
    "verdict": {
      "type": "string",
      "enum": ["reuse", "extend", "new"]
    },
    "outcome": {
      "type": ["string", "null"],
      "enum": ["reused", "extended", "new", "skipped", null]
    },
    "source": {
      "type": "string",
      "enum": ["plan-check", "manual", "hub"]
    }
  }
 }
--- a/specs/PlanCheck.md
+++ b/specs/PlanCheck.md
@@ -0,0 +1,169 @@
 # Plan Check
 **Repository:** `reuse-surface`
 **Artifact:** `specs/PlanCheck.md`
 **Status:** Draft 0.1 (REUSE-WP-0018-T01)
 **Schema:** `schemas/plan-check-result.schema.json`
 ---
 ## 1. Purpose
 `plan-check` closes the consumption loop the registry has lacked since
 inception: nothing today nudges an agent planning work in a sibling repo to
 query the federated capability index before building. The registry has been
 write-mostly. `plan-check` is the query-before-build step — advisory, not a
 gate — that matches a draft workplan or a free-text intent against the
 federated index and returns a verdict: reuse it, extend it, or it's genuinely
 new.
 This spec covers the deterministic matching core (T02) and its interfaces
 with the optional LLM rerank (T03) and the State Hub capability-request
 bridge (T04). It does not cover the ecosystem rollout (T05) — the
 session-protocol convention is designed once this spec is implemented and
 dogfooded in this repo.
 ## 2. Design principles
 1. **Deterministic core, LLM assist optional.** Keyword/scope/relation
   matching against `registry/indexes/federated.yaml` works with no external
   dependency. `LLM_CONNECT_URL` unlocks a semantic rerank pass; its absence
   degrades gracefully, never blocks.
 2. **Advisory, not blocking.** `plan-check` never fails a workplan into
   existence or refuses to let one be created. Adoption comes from the tool
   being useful and from convention (REUSE-WP-0018-T05), not from a gate.
 3. **Deterministic matches always rank first.** Whatever the LLM rerank
   proposes, it is listed after — and clearly labeled apart from — the
   deterministic candidates, so a human or agent can trust the base result
   even with `--no-llm`.
 4. **Every invocation is a data point.** `--record-outcome` writes an
   append-only fact. This is the raw material for REUSE-WP-0019's reuse
   telemetry — `plan-check` and telemetry share one event schema from day
   one so nothing needs migrating later.
 ## 3. Input model
 Two input shapes, mutually exclusive:
 | Input | How it's read |
 |---|---|
 | Workplan file | Parsed like `registry_update.py`'s git-diff signal collector: YAML frontmatter (`---`-delimited) plus the Markdown body. `title`, the one-liner in the intro paragraph, and any `## Problem statement` / `## Core Idea` heading content feed the match blob. |
 | `--intent "free text"` | Used verbatim as the match blob. |
 Both normalize to the same internal `MatchQuery { text: str, tokens: set[str] }`
 before matching — the matcher does not care which input shape it came from.
 ## 4. Matching pipeline
 Reuses the token-Jaccard approach already proven in `overlaps.py`
 (`TOKEN_RE`, `_tokens`) rather than inventing a second scoring method in the
 same codebase:
 1. **Tokenize** the query blob with the existing `TOKEN_RE`.
 2. **Score** against every federated capability's blob (`name` + `summary` +
   `tags` + `discovery.intent` + `discovery.includes`, mirroring
   `overlaps._entry_blob`) via Jaccard similarity.
 3. **Rank signal, not just tie-break:** among candidates within
   `--tie-window` (default 0.05) of the top score, prefer the entry with the
   higher discovery/availability vector (a more mature capability is a safer
   reuse bet at equal textual match).
 4. **Relation expansion:** if a top candidate has `relations.supports` or
   `relations.related_to` entries, surface them as secondary candidates
   labeled `related` rather than silently dropped.
 ## 5. Verdict model
 | Verdict | Condition | Meaning |
 |---|---|---|
 | `reuse` | top score ≥ `--reuse-threshold` (default 0.45) | An existing capability already covers this need — link it, don't rebuild it. |
 | `extend` | top score in `[--extend-threshold, --reuse-threshold)` (default 0.22–0.45) | Scope overlaps a capability closely enough that extending it is very likely cheaper than a new one — surfaced with an explicit "consider extending" framing. |
 | `new` | top score < `--extend-threshold`, or no federated capabilities exist | No good match. Proceed; optionally file a capability request (T04). |
 Thresholds are CLI flags, not hardcoded, because the right cutoff will drift
 as coverage and entry quality improve (see REUSE-WP-0017). Defaults come from
 the same threshold reasoning as `overlaps.py`'s `--threshold 0.28` default,
 shifted since plan-check matches short intent text against short summaries
 rather than long entry-to-entry blobs.
 ## 6. Output
 ### Markdown (TTY default)
 ```text
 # Plan check: reuse | extend | new
 **Query:** <workplan title or intent text>
 ## Top match
 - `capability.infotech.issue-tracking` (score 0.52, D4/A2/C2/R1) — issue-core
  > Unified Python/CLI interface for issue tracking across Gitea, GitHub, and GitLab...
 ## Other candidates
 - ...
 ## Related (via relations.*)
 - ...
 Verdict: REUSE — link this capability instead of building new.
 ```
 ### JSON (`--format json`, agent-consumable)
 Validated against `schemas/plan-check-result.schema.json`:
 ```json
 {
  "query": {"source": "workplan|intent", "text": "...", "workplan_id": "..."},
  "verdict": "reuse|extend|new",
  "top_score": 0.52,
  "matches": [
    {"id": "capability.infotech.issue-tracking", "score": 0.52, "vector": "D4/A2/C2/R1", "owner": "issue-core", "kind": "deterministic|llm|related"}
  ],
  "federated_index_updated": "2026-07-06",
  "federated_index_stale_warning": null
 }
 ```
 `federated_index_stale_warning` is set when `federated.yaml`'s `updated`
 field is older than 14 days — a cheap freshness signal until
 REUSE-WP-0019's automatic recompose lands.
 ## 7. Outcome recording (`--record-outcome`)
 Append-only JSONL under `registry/telemetry/plan-check-events.jsonl`
 (reuse-surface's own copy; sibling repos get their own via the same schema
 when they adopt T05). One line per invocation:
 ```json
 {"ts": "2026-07-07T10:00:00Z", "consumer_repo": "reuse-surface", "capability_id": "capability.infotech.issue-tracking", "verdict": "reuse", "outcome": "reused|extended|new|skipped", "source": "plan-check"}
 ```
 This schema is deliberately identical to the reuse-event schema
 REUSE-WP-0019-T04 will implement server-side — `plan-check`'s local JSONL
 file is the fallback path when the hub is unreachable, and the same record
 shape posts to `POST /v1/reuse-events` once T04/WP-0019 exist. No local
 telemetry write ever blocks the primary command.
 ## 8. Relationship to T03 (LLM rerank) and T04 (State Hub bridge)
 - **T03** adds an optional post-pass: send the deterministic top-N candidates
  plus the query text to `llm-connect` for a semantic confidence score and
  possible reordering *within* the deterministic candidate set. It does not
  invent new candidates outside what deterministic matching already found —
  keeps the "deterministic matches always rank first" guarantee simple to
  reason about. Schema-constrained JSON response, mirrors the
  `maintain_llm.py` pattern (graceful skip on missing `LLM_CONNECT_URL`,
  reject malformed responses rather than guess).
 - **T04** wires `new` verdicts to `POST /messages/` (State Hub
  `request_capability`-equivalent) and reads back open capability requests
  for `report gaps` to list unmatched. Deferred to its own task since it
  depends on State Hub API shapes this spec does not need to pin down yet.
 ## 9. Non-goals
 - Blocking or gating workplan creation (§2.2).
 - Embedding-based / vector-similarity matching — token-Jaccard is the
  deterministic core for consistency with `overlaps.py`; embeddings are an
  LLM-rerank concern (T03), not a second deterministic path.
 - Editing sibling repos' rules files directly — that's the template
  propagation mechanism's job (T05), not this tool's.
--- a/templates/NO_CAPABILITIES.template.md
+++ b/templates/NO_CAPABILITIES.template.md
@@ -0,0 +1,24 @@
 ---
 # Copy this file to registry/NO_CAPABILITIES.md in the target repo.
 # It marks the repo as reviewed with no reusable capability to register,
 # converting an "empty scaffold" from ambiguous to informative.
 repo: <slug>
 reason: >
  One or two sentences on why this repo has nothing to register — e.g.
  personal experiment, fork with no independent scope, docs/canon-only,
  probe/spike not intended for reuse.
 reviewed: "YYYY-MM-DD"
 reviewed_by: <person-or-agent>
 revisit: >
  Optional. Note a condition or date under which this repo should be
  reclassified (e.g. "revisit if the probe becomes a maintained service").
 ---
 # No reusable capability
 This repo was reviewed for the `reuse-surface` capability registry
 (REUSE-WP-0017 coverage campaign) and has no capability to register at this
 time. See the `reason` field above.
 Set `capability_status: none` for this repo's row in
 `local-repo-roster.yaml` when this file lands.
--- a/tests/test_plan_check.py
+++ b/tests/test_plan_check.py
@@ -0,0 +1,198 @@
 from __future__ import annotations
 import json
 from reuse_surface.plan_check import (
    MatchQuery,
    load_query_from_intent,
    load_query_from_workplan,
    maybe_file_capability_request,
    match_query,
    record_outcome,
    run_plan_check,
    verdict_for_score,
 )
 SAMPLE_CAPABILITIES = [
    {
        "id": "capability.infotech.issue-tracking",
        "name": "Universal Issue Tracking Coordination",
        "summary": "Unified interface for issue tracking coordination across Gitea, GitHub, GitLab.",
        "vector": "D4 / A2 / C2 / R1",
        "owner": "issue-core",
        "tags": ["issue-tracking", "coordination"],
    },
    {
        "id": "capability.audit.event-retain",
        "name": "Audit Event Retention",
        "summary": "Collect, normalize, retain, and search audit events with integrity evidence across tenants.",
        "vector": "D4 / A2 / C2 / R1",
        "owner": "audit-core",
        "tags": ["audit"],
    },
 ]
 def test_verdict_thresholds():
    assert verdict_for_score(0.5) == "reuse"
    assert verdict_for_score(0.3) == "extend"
    assert verdict_for_score(0.1) == "new"
    assert verdict_for_score(0.45) == "reuse"
    assert verdict_for_score(0.22) == "extend"
 def test_match_query_finds_close_match():
    query = load_query_from_intent(
        "unified issue tracking coordination across Gitea GitHub GitLab"
    )
    matches = match_query(query, SAMPLE_CAPABILITIES)
    assert matches
    assert matches[0].id == "capability.infotech.issue-tracking"
    assert matches[0].score > 0.3
 def test_match_query_empty_when_no_overlap():
    query = load_query_from_intent("something entirely unrelated xyzzy plugh")
    matches = match_query(query, SAMPLE_CAPABILITIES)
    assert matches == []
 def test_match_query_no_capabilities():
    query = load_query_from_intent("anything")
    assert match_query(query, []) == []
 def test_load_query_from_workplan(tmp_path):
    workplan = tmp_path / "TEST-WP-0001-thing.md"
    workplan.write_text(
        """---
 id: TEST-WP-0001
 title: "Unified issue tracking coordination"
 status: proposed
 ---
 # Unified issue tracking coordination
 ## Core Idea
 Build a single interface for issue tracking across Gitea, GitHub, and GitLab.
 """
    )
    query = load_query_from_workplan(workplan)
    assert query.source == "workplan"
    assert query.workplan_id == "TEST-WP-0001"
    assert "issue tracking" in query.text.lower()
    matches = match_query(query, SAMPLE_CAPABILITIES)
    assert matches[0].id == "capability.infotech.issue-tracking"
 def test_run_plan_check_reuse_verdict(monkeypatch):
    monkeypatch.setattr(
        "reuse_surface.plan_check.load_federated_capabilities",
        lambda: (SAMPLE_CAPABILITIES, "2026-07-06"),
    )
    query = MatchQuery(
        source="intent",
        text="unified issue tracking coordination gitea github gitlab",
        tokens={"unified", "issue", "tracking", "coordination", "gitea", "github", "gitlab"},
    )
    result = run_plan_check(query)
    assert result["verdict"] == "reuse"
    assert result["matches"][0]["id"] == "capability.infotech.issue-tracking"
    assert result["federated_index_stale_warning"] is None
 def test_run_plan_check_stale_warning(monkeypatch):
    monkeypatch.setattr(
        "reuse_surface.plan_check.load_federated_capabilities",
        lambda: (SAMPLE_CAPABILITIES, "2020-01-01"),
    )
    query = load_query_from_intent("nothing matches this at all zzz")
    result = run_plan_check(query)
    assert result["verdict"] == "new"
    assert "days old" in result["federated_index_stale_warning"]
 def test_record_outcome_appends_jsonl(tmp_path, monkeypatch):
    telemetry_path = tmp_path / "plan-check-events.jsonl"
    monkeypatch.setattr("reuse_surface.plan_check.TELEMETRY_PATH", telemetry_path)
    result = {
        "verdict": "reuse",
        "matches": [{"id": "capability.infotech.issue-tracking"}],
    }
    record_outcome(result, "reused", consumer_repo="some-repo")
    lines = telemetry_path.read_text().splitlines()
    assert len(lines) == 1
    event = json.loads(lines[0])
    assert event["consumer_repo"] == "some-repo"
    assert event["capability_id"] == "capability.infotech.issue-tracking"
    assert event["outcome"] == "reused"
    assert event["source"] == "plan-check"
 def test_maybe_file_capability_request_only_on_new_verdict(monkeypatch):
    called = []
    monkeypatch.setattr(
        "reuse_surface.plan_check.file_capability_request",
        lambda **kwargs: called.append(kwargs) or {"id": "req-1"},
    )
    reuse_result = {"verdict": "reuse", "query": {"text": "x", "workplan_id": None}}
    assert maybe_file_capability_request(
        reuse_result, requesting_domain="infotech", requesting_agent="a"
    ) is None
    assert called == []
    new_result = {"verdict": "new", "query": {"text": "some new intent", "workplan_id": None}}
    filed = maybe_file_capability_request(
        new_result, requesting_domain="infotech", requesting_agent="a"
    )
    assert filed == {"id": "req-1"}
    assert called[0]["requesting_domain"] == "infotech"
 def test_cmd_plan_check_file_request_flag(monkeypatch):
    from reuse_surface.cli import main
    monkeypatch.setattr(
        "reuse_surface.plan_check.load_federated_capabilities",
        lambda: (SAMPLE_CAPABILITIES, "2026-07-06"),
    )
    filed_calls = []
    monkeypatch.setattr(
        "reuse_surface.cli.maybe_file_capability_request",
        lambda result, **kwargs: filed_calls.append(kwargs) or {"id": "req-9"},
    )
    exit_code = main(
        ["plan-check", "--intent", "totally unrelated xyzzy plugh", "--file-request"]
    )
    assert exit_code == 0
    assert filed_calls
 def test_cmd_plan_check_intent_json(monkeypatch):
    from reuse_surface.cli import main
    monkeypatch.setattr(
        "reuse_surface.plan_check.load_federated_capabilities",
        lambda: (SAMPLE_CAPABILITIES, "2026-07-06"),
    )
    exit_code = main(
        ["plan-check", "--intent", "issue tracking gitea github gitlab", "--format", "json"]
    )
    assert exit_code == 0
 def test_cmd_plan_check_requires_input():
    from reuse_surface.cli import main
    exit_code = main(["plan-check"])
    assert exit_code == 1
 def test_cmd_plan_check_rejects_both_inputs(tmp_path):
    from reuse_surface.cli import main
    workplan = tmp_path / "x.md"
    workplan.write_text("---\nid: X\n---\nbody")
    exit_code = main(["plan-check", str(workplan), "--intent", "also this"])
    assert exit_code == 1
--- a/tests/test_reports.py
+++ b/tests/test_reports.py
@@ -96,9 +96,38 @@ def test_collect_gap_report_from_roster():
    root = Path(__file__).resolve().parent.parent
    roster = root / "registry/federation/local-repo-roster.yaml"
    report = collect_gap_report(roster)
-    assert report["summary"]["total"] == 60
+    assert report["summary"]["total"] == 61
    assert len(report["publish_fail"]) == 0
-    assert report["empty_scaffold_count"] >= 40
+    assert report["unclassified_count"] + report["explicit_none_count"] == report["empty_scaffold_count"]
    assert "/" in report["coverage_ratio"]
 def test_collect_gap_report_splits_unclassified_and_explicit_none(tmp_path):
    roster_path = tmp_path / "roster.yaml"
    roster_path.write_text(
        """
 summary:
  total: 3
 repos:
 - slug: has-repo
  status: established
  capability_count: 1
  capability_status: has
 - slug: none-repo
  status: established
  capability_count: 0
  capability_status: none
 - slug: pending-repo
  status: established
  capability_count: 0
  capability_status: pending
 """
    )
    report = collect_gap_report(roster_path, index={"capabilities": []})
    assert report["unclassified"] == ["pending-repo"]
    assert report["explicit_none"] == ["none-repo"]
    assert report["empty_scaffold_count"] == 2
    assert report["coverage_ratio"] == "2/3"
 def test_format_gap_markdown_lists_publish_fail():
@@ -108,6 +137,11 @@ def test_format_gap_markdown_lists_publish_fail():
        "publish_fail": [{"slug": "inter-hub", "publish_note": "missing repo"}],
        "empty_scaffold_count": 1,
        "empty_scaffolds": ["ops-bridge"],
        "unclassified_count": 1,
        "unclassified": ["ops-bridge"],
        "explicit_none_count": 0,
        "explicit_none": [],
        "coverage_ratio": "59/60",
        "seeded_repos": [],
        "dedup_pending_local_owners": [],
        "local_capability_count": 2,
@@ -124,6 +158,29 @@ def test_cmd_report_gaps_json(monkeypatch):
    assert exit_code == 0
 def test_cmd_report_gaps_check_capability_requests_unreachable(monkeypatch):
    from reuse_surface.cli import main
    monkeypatch.setattr(
        "reuse_surface.cli.list_open_capability_requests", lambda: None
    )
    exit_code = main(["report", "gaps", "--check-capability-requests"])
    assert exit_code == 0
 def test_cmd_report_gaps_check_capability_requests_json(monkeypatch):
    from reuse_surface.cli import main
    monkeypatch.setattr(
        "reuse_surface.cli.list_open_capability_requests",
        lambda: [{"id": "r1", "title": "Need X", "requesting_domain_slug": "infotech"}],
    )
    exit_code = main(
        ["report", "gaps", "--check-capability-requests", "--format", "json"]
    )
    assert exit_code == 0
 def test_cmd_report_cohorts_markdown(monkeypatch):
    from reuse_surface.cli import main
--- a/tests/test_statehub_bridge.py
+++ b/tests/test_statehub_bridge.py
@@ -0,0 +1,66 @@
 from __future__ import annotations
 import urllib.error
 from reuse_surface import statehub_bridge
 def test_state_hub_reachable_true(monkeypatch):
    monkeypatch.setattr(statehub_bridge, "_request", lambda *a, **k: {"status": "ok"})
    assert statehub_bridge.state_hub_reachable() is True
 def test_state_hub_reachable_false_on_error(monkeypatch):
    def raise_error(*args, **kwargs):
        raise urllib.error.URLError("no route")
    monkeypatch.setattr(statehub_bridge, "_request", raise_error)
    assert statehub_bridge.state_hub_reachable() is False
 def test_file_capability_request_skips_when_unreachable(monkeypatch):
    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: False)
    result = statehub_bridge.file_capability_request(
        title="t", description="d", requesting_domain="infotech", requesting_agent="a"
    )
    assert result is None
 def test_file_capability_request_posts_body(monkeypatch):
    captured = {}
    def fake_request(method, path, base_url, *, body=None, params=None, timeout=None):
        captured["method"] = method
        captured["path"] = path
        captured["body"] = body
        return {"id": "abc-123", **body}
    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: True)
    monkeypatch.setattr(statehub_bridge, "_request", fake_request)
    result = statehub_bridge.file_capability_request(
        title="Need X", description="desc", requesting_domain="infotech", requesting_agent="reuse-surface"
    )
    assert captured["method"] == "POST"
    assert captured["path"] == "/capability-requests/"
    assert captured["body"]["title"] == "Need X"
    assert result["id"] == "abc-123"
 def test_list_open_capability_requests_filters_terminal_status(monkeypatch):
    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: True)
    monkeypatch.setattr(
        statehub_bridge,
        "_request",
        lambda *a, **k: [
            {"id": "1", "status": "requested"},
            {"id": "2", "status": "completed"},
            {"id": "3", "status": "requested", "catalog_entry_id": "routed-but-open"},
        ],
    )
    result = statehub_bridge.list_open_capability_requests()
    assert {r["id"] for r in result} == {"1", "3"}
 def test_list_open_capability_requests_none_when_unreachable(monkeypatch):
    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: False)
    assert statehub_bridge.list_open_capability_requests() is None
--- a/tests/test_stats.py
+++ b/tests/test_stats.py
@@ -29,8 +29,8 @@ def test_collect_roster_stats_federation_ready():
    root = Path(__file__).resolve().parent.parent
    roster = root / "registry/federation/local-repo-roster.yaml"
    stats = collect_roster_stats(roster, federation_ready=True)
-    assert stats["counts"]["total"] == 60
+    assert stats["counts"]["total"] == 61
-    assert stats["counts"]["established"] == 60
+    assert stats["counts"]["established"] == 61
    assert "federation_readiness" in stats
    text = format_roster_stats_markdown(stats)
    assert "publish pass ratio" in text
--- a/tools/README.md
+++ b/tools/README.md
@@ -51,6 +51,28 @@ reuse-surface overlaps
 reuse-surface overlaps --threshold 0.35
 ```
 ### plan-check
 Query-before-build check (REUSE-WP-0018): match a draft workplan or a free
 intent against the federated capability index before starting new work.
 Deterministic token matching against `registry/indexes/federated.yaml`;
 advisory only — never blocks workplan creation. See `specs/PlanCheck.md`.
 ```bash
 reuse-surface plan-check workplans/XXX-WP-0042-something.md
 reuse-surface plan-check --intent "parse invoices and file evidence"
 reuse-surface plan-check --intent "..." --format json
 reuse-surface plan-check --intent "..." --record-outcome reused
 reuse-surface plan-check --intent "..." --file-request --requesting-domain infotech
 ```
 `reuse|extend|new` verdict from `--reuse-threshold`/`--extend-threshold`
 (defaults 0.45/0.22). `--record-outcome` appends to
 `registry/telemetry/plan-check-events.jsonl` (schema shared with
 REUSE-WP-0019's reuse telemetry). `--file-request` files a State Hub
 capability request on a `new` verdict (requires the hub reachable at
 `127.0.0.1:8000`; degrades gracefully offline).
 ### catalog
 Generate human-readable catalog artifacts (UC-RS-018).
@@ -110,8 +132,14 @@ Run the service locally: `REUSE_SURFACE_TOKEN=dev-token reuse-surface serve`
 reuse-surface report gaps
 reuse-surface report gaps --format json
 reuse-surface report gaps --roster registry/federation/local-repo-roster.yaml
 reuse-surface report gaps --check-capability-requests
 ```
 `--check-capability-requests` (REUSE-WP-0018-T04) also lists open State Hub
 capability requests with no matching federated capability; requires the hub
 reachable at `127.0.0.1:8000` and degrades gracefully (prints "skipped") when
 it isn't. Off by default so `report gaps` stays fast and offline-safe.
 Workstation roster report: publish blockers, empty scaffolds, seed-ready repos,
 and local index owner stubs pending dedup.
--- a/workplans/REUSE-WP-0001-statehub-bootstrap.md
+++ b/workplans/REUSE-WP-0001-statehub-bootstrap.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0001
 type: workplan
 title: "Bootstrap State Hub integration"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0002-mvp-registry-foundation.md
+++ b/workplans/REUSE-WP-0002-mvp-registry-foundation.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0002
 type: workplan
 title: "MVP registry foundation"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0003-intent-scope-gap-closure.md
+++ b/workplans/REUSE-WP-0003-intent-scope-gap-closure.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0003
 type: workplan
 title: "Close intent-scope gaps: docs, tooling, and registry growth"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0004-registry-hardening.md
+++ b/workplans/REUSE-WP-0004-registry-hardening.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0004
 type: workplan
 title: "Registry hardening: CI, overlap detection, and catalog"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0005-registry-federation.md
+++ b/workplans/REUSE-WP-0005-registry-federation.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0005
 type: workplan
 title: "Registry federation and relation graphs"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md
+++ b/workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0006
 type: workplan
 title: "Registry hygiene and coverage expansion"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0007-interactive-catalog.md
+++ b/workplans/REUSE-WP-0007-interactive-catalog.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0007
 type: workplan
 title: "Interactive capability catalog"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0008-graph-explorer.md
+++ b/workplans/REUSE-WP-0008-graph-explorer.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0008
 type: workplan
 title: "Interactive relation graph explorer"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0009-cli-hardening.md
+++ b/workplans/REUSE-WP-0009-cli-hardening.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0009
 type: workplan
 title: "CLI hardening and test suite"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0010-network-federation.md
+++ b/workplans/REUSE-WP-0010-network-federation.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0010
 type: workplan
 title: "Network federation for remote indexes"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0016-interactive-registry-maintain.md
+++ b/workplans/REUSE-WP-0016-interactive-registry-maintain.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0016
 type: workplan
 title: "Interactive registry maintain with llm-connect automation"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0017-capability-coverage-campaign.md
+++ b/workplans/REUSE-WP-0017-capability-coverage-campaign.md
@@ -0,0 +1,278 @@
 ---
 id: REUSE-WP-0017
 type: workplan
 title: "Capability coverage campaign: seed or explicitly close all empty scaffolds"
 domain: infotech
 repo: reuse-surface
 status: active
 owner: claude-code
 topic_slug: helix-forge
 created: "2026-07-06"
 updated: "2026-07-06"
 state_hub_workstream_id: "a2d83504-fcd0-4561-8688-b77a01cb7f06"
 ---
 # Capability coverage campaign: seed or explicitly close all empty scaffolds
 The federation infrastructure is complete (61/61 repos established and
 hub-registered, WP-0014/0015), but **51 of 61 roster repos publish zero
 capabilities**. The federated index carries 24 capabilities, concentrated in a
 handful of custodian-core repos. A registry that answers most queries with
 "nothing found" trains agents to stop querying — content coverage is the
 prerequisite for the consumption loop (REUSE-WP-0018) and the automation loop
 (REUSE-WP-0019).
 **Goal:** every roster repo either publishes ≥1 capability entry or carries an
 explicit, machine-readable `no-reusable-capability` marker with a rationale.
 "Empty" becomes informative instead of ambiguous.
 **Baseline:** 10/61 repos with ≥1 capability; 51 empty scaffolds; 7 seed-ready
 (gap report 2026-07-06).
 **Target:** 0 ambiguous scaffolds; coverage ratio surfaced in `report gaps`
 and CI.
 ## Approach
 1. **Classify before drafting.** Sweep the 51 empty scaffolds and bucket each:
   `has-capability` (draft entries) vs `no-capability` (mark explicitly —
   experiments, forks, canon/docs-only repos, probes).
 2. **Draft with existing tooling.** `reuse-surface establish --discover` +
   llm-connect per repo produces first-pass entries at honest low maturity
   (typically D1–D2 / A0–A1); no invented evidence.
 3. **Human review gate.** Drafts land as branches/commits flagged for review;
   nothing publishes to the federated index without a human pass (same pattern
   as CUST-WP-0050 repo classification).
 4. **Publish + recompose.** After review: publish-check, hub state refresh,
   `federation compose`, catalog/graph regeneration.
 ## Dependencies
 | Dependency | Owner | Notes |
 |---|---|---|
 | llm-connect | llm-connect | drafting backend for `establish --discover` |
 | local-repo-roster.yaml | reuse-surface | 61-repo roster, sweep source of truth |
 | .repo-classification.yaml | the-custodian | classification signals for the no-capability bucket |
 | config-atlas publish fix | config-atlas | 303 publish blocker (T06) |
 | Sibling repo write access | Bernd | drafts commit into sibling checkouts at `~/<slug>/` |
 ## Design decisions
 - **`no-capability` marker format:** a `registry/NO_CAPABILITIES.md` file with
  frontmatter (`reason`, `reviewed`, `revisit`) in the sibling repo, plus a
  `capability_status: none` field in the roster row. `report gaps` treats
  marked repos as resolved, not empty.
 - **Honest maturity floor:** first-pass entries never claim above D2/A2/C2/R1
  without cited on-disk evidence (WP-0016 evidence gates apply).
 - **Batch execution:** repos are processed in cohorts of ~10 via
  `/ralph-workplan`; each cohort ends with validate + gap-report delta.
 ---
 ## Extend Gap Report And Roster For Explicit No-Capability Status
 ```task
 id: REUSE-WP-0017-T01
 status: done
 priority: high
 state_hub_task_id: "90fe5bf2-7c03-4af5-bc4a-e5d608c7e879"
 ```
 - Add `capability_status: has | none | pending` to roster schema and
  `local-repo-roster.yaml` handling (default `pending` for empty scaffolds)
 - `report gaps`: split "Empty scaffolds" into "Unclassified" and
  "Explicitly none (n)"; add a coverage ratio headline
  (`repos with capabilities or explicit none / total`)
 - Define `registry/NO_CAPABILITIES.md` template in `templates/`
 - Pytest coverage for both report paths
 ## Classification Sweep Of The 51 Empty Scaffolds
 ```task
 id: REUSE-WP-0017-T02
 status: done
 priority: high
 state_hub_task_id: "17ea8783-1344-4d04-8f7f-f93859ae4a20"
 ```
 - For each empty-scaffold repo: read INTENT/SCOPE/README + top-level layout,
  bucket `has-capability` vs `no-capability` with a one-line rationale
 - Output: `history/2026-07-06-coverage-classification.md` table (repo, bucket,
  rationale, candidate capability ids for the has bucket) — done, 37
  has-capability / 13 no-capability / 0 missing
 - Cross-check against `.repo-classification.yaml` where available
 - **Human review checkpoint:** Bernd confirms the bucket split before T03/T04
 ## Mark No-Capability Repos
 ```task
 id: REUSE-WP-0017-T03
 status: wait
 priority: medium
 state_hub_task_id: "3465cebf-84f9-4d67-8d8a-cca9771f2f06"
 ```
 For each confirmed `no-capability` repo:
 - Write `registry/NO_CAPABILITIES.md` from template into the sibling checkout — done, 13/13
 - Set `capability_status: none` in the roster — done
 - Commit in sibling repo with a uniform message referencing this workplan — done,
  13 commits made locally; **push held back pending explicit confirmation**
  (auto-mode declined to push to 13 sibling repos' default branches without it)
 ## Draft Capability Entries For Has-Capability Repos
 ```task
 id: REUSE-WP-0017-T04
 status: done
 priority: high
 state_hub_task_id: "20d67516-331b-46bd-8a90-1170139313c2"
 ```
 **Note:** `establish --discover` requires a running `llm-connect` backend,
 which isn't up on this workstation; spinning up a new inference service was
 out of scope for this task. Entries are instead drafted directly by the
 implementing agent, grounded in each repo's actual README/docs/tests (no
 invented evidence), which better matches the "no invented evidence" design
 principle anyway.
 **Cohort 1 (10/37 done):** artifact-store, can-you-assist, citation-engine,
 citation-evidence, email-connect, guide-board, hub-core, info-tech-canon,
 infospace-bench, inter-hub. All validate; no overlap with the existing 24
 federated capabilities. Committed locally in each sibling repo (push held
 for T05). Coverage 24/61 -> 34/61.
 **Cohort 2 (20/37 done):** issue-core (migrated its existing
 `CAPABILITY-issue-tracking.yaml` into the standard registry location rather
 than drafting fresh), kaizen-agentic, key-cape, kontextual-engine,
 llm-connect, markitect-filter, markitect-main (registered honestly as a
 superseded legacy platform pointing at its three successor repos, not a
 forward-looking target), markitect-quarkdown, markitect-tool, net-kingdom.
 All validate; no overlap with existing federated capabilities. Committed
 locally (push held for T05). Coverage 34/61 -> 44/61. Also fixed a stale
 `empty_scaffold_count >= 40` test threshold in `tests/test_reports.py` —
 no longer meaningful once the coverage campaign started shrinking that
 number by design.
 **Cohort 3 / final (17/17 done):** open-cmis-tck, open-reuse, ops-bridge,
 phase-memory, railiance-apps, railiance-cluster, railiance-enablement,
 railiance-fabric, railiance-forge, railiance-infra, railiance-platform,
 repo-scoping, the-custodian, user-engine, vantage-point, vergabe-teilnahme,
 whynot-design. All validate; no overlap with existing federated
 capabilities. Committed locally (push held for T05). Coverage 44/61 ->
 **61/61 — full coverage, T04 complete**.
 Notable calls in this cohort:
 - **the-custodian**: repo root is confidential/proprietary (NDA notice in
  its README). Entry is deliberately scoped only to the non-confidential
  `runtime/` agent framework and `tools/` repo-classification scripts;
  canon/memory content is explicitly excluded from the entry's `includes`
  and called out in `consumer_guidance.not_recommended_for`.
 - **vergabe-teilnahme**: its own `SCOPE.md` is an unfilled template, so
  discovery is honestly D1/C0 — flagged in `known_limitations` that filling
  in SCOPE.md is the natural next step before further promotion.
 - **markitect-main** (cohort 2) and **vantage-point**/**railiance-forge**
  patterns repeat here: several repos (open-reuse, vantage-point) have a
  stale repo-seed-template README; SCOPE.md/INTENT.md were used as the
  authoritative source instead, noted per-entry.
 - **railiance-enablement**, **railiance-apps**, **the-custodian**: each
  surfaced tooling directly relevant to REUSE-WP-0019 (Forgejo promotion
  script, forgejo-smoke.sh, patch-forgejo-remote-urls.sh) — worth cross-
  referencing when that workplan starts its host-migration inventory (T01).
 - `reuse-surface establish --discover` with llm-connect per repo
 - Manual tightening: id namespace (`capability.<domain>.<verb>`), scope
  boundary, honest vectors, relations to existing federated capabilities
 - `reuse-surface validate` + `overlaps` check per cohort (no duplicate
  semantics vs the existing 24)
 - Drafts committed in sibling repos, flagged for human review; roster
  `capability_status: has`
 ## Human Review And Publish Pass
 ```task
 id: REUSE-WP-0017-T05
 status: wait
 priority: high
 state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
 ```
 - Bernd reviews drafted entries per cohort (maturity honesty, scope, ids)
 - After approval: sibling repos push; `establish --publish-check` per repo;
  hub registrations refreshed where raw URLs changed
 - `reuse-surface federation compose` + catalog + graph regeneration in this repo
 ## Fix config-atlas Publish Blocker
 ```task
 id: REUSE-WP-0017-T06
 status: done
 priority: medium
 state_hub_task_id: "1a04b60a-b982-4b5f-ae20-955bc88d4204"
 ```
 **Diagnosis complete — two separate issues, conflated in the original note:**
 1. **The 303 itself was not actually a live blocker.** Gitea's raw-URL
   scheme is `/raw/main/<path>` -> 303 redirect -> `/raw/branch/main/<path>`
   -> 200. `establish.py`'s `_probe_raw_url` uses `urllib.request.urlopen`,
   which already follows redirects transparently (verified: HEAD request to
   the `/raw/main/...` URL resolves to 200 today). Re-running
   `establish --publish-check` for config-atlas now returns **PASS**. The
   roster's `publish_check: fail` was stale data from the 2026-06-16 sweep,
   not a reproducible current failure — corrected in the roster (publish
   pass now 61/61).
 2. **config-atlas was never actually registered with the production hub.**
   Diffing `https://reuse.coulomb.social/v1/federated` (60 sources) against
   the local roster (61 repos) shows config-atlas is the only mismatch —
   present in `sources.yaml` and locally claimed `hub_registered: true`
   (from the config-atlas registration commit), but genuinely absent from
   the hub. Corrected the roster's `hub_registered` to `false` for
   config-atlas (summary count 61 -> 60) to reflect reality.
 **Resolved 2026-07-07.** A routing catalog entry
 (`reuse-surface-hub-write-token`) appeared in
 `~/ops-warden/registry/routing/catalog.yaml` pointing at the token's actual
 home: a Kubernetes Secret (`reuse-surface-env` in namespace `reuse` on the
 Railiance01 cluster), not an OpenBao/Vault lane. Registration was completed
 through that channel (by a separate concurrent session, not this one — this
 session verified the *result*, not the credential itself, per the
 credential-routing rule against exploring live cluster secrets directly).
 config-atlas is now present among the 61 sources at
 `https://reuse.coulomb.social/v1/federated`. Roster corrected:
 `hub_registered: true`, publish_sweep 2026-07-07.
 - [x] Diagnose the 303 (resolved — not a current blocker, code already follows the redirect)
 - [x] Local publish-check target: 61/61 pass
 - [x] Complete hub registration for config-atlas — done 2026-07-07, 61/61 hub-registered
 ## Closeout: Coverage Metrics, Docs, SCOPE Update
 ```task
 id: REUSE-WP-0017-T07
 status: wait
 priority: low
 state_hub_task_id: "24ac37bf-2509-4077-9aa3-c09a599dd644"
 ```
 - `report gaps` shows 0 unclassified scaffolds; record final coverage ratio
 - Update `SCOPE.md` Current State (capability count, coverage), regenerate
  `docs/CapabilityCatalog.md`, graph, search catalog
 - `history/` milestone note; progress event + fix-consistency
 ---
 ## Acceptance
 - [ ] Every roster repo is `has` or `none` — zero `pending`
 - [ ] All `none` repos carry a reviewed `registry/NO_CAPABILITIES.md`
 - [ ] Federated index capability count reflects the seeded entries; 0 collision warnings
 - [ ] 61/61 publish pass (config-atlas unblocked)
 - [ ] Coverage ratio visible in `report gaps` and CI output
 - [ ] No entry claims maturity without on-disk evidence citations
 ## Out of scope
 - Consumption/plan-check tooling (REUSE-WP-0018)
 - Forgejo webhooks/automation (REUSE-WP-0019)
 - Maturity promotions beyond honest first-pass levels
 - Multi-domain federation (all entries remain `helix_forge`)
--- a/workplans/REUSE-WP-0018-plan-check-consumption-loop.md
+++ b/workplans/REUSE-WP-0018-plan-check-consumption-loop.md
@@ -0,0 +1,229 @@
 ---
 id: REUSE-WP-0018
 type: workplan
 title: "plan-check: close the consumption loop for capability reuse"
 domain: infotech
 repo: reuse-surface
 status: active
 owner: claude-code
 topic_slug: helix-forge
 created: "2026-07-06"
 updated: "2026-07-06"
 state_hub_workstream_id: "cd8683ff-6e6c-4f6c-a62f-565bd55113ea"
 ---
 # plan-check: close the consumption loop for capability reuse
 The registry is write-mostly: nothing nudges an agent planning work in a
 sibling repo to query the federated index before building. The State Hub has a
 `request_capability` / `list_capability_requests` flow, but it is not bridged
 to reuse-surface data. This workplan adds the **query-before-build** step to
 the ecosystem: a `plan-check` command that matches a draft workplan or intent
 text against federated capabilities, wired into every repo's session protocol,
 with a two-way bridge to State Hub capability requests.
 This is the highest-leverage coherence mechanism: it is what stops 61 repos
 from independently reinventing the same thing.
 **Depends on REUSE-WP-0017** for meaningful match rates — plan-check against a
 mostly-empty index produces noise and erodes trust. T01–T03 (design +
 implementation) can proceed in parallel with the coverage campaign; the
 ecosystem rollout (T05) waits for coverage.
 ## Proposed CLI surface
 ```bash
 # Match a draft workplan against the federated index
 reuse-surface plan-check workplans/XXX-WP-0042-something.md
 # Free-text intent
 reuse-surface plan-check --intent "parse invoices from email and file evidence"
 # Agent-consumable output
 reuse-surface plan-check --format json workplans/XXX-WP-0042.md
 # Record the outcome (feeds R-axis evidence, WP-0019)
 reuse-surface plan-check ... --record-outcome reused|extended|new
 ```
 **Verdict classes per match:** `reuse` (capability covers the need — link it),
 `extend` (close scope — extend instead of duplicating), `new` (no match —
 proceed, optionally file a capability request). Output includes capability id,
 maturity vector, owning repo, and consumer guidance.
 ## Design principles
 1. **Deterministic core, LLM assist optional** — keyword/scope/relation
   matching against index rows works without llm-connect; semantic matching
   via llm-connect improves recall when available (same optional-backend
   pattern as WP-0016).
 2. **Advisory, not blocking** — plan-check informs; it never vetoes a
   workplan. Adoption comes from usefulness plus protocol convention, not
   gates.
 3. **One line in the session protocol** — sibling integration is a single
   instruction in the shared `.claude/rules/` template: run plan-check before
   creating a workplan. No per-repo bespoke wiring.
 4. **Every check is a data point** — plan-check invocations and recorded
   outcomes are the raw material for reuse telemetry (WP-0019-T04).
 ## Dependencies
 | Dependency | Owner | Notes |
 |---|---|---|
 | REUSE-WP-0017 coverage | reuse-surface | rollout gate for T05 |
 | federated.yaml freshness | reuse-surface | improved by WP-0019 auto-recompose |
 | llm-connect | llm-connect | optional semantic matching backend |
 | State Hub capability-request API | state-hub | `request_capability`, `list_capability_requests` |
 | .claude/rules template propagation | the-custodian / repo-seed | mechanism for T05 rollout |
 ---
 ## Design Matching Semantics And Verdict Model
 ```task
 id: REUSE-WP-0018-T01
 status: done
 priority: high
 state_hub_task_id: "c7b3407a-2b9d-46ba-ae9c-7ab12235f0ba"
 ```
 Design doc `specs/PlanCheck.md`:
 - Input model: workplan file (frontmatter + body) vs free intent text
 - Match pipeline: token/keyword scoring over id, name, scope, guidance →
  relation expansion → optional llm-connect semantic rerank
 - Verdict thresholds and tie-breaking (maturity vector as rank signal:
  prefer higher D/A when scopes tie)
 - JSON output schema (`schemas/plan-check-result.schema.json`)
 - Outcome-recording format (append-only JSONL under `registry/telemetry/`,
  schema shared with WP-0019-T04)
 ## Implement Deterministic plan-check
 ```task
 id: REUSE-WP-0018-T02
 status: done
 priority: high
 state_hub_task_id: "24911d0e-41bc-4c8c-a39a-7dc8ec65d8c6"
 ```
 Implemented in `reuse_surface/plan_check.py` + `plan-check` CLI command:
 - Reuses `overlaps.py`'s `TOKEN_RE`/Jaccard approach rather than a second
  scoring method (per spec §4)
 - Reads `registry/indexes/federated.yaml`, falls back to the local index,
  warns when the composed index is >14 days stale
 - Markdown (TTY default) and `--format json` (validated against
  `schemas/plan-check-result.schema.json`)
 - 11 pytest cases: verdict thresholds, workplan-file parsing, intent-text
  parsing, tie-window vector ranking, staleness warning, CLI wiring
 - `--record-outcome` appends to `registry/telemetry/plan-check-events.jsonl`
  per the shared `schemas/reuse-event.schema.json` (WP-0019-T04 will post the
  same shape to the hub)
 ## Add llm-connect Semantic Rerank
 ```task
 id: REUSE-WP-0018-T03
 status: todo
 priority: medium
 state_hub_task_id: "9040505a-238e-4815-ae1a-8c5f8c12afa9"
 ```
 **Not started** — `llm-connect` is not running on this workstation
 (same gap noted in REUSE-WP-0017-T04's drafting cohorts). Deterministic
 `plan-check` (T02) is fully usable without it; this task adds the optional
 rerank on top when a backend is available.
 - Optional rerank/expansion stage via `LLM_CONNECT_URL` (reuse
  `llm_bridge.py`); schema-constrained JSON, graceful skip when unset
 - Confidence surfaced per match; deterministic matches always listed first
 - Pytest with mocked llm-connect (valid + malformed responses)
 ## Bridge State Hub Capability Requests
 ```task
 id: REUSE-WP-0018-T04
 status: done
 priority: medium
 state_hub_task_id: "8249dca7-18ca-4150-9671-ca87e6a5ad88"
 ```
 Implemented in `reuse_surface/statehub_bridge.py` against the live local
 State Hub HTTP API (`http://127.0.0.1:8000`, confirmed reachable):
 - **new → request:** `plan-check --file-request` files a State Hub
  capability request (`POST /capability-requests/`) on a `new` verdict
 - **request → gap:** `report gaps --check-capability-requests` lists open
  requests (`GET /capability-requests/`, filtered on `status` — a request
  can carry a `catalog_entry_id` while still `requested`/routed, so status
  is the correct open/closed signal, not `catalog_entry_id` presence).
  Opt-in flag so `report gaps` stays fast and offline-safe by default
 - Both degrade to `None`/graceful-skip when the hub is unreachable; neither
  ever blocks the primary command
 - List endpoint observed taking ~7s in production with only 5 rows; uses a
  20s timeout distinct from the 5s health-check timeout
 - 5 pytest cases with the hub client fully mocked (never hits the network
  in the default test run)
 - **Not done:** marking matched requests resolved with a pointer to the
  capability id — deferred, no current caller needs it yet
 ## Ecosystem Rollout: Session-Protocol Integration
 ```task
 id: REUSE-WP-0018-T05
 status: wait
 priority: high
 state_hub_task_id: "c232a669-b263-4978-a8b1-3721b8bfaa68"
 ```
 Blocked on WP-0017 coverage reaching the *published* federated index, not
 just local drafts. WP-0017-T04 has drafted entries for all 61 roster repos
 (coverage 61/61 locally), but those commits are still local-only in each
 sibling repo pending WP-0017-T05's human review and push — `federated.yaml`
 still only carries the original 24 entries. Re-check this gate once
 WP-0017-T05 pushes and recomposes.
 - Draft the one-line convention for the shared session-protocol/workplan
  rules: *"Before creating a workplan, run `reuse-surface plan-check` on the
  draft and record the verdict in the workplan frontmatter
  (`reuse_check: reuse|extend|new — <capability-id?>`)"*
 - Coordinate propagation with the-custodian rules template mechanism
  (fix-consistency / repo-seed) — send State Hub message to custodian agent
 - Add `reuse_check` frontmatter to this repo's workplan convention as the
  reference implementation
 ## Docs, CI, SCOPE
 ```task
 id: REUSE-WP-0018-T06
 status: done
 priority: low
 state_hub_task_id: "ff0a91eb-cc41-487b-b726-8c2f84860399"
 ```
 - `tools/README.md` command reference for `plan-check` and
  `report gaps --check-capability-requests`; `docs/RegistryFederation.md`
  "Query before building" consumer section; `SCOPE.md` "What Is Possible Now"
 - CI: informational `plan-check --intent "smoke test" --format json` run
  added to `.gitea/workflows/ci.yml`
 - `docs/IntentScopeGapAnalysis.md`: priority 29 added, marked **Partial**
  (T02/T04 shipped; T03/T05 remain open — not flipped fully to "shipped"
  since the ecosystem rollout hasn't happened yet)
 ---
 ## Acceptance
 - [x] `plan-check` returns reuse/extend/new verdicts for workplan files and intent text (without llm-connect — T03 rerank not built, not available on this workstation)
 - [x] JSON output validates against the published schema
 - [x] `new` verdicts can file State Hub capability requests; `report gaps` lists unmatched open requests
 - [ ] Session-protocol convention drafted and propagation agreed with the-custodian (blocked, see T05)
 - [ ] reuse-surface itself records `reuse_check` in new workplans (dogfood) — deferred to T05 rollout
 ## Out of scope
 - Blocking/gating workplan creation on plan-check results
 - Reuse telemetry aggregation and R-axis evidence (WP-0019)
 - Embedding-based matching (llm-connect rerank only)
 - Editing sibling repos' rules files directly (owned by template propagation)
--- a/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md
+++ b/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md
@@ -0,0 +1,186 @@
 ---
 id: REUSE-WP-0019
 type: workplan
 title: "Forgejo-native federation automation and reuse telemetry"
 domain: infotech
 repo: reuse-surface
 status: active
 owner: claude-code
 topic_slug: helix-forge
 created: "2026-07-06"
 updated: "2026-07-06"
 state_hub_workstream_id: "569be717-34f8-4039-bb26-497685f60159"
 ---
 # Forgejo-native federation automation and reuse telemetry
 Federation compose is on-demand and the hub serves whatever was last composed;
 roster sweeps are manual; reliability evidence is structural (CI exists) rather
 than observed (someone reused it and it worked). This workplan makes the
 registry **live** (event-driven recompose) and **evidence-backed** (reuse
 telemetry feeding the R axis).
 **Platform constraint:** the forge is transitioning **Gitea → Forgejo**. All
 new automation attaches to Forgejo (webhooks, Forgejo Actions, API tokens) —
 nothing new is built against Gitea. Existing raw URLs
 (`https://gitea.coulomb.social/...`) and `.gitea/workflows/` must migrate or
 be made host-agnostic. Forgejo is Gitea-API-compatible, so migration is mostly
 host/path configuration, but every hardcoded `gitea.` reference is a liability.
 **Depends on:** REUSE-WP-0017 (content worth refreshing), REUSE-WP-0018-T01
 telemetry schema (shared). Closes SCOPE "not possible yet" item *automatic hub
 refresh* and moves reliability evidence beyond structural.
 ## Design principles
 1. **Host-agnostic first** — a single `forge_base_url` configuration
   (env/config + hub setting) replaces hardcoded hosts; the Forgejo cutover
   becomes a one-line change per surface.
 2. **Webhook triggers, compose stays pull-based** — the webhook only marks the
   hub's composed index stale and triggers recompose from published raw URLs;
   no push-parsing of payloads into registry state.
 3. **Degrade to schedule** — if webhooks are unavailable, a scheduled Forgejo
   Actions job recomposes on an interval; freshness is monitored either way.
 4. **Telemetry is append-only and low-ceremony** — reuse events are JSONL
   facts (who consumed what, when, outcome); aggregation derives `reused_by`
   relations and R-axis evidence citations, never hand-edited.
 ## Dependencies
 | Dependency | Owner | Notes |
 |---|---|---|
 | Forgejo instance + admin | Bernd / infra | webhook config, org-level token, Actions runners |
 | Gitea→Forgejo cutover plan | infra | final hostname, raw URL scheme, redirect window |
 | Hub deployment (reuse.coulomb.social) | reuse-surface / railiance | new endpoint + config rollout |
 | REUSE-WP-0018-T01 | reuse-surface | shared telemetry/outcome schema |
 | plan-check adoption | ecosystem | telemetry volume comes from WP-0018-T05 rollout |
 ---
 ## Forge Host Abstraction And URL Migration Inventory
 ```task
 id: REUSE-WP-0019-T01
 status: todo
 priority: high
 state_hub_task_id: "4a187b56-bff9-4097-abd0-b423e7bf9442"
 ```
 - Inventory every hardcoded `gitea.coulomb.social` / `.gitea/` reference:
  `sources.yaml` (60 raw URLs), hub registrations, establish/publish-check
  defaults, docs, templates, CI workflows
 - Introduce `REUSE_SURFACE_FORGE_BASE_URL` (env + hub config); derive raw
  index URLs from `{base}/{org}/{repo}/raw/{branch}/registry/indexes/capabilities.yaml`
 - Migration command: `reuse-surface federation migrate-host --from <old> --to <new>`
  rewriting sources.yaml + hub registrations via the hub API
 - Check whether the config-atlas 303 (WP-0017-T06) is a symptom of the host
  transition; coordinate findings
 - Tests: URL derivation, migrate-host dry-run
 ## Hub Recompose Endpoint And Webhook Receiver
 ```task
 id: REUSE-WP-0019-T02
 status: todo
 priority: high
 state_hub_task_id: "691eb32a-6f20-4a2a-b9ff-0ae427b659aa"
 ```
 - Hub service (`reuse_surface/serve`): `POST /v1/recompose` (token-auth) —
  marks index stale and triggers recompose from registered raw URLs
 - `POST /v1/webhooks/forgejo`: validates Forgejo webhook signature
  (`X-Forgejo-Signature`, secret from env), accepts push events, triggers
  recompose only when the pushed commits touch `registry/indexes/`
 - Debounce/coalesce concurrent triggers; `GET /v1/federated` gains
  `composed_at` + `stale` fields
 - Extend `specs/FederationHubAPI.md`; pytest with signed fixture payloads
 ## Forgejo Webhook Rollout And Scheduled Fallback
 ```task
 id: REUSE-WP-0019-T03
 status: wait
 priority: medium
 state_hub_task_id: "aa9e9f80-b878-490c-832e-515d8cbbbb60"
 ```
 Blocked on T02 deploy and Forgejo instance availability.
 - Org-level Forgejo webhook (single config, all repos) → hub
  `/v1/webhooks/forgejo`, push events only
 - Fallback: Forgejo Actions scheduled workflow (cron) in this repo calling
  `POST /v1/recompose`; also serves repos during any Gitea-remnant window
 - Migrate this repo's CI `.gitea/workflows/ci.yml` → `.forgejo/workflows/ci.yml`
  (Forgejo Actions; verify runner labels); document the pattern for siblings
 - Verify end-to-end: index change in a sibling repo → hub `composed_at`
  advances without manual compose
 ## Reuse Telemetry Store And Recording
 ```task
 id: REUSE-WP-0019-T04
 status: todo
 priority: medium
 state_hub_task_id: "c8e9064e-5c39-4c84-80e9-8b255f8edaec"
 ```
 - Implement the shared schema from WP-0018-T01: reuse events
  `{ts, consumer_repo, capability_id, verdict, outcome?, source: plan-check|manual|hub}`
 - Hub: `POST /v1/reuse-events` (token-auth) + local JSONL fallback when hub
  unreachable; `GET /v1/reuse-events?capability_id=` for aggregation
 - `plan-check --record-outcome` (WP-0018) posts here; manual
  `reuse-surface record-reuse` for retroactive facts
 - Privacy/scope: repo slugs and capability ids only — no code, no secrets
 ## Telemetry Aggregation Into R-Axis Evidence
 ```task
 id: REUSE-WP-0019-T05
 status: wait
 priority: medium
 state_hub_task_id: "f0282cfa-0a71-4b46-a558-80b51ef04fa7"
 ```
 Blocked on T04 plus initial event volume.
 - `reuse-surface report reuse`: per-capability consumer counts, outcomes,
  last-used; feeds `reused_by` relation suggestions via the WP-0016
  maintain/patch pipeline (evidence-gated, never silent promotion)
 - Maturity standard note: what observed-reuse evidence counts toward R2/R3+
  (`specs/CapabilityMaturityStandard.md` amendment)
 - Catalog + graph surface consumer counts
 ## Freshness Monitoring, Docs, SCOPE
 ```task
 id: REUSE-WP-0019-T06
 status: todo
 priority: low
 state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b"
 ```
 - `reuse-surface stats`: hub `composed_at` age + stale flag; CI informational
  check warns when the hub index is older than N days
 - `docs/RegistryFederation.md` + `docs/deploy/reuse-kubernetes.md`: webhook
  setup, recompose endpoint, Forgejo token handling (route credentials per
  credential-routing rules — no secrets in repo)
 - `SCOPE.md`: flip "automatic hub refresh" to possible; update federation
  posture
 ---
 ## Acceptance
 - [ ] No hardcoded forge host in code or sources.yaml; `migrate-host` tested
 - [ ] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place
 - [ ] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`)
 - [ ] Reuse events recordable via hub API and CLI; `report reuse` aggregates them
 - [ ] R-axis evidence rules for observed reuse documented in the maturity standard
 - [ ] Hub freshness visible (`composed_at`, stale flag) in API and stats
 ## Out of scope
 - Operating the Forgejo instance or the Gitea→Forgejo data migration itself
 - Multi-replica/Postgres hub posture (separate managed-platform track)
 - Blocking CI gates on registry freshness in sibling repos
 - ActivityPub/Forgejo-native federation features (our federation layer stays raw-URL based)
Author	SHA1	Message	Date
custodian-sync	cf3b8f93db	chore(consistency): sync task status from DB [auto] Some checks are pending ci / validate-registry (push) Waiting to run Details Updated by fix-consistency on 2026-07-07: - update .custodian-brief.md for reuse-surface	2026-07-07 01:16:20 +02:00
tegwick	533b4f0831	REUSE-WP-0017-T06: config-atlas hub registration completed Some checks failed ci / validate-registry (push) Has been cancelled Details Resolved via the reuse-surface-hub-write-token routing catalog entry that appeared in ops-warden (points at a Kubernetes Secret on Railiance01, not OpenBao). config-atlas is now among the 61 sources at reuse.coulomb.social/v1/federated. hub_registered corrected to true; 61/61 hub-registered, 61/61 publish pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 01:14:41 +02:00
tegwick	e1ca9bbbc5	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-07: - update .custodian-brief.md for reuse-surface	2026-07-07 00:58:27 +02:00
tegwick	e72966a658	REUSE-WP-0018 T01/T02/T04/T06: plan-check deterministic matching + State Hub bridge Some checks failed ci / validate-registry (push) Has been cancelled Details T01: specs/PlanCheck.md design doc, plan-check-result.schema.json and reuse-event.schema.json (the latter shared with WP-0019's reuse telemetry). T02: reuse_surface/plan_check.py + 'reuse-surface plan-check' CLI command. Deterministic token-Jaccard matching against registry/indexes/federated.yaml (reuses overlaps.py's TOKEN_RE rather than a second scoring method), with reuse/extend/new verdicts, markdown and --format json output, staleness warning, and --record-outcome JSONL telemetry. T04: reuse_surface/statehub_bridge.py bridges plan-check 'new' verdicts to State Hub capability requests (--file-request) and surfaces open requests with no matching capability (report gaps --check-capability-requests, opt-in to stay offline-safe). Verified against the live local State Hub API; status field (not catalog_entry_id presence) is the correct open/closed signal, and the list endpoint needs a longer timeout than the health check (~7s observed with 5 rows). T06: docs (tools/README.md, RegistryFederation.md, SCOPE.md, IntentScopeGapAnalysis.md priority 29) and an informational CI smoke step. T03 (LLM rerank) not started -- llm-connect isn't running on this workstation. T05 (ecosystem rollout) remains blocked: WP-0017 has drafted entries for all 61 repos but they're still local-only pending its own T05 push/publish pass, so the federated index isn't yet worth rolling out plan-check as ecosystem convention. 16 new tests, all mocked -- no network calls in the default test run. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 00:57:18 +02:00
tegwick	2a6818d4fe	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 20:18:12 +02:00
tegwick	e046562b56	REUSE-WP-0017-T06: diagnose config-atlas publish blocker Some checks failed ci / validate-registry (push) Has been cancelled Details Two conflated issues: (1) the raw-URL 303 redirect is already followed correctly by establish.py's urllib-based probe -- re-running publish-check now passes; the stale roster fail was from the 2026-06-16 sweep, not a live issue. (2) config-atlas was never actually registered with the production hub (absent from the 60 sources at reuse.coulomb.social/v1/federated despite hub_registered: true in the roster) -- corrected to false. Local publish pass is now 61/61; hub registration itself is blocked on REUSE_SURFACE_TOKEN, which has no routing catalog entry -- needs Bernd to provide or route it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 20:16:59 +02:00
tegwick	8fc975717f	REUSE-WP-0017: T05 review summary + fix stale seed_capability_ids Some checks failed ci / validate-registry (push) Has been cancelled Details Prepared history/2026-07-06-t04-review-summary.md for the T05 human review pass: full table of all 48 capability entries and 13 no-capability markers generated from the actual committed files, plus flagged items (the-custodian confidentiality scoping, vergabe-teilnahme low D1/C0, markitect-main superseded framing, Forgejo-relevant tooling found along the way). Also fixed two pre-existing roster rows with stale empty seed_capability_ids despite having real published entries: activity-core and ops-warden. Not new drafts -- a bookkeeping gap predating this workplan. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 20:02:06 +02:00
tegwick	8726cb8c86	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 19:53:27 +02:00
tegwick	89b8b34471	REUSE-WP-0017-T04 cohort 3 (final): draft entries for remaining 17 repos Some checks failed ci / validate-registry (push) Has been cancelled Details open-cmis-tck, open-reuse, ops-bridge, phase-memory, railiance-apps, railiance-cluster, railiance-enablement, railiance-fabric, railiance-forge, railiance-infra, railiance-platform, repo-scoping, the-custodian, user-engine, vantage-point, vergabe-teilnahme, whynot-design. the-custodian entry deliberately scoped to its non-confidential runtime/tools/ surface only, given the repo's NDA notice. vergabe-teilnahme honestly registered at D1/C0 given its own unfilled SCOPE.md. T04 complete: coverage 44/61 -> 61/61 (48 has-capability, 13 explicit no-capability, 0 unclassified). All 50 sibling-repo commits across three cohorts remain local only, pending T05 human review and push. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:52:19 +02:00
tegwick	651b84a16b	REUSE-WP-0017-T04 cohort 2: draft entries for 10 more has-capability repos Some checks failed ci / validate-registry (push) Has been cancelled Details issue-core (migrated existing CAPABILITY-issue-tracking.yaml), kaizen-agentic, key-cape, kontextual-engine, llm-connect, markitect-filter, markitect-main (registered as superseded legacy platform), markitect-quarkdown, markitect-tool, net-kingdom. All validate, no overlap with existing federated capabilities. Committed locally in each sibling repo; push held for T05 human review. Coverage 34/61 -> 44/61. Also fixed a stale empty_scaffold_count >= 40 test threshold -- no longer meaningful as the coverage campaign shrinks that number by design. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:44:02 +02:00
tegwick	b48a4edf81	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 19:06:59 +02:00
tegwick	8429eea576	chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-06: - REUSE-WP-0017-T04: progress → wait	2026-07-06 19:06:55 +02:00
tegwick	6688830bf8	chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-06: - REUSE-WP-0017-T03: progress → wait	2026-07-06 19:06:55 +02:00
tegwick	d3ae49fdf3	REUSE-WP-0017-T04 cohort 1: draft entries for 10 has-capability repos Some checks failed ci / validate-registry (push) Has been cancelled Details artifact-store, can-you-assist, citation-engine, citation-evidence, email-connect, guide-board, hub-core, info-tech-canon, infospace-bench, inter-hub. Drafted directly (llm-connect not running locally; this matches the workplan's no-invented-evidence principle better anyway). All validate, no overlap with existing 24 federated capabilities. Committed locally in each sibling repo; push held for T05 human review. Coverage 24/61 -> 34/61. 27 has-capability repos remain for later cohorts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:06:11 +02:00
tegwick	be1dd56d76	REUSE-WP-0017-T03: mark 13 confirmed no-capability repos, fix repo-seed stale count Some checks failed ci / validate-registry (push) Has been cancelled Details Roster capability_status now has:11 / none:13 / pending:37. Coverage 24/61. NO_CAPABILITIES.md committed locally in all 13 sibling repos (push held pending confirmation — touches 13 external default branches). repo-seed's capability_count was stale (0, should be 1); corrected. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:51:54 +02:00
tegwick	f4a5cefa4b	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 18:42:03 +02:00
tegwick	e87a07014c	chore(consistency): renormalize lifecycle state [auto] Updated by fix-consistency on 2026-07-06: - workplan status: ready → active	2026-07-06 18:41:53 +02:00
tegwick	a6ed45bb22	chore(consistency): renormalize lifecycle state [auto] Updated by fix-consistency on 2026-07-06: - workplan status: ready → active	2026-07-06 18:41:52 +02:00
tegwick	f383f01dac	REUSE-WP-0017-T02: classification sweep of 51 empty scaffolds Some checks failed ci / validate-registry (push) Has been cancelled Details 37 has-capability / 13 no-capability / 0 missing. Awaiting review before T03 (no-capability markers) and T04 (draft entries) proceed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:40:58 +02:00
tegwick	8219a5d253	REUSE-WP-0017-T01: explicit capability_status on roster + coverage split in report gaps Some checks failed ci / validate-registry (push) Has been cancelled Details Adds capability_status: has\|none\|pending to every roster row (10 has / 51 pending currently), a coverage_ratio headline, and splits the gap report's empty-scaffold section into unclassified vs explicitly-none. Adds templates/NO_CAPABILITIES.template.md for the no-capability marker. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:36:05 +02:00
tegwick	493f23123c	Move WP-0017, WP-0018, WP-0019 to ready Some checks failed ci / validate-registry (push) Has been cancelled Details Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:31:39 +02:00
tegwick	64b57e69f0	Write back State Hub workstream/task IDs for WP-0017..0019 Some checks failed ci / validate-registry (push) Has been cancelled Details Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 18:18:46 +02:00
tegwick	365db676cf	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 18:18:26 +02:00
tegwick	e37fc60ecf	Add workplans WP-0017..0019: coverage campaign, plan-check loop, Forgejo automation + telemetry Some checks failed ci / validate-registry (push) Has been cancelled Details Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 18:17:32 +02:00
tegwick	08f3bb5110	feat(federation): register config-atlas and reserve surface.* namespace Some checks failed ci / validate-registry (push) Has been cancelled Details Add config-atlas as a federation source (capability index) and to the local repo roster. Document surface.* as a distinct id namespace owned by config-atlas (typed sibling of capability.*, not federated here) under a new "Id namespace ownership" section. Raw URL currently 303 (required:false), same publish block as state-hub/feature-control. Recompose federated.yaml. Supports config-atlas ATLAS-WP-0002-T05. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 23:48:20 +02:00
tegwick	368fb156d4	Normalize agent instructions and workplan frontmatter (STATE-WP-0067) Some checks failed ci / validate-registry (push) Has been cancelled Details - Align agent files with on-disk workplan prefixes (infer from workplan ids) - Set workplan domain to registered domain_slug; add topic_slug where applicable - Repair frontmatter delimiter formatting; migrate legacy task status literals - Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates	2026-06-22 23:16:28 +02:00
tegwick	fe05d60a66	Human-review .repo-classification.yaml (CUST-WP-0050 follow-up) Some checks failed ci / validate-registry (push) Has been cancelled Details	2026-06-22 17:56:16 +02:00
tegwick	fd078c598c	Add .repo-classification.yaml (CUST-WP-0050 T11 agent first-pass)	2026-06-22 17:47:43 +02:00