Document inter-hub retirement and maturity reassessment

inter-hub is retired (Haskell/IHP build-chain problems), superseded by core-hub (Python/FastAPI/Postgres). Its capability entry was updated directly in ~/inter-hub (commit cffdf9e): D3/A1/C1/R0 -> D5/A1/C3/R0, status: deprecated, relations.related_to -> capability.infotech.core-hub. core-hub itself is not yet added to reuse-surface's roster/federation sources -- it postdates the WP-0017 coverage sweep; noted as a follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
chore(consistency): sync task status from DB [auto]
2026-07-07 01:45:00 +02:00 · 2026-07-07 01:16:20 +02:00 · 2026-07-07 01:14:41 +02:00 · 2026-07-07 00:58:27 +02:00 · 2026-07-07 00:57:18 +02:00 · 2026-07-06 20:18:12 +02:00
40 changed files with 2598 additions and 287 deletions
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -1,18 +1,42 @@
 <!-- custodian-brief: generated by fix-consistency — do not edit manually -->
 # Custodian Brief — reuse-surface

-**Domain:** helix_forge  
-**Last synced:** 2026-06-16 19:38 UTC  
+**Domain:** infotech  
+**Last synced:** 2026-07-06 23:16 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*

 ## Active Workstreams

-*(none — repo may need first-session setup)*
+### Capability coverage campaign: seed or explicitly close all empty scaffolds
+Progress: 4/7 done  |  workstream_id: `a2d83504-fcd0-4561-8688-b77a01cb7f06`
+
+**Open tasks:**
+- ! Mark No-Capability Repos  `3465cebf`
+- ! Human Review And Publish Pass  `56b68b6f`
+- ! Closeout: Coverage Metrics, Docs, SCOPE Update  `24ac37bf`
+
+### plan-check: close the consumption loop for capability reuse
+Progress: 4/6 done  |  workstream_id: `cd8683ff-6e6c-4f6c-a62f-565bd55113ea`
+
+**Open tasks:**
+- ! Ecosystem Rollout: Session-Protocol Integration  `c232a669`
+- · Add llm-connect Semantic Rerank  `9040505a`
+
+### Forgejo-native federation automation and reuse telemetry
+Progress: 0/6 done  |  workstream_id: `569be717-34f8-4039-bb26-497685f60159`
+
+**Open tasks:**
+- ! Forgejo Webhook Rollout And Scheduled Fallback  `aa9e9f80`
+- ! Telemetry Aggregation Into R-Axis Evidence  `f0282cfa`
+- · Forge Host Abstraction And URL Migration Inventory  `4a187b56`
+- · Hub Recompose Endpoint And Webhook Receiver  `691eb32a`
+- · Reuse Telemetry Store And Recording  `c8e9064e`
+- · Freshness Monitoring, Docs, SCOPE  `a9f44d45`

 ---
 ## MCP Orientation (when available)

 If the state-hub MCP server is reachable, call:
-`get_domain_summary("helix_forge")`
+`get_domain_summary("infotech")`
 This provides richer cross-domain context.
 If the MCP call fails, use this file as your orientation source.
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -49,5 +49,8 @@ jobs:
      - name: Registry gap report (informational)
        run: reuse-surface report gaps || true

+      - name: Plan-check smoke test (informational)
+        run: reuse-surface plan-check --intent "smoke test" --format json || true
+
      - name: Run tests
        run: pytest -q
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4,7 +4,7 @@

 **Purpose:** Capability registry for planning and implementation reuse based on discovery and delivery maturity.

-**Domain:** helix_forge
+**Domain:** infotech
 **Repo slug:** reuse-surface
 **Topic ID:** `f39fa2a3-c491-414c-a91b-b4c5fcc6139c`
 **Workplan prefix:** `REUSE-WP-`
@@ -101,159 +101,6 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \

 ---

-## Local Developer Workflow
-
-The repository is primarily documentation-first with a small Python CLI for
-registry validate, query, and export. There is no long-running service.
-
-### Install
-
-```bash
-python3 -m venv .venv
-.venv/bin/pip install -e .
-```
-
-### Build
-
-No separate build step. Treat Markdown, YAML, and workplan edits as source
-artifacts.
-
-### Test / lint
-
-```bash
-# Registry validation (schema + index drift)
-.venv/bin/reuse-surface validate
-
-# Overlap, catalog, federation, and graph
-.venv/bin/reuse-surface overlaps
-.venv/bin/reuse-surface catalog
-.venv/bin/reuse-surface federation compose
-.venv/bin/reuse-surface graph --check
-
-# Federation service (local)
-# REUSE_SURFACE_TOKEN=dev-token reuse-surface serve
-
-# Hub CLI (against deployed or local service)
-# REUSE_SURFACE_URL=http://127.0.0.1:8000 reuse-surface hub status
-
-# Automated tests
-.venv/bin/pytest -q
-
-# Repository hygiene
-rg --files
-git diff --check
-```
-
-When workplan files change, sync ADR-001 file state into State Hub:
-
-```bash
-curl -s -X POST "http://127.0.0.1:8000/repos/reuse-surface/sync?fix=true" \
-  | python3 -m json.tool
-```
-
-If the HTTP sync endpoint is unavailable, run the consistency script from the
-State Hub checkout:
-
-```bash
-cd ~/state-hub
-.venv/bin/python scripts/consistency_check.py --repo reuse-surface --fix
-.venv/bin/python scripts/consistency_check.py --repo reuse-surface
-```
-
-The generated instruction in older workplans says `make fix-consistency
-REPO=reuse-surface`; that is still valid when `uv` is installed and on PATH.
-On this workstation, the `.venv/bin/python` fallback has been verified.
-
-CI runs `reuse-surface validate` on push and pull requests via
-`.gitea/workflows/ci.yml`.
-
-### Run
-
-There is no local service to run from this repository.
-
-### Documentation Review Checklist
-
- Keep `INTENT.md`, `SCOPE.md`, and `specs/` aligned on the registry-first
-  reuse boundary.
- Keep maturity definitions in `specs/CapabilityMaturityStandard.md` consistent
-  with `INTENT.md` and `specs/ProductRequirementsDocument.md`.
- Keep registry entries, indexes, and schemas in `registry/`, `schemas/`, and
-  `templates/` current when capabilities change.
- Record implementation ideas in workplans, not as premature runtime code in
-  this repository.
-
---
-
-## Capability Registry
-
-Before building or documenting a new reusable behavior, query the registry to
-avoid duplication and to select the best existing capability for planning or
-implementation reuse.
-
-### Orient
-
-```bash
-# Fast discovery surface — read federated index when multi-repo
-cat registry/indexes/federated.yaml
-cat registry/indexes/capabilities.yaml
-
-# CLI discovery and export
-.venv/bin/reuse-surface query --discovery-min D4
-.venv/bin/reuse-surface export --format yaml
-
-# Authoring template and schema
-cat templates/capability-entry.template.md
-cat schemas/capability.schema.yaml
-
-# Validation and search guidance
-cat registry/README.md
-cat tools/README.md
-```
-
-### Query workflow
-
-1. Run `.venv/bin/reuse-surface query` with filters, or read the index directly.
-2. Filter by `vector`, `tags`, `consumption_modes`, `domain`, or `summary`.
-3. Open only matching files under `registry/capabilities/`.
-4. Compare candidates using `discovery`, `external_evidence`, `availability`,
-   and `relations` from the entry front matter.
-5. Prefer planning reuse when discovery is strong (`D3+`, especially `D5+`).
-6. Prefer implementation reuse only when availability is consumable (`A2+` code,
-   `A3+` CLI, `A4+` API/SDK).
-
-### Add a new capability
-
-1. Search the index for overlap (UC-RS-015) before creating a new entry.
-2. Copy `templates/capability-entry.template.md` to
-   `registry/capabilities/capability.<domain>.<name>.md`.
-3. Start at `D0 / A0 / C0 / R0` when evidence is minimal; keep gaps explicit.
-4. Add the entry to `registry/indexes/capabilities.yaml`.
-5. Run `.venv/bin/reuse-surface validate`.
-
-### Promote a capability
-
-1. Attach evidence required by `specs/CapabilityMaturityStandard.md` for the
-   target level.
-2. Update `maturity` for discovery/availability and `external_evidence` for
-   completeness/reliability separately.
-3. Refresh the index `vector` and record rationale in the entry body.
-4. Do not treat higher availability as proof of reliability or completeness.
-
-### MVP acceptance mapping
-
-| Acceptance criterion | Registry surface |
-|---|---|
-| Add D0/A0/C0/R0 with minimal friction | template + index + registry README |
-| Promote through discovery levels | entry front matter + maturity standard |
-| Identify current consumption mode | `availability` + index `consumption_modes` |
-| Record expectations and broken expectations | `external_evidence.completeness` |
-| Record reliability evidence | `external_evidence.reliability` |
-| Search by maturity and availability | `reuse-surface query` or index filters |
-| Compare candidates | entry vectors + relations + README guidance |
-| Avoid duplicate capabilities | index search before add |
-
---
-
 ## Credential and access routing

 **Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
@@ -304,6 +151,11 @@ every repo's agent instructions because it is high-frequency, high-risk, and eas
 get wrong.

 **Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
+
+<!-- REPO-AGENTS-EXTENSIONS -->
+<!-- Append repo-specific agent instructions below this marker.
+     The state-hub template sync preserves content after this line. -->
+
 ---

 ## Workplan Convention (ADR-001)
@@ -329,7 +181,7 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
 id: REUSE-WP-NNNN
 type: workplan
 title: "..."
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: proposed | ready | active | blocked | backlog | finished | archived
 owner: codex
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,17 +1,12 @@
-{
-  "agents": {
-    "coach": {
-      "path": "agents/agent-coach.md",
-      "enabled": true
-    },
-    "optimization": {
-      "path": "agents/agent-optimization.md",
-      "enabled": true
-    },
-    "scope-analyst": {
-      "path": "agents/agent-scope-analyst.md",
-      "enabled": true
-    }
-  }
-}
+# reuse-surface — Claude Code Instructions
+
+@SCOPE.md
+@.claude/rules/repo-identity.md
+@.claude/rules/session-protocol.md
+@.claude/rules/first-session.md
+@.claude/rules/workplan-convention.md
+@.claude/rules/stack-and-commands.md
+@.claude/rules/architecture.md
+@.claude/rules/repo-boundary.md
@.claude/rules/credential-routing.md
+@.claude/rules/agents.md
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -75,6 +75,11 @@ The MVP registry foundation, CLI tooling (REUSE-WP-0003), federation stack
 - **Explore relations interactively** at `docs/graph/index.html`
 - **Avoid duplicates** by querying the index and checking overlaps before adding
  entries
+- **Check before building** with `reuse-surface plan-check` (REUSE-WP-0018) —
+  match a draft workplan or free-text intent against the federated index and
+  get a reuse/extend/new verdict; `--file-request` bridges a `new` verdict to
+  a State Hub capability request; `report gaps --check-capability-requests`
+  surfaces open requests with no matching capability

 Registry **tooling** availability is **A4** (CLI plus hosted hub HTTP API).
 Registry **authoring** remains Markdown-first; consumption combines entries, the
--- a/docs/IntentScopeGapAnalysis.md
+++ b/docs/IntentScopeGapAnalysis.md
@@ -202,9 +202,11 @@ See §4 and archived workplans `workplans/archived/`.
 | 26 | Federated ID deduplication | Per-owner removal from reuse-surface index | **Closed** (WP-0015-T02) |
 | 27 | Planning analytics + standardization | Gap report or standardization tracker | **Partial** — gap report shipped (T03); tracker deferred |
 | 28 | Registry maintenance automation | Interactive `maintain` + `--auto` with llm-connect | **Closed** (WP-0016) |
+| 29 | Consumption loop (query-before-build) | `plan-check` command + State Hub capability-request bridge | **Partial** — deterministic matching (T02) and the request bridge (T04) shipped; LLM semantic rerank (T03) and ecosystem session-protocol rollout (T05) remain open, T05 gated on REUSE-WP-0017 coverage reaching the *published* federated index, not just local drafts |

 **Workplan:** `workplans/REUSE-WP-0016-interactive-registry-maintain.md` (priority 28);
-`workplans/REUSE-WP-0015-federation-polish-and-planning-analytics.md` (25–27)  
+`workplans/REUSE-WP-0015-federation-polish-and-planning-analytics.md` (25–27);
+`workplans/REUSE-WP-0018-plan-check-consumption-loop.md` (priority 29)  
 **Assessment:** `history/2026-06-16-intent-scope-assessment.md`

 **Follow-up docs:**
@@ -235,4 +237,5 @@ See §4 and archived workplans `workplans/archived/`.
 | 2026-06-16 | WP-0014 closed priority 18; 60 workstation repos |
 | 2026-06-16 | **SCOPE refresh + full INTENT success-criteria mapping**; priorities 25–27 proposed |
 | 2026-06-16 | Assessment persisted; **REUSE-WP-0015** created for priorities 25–27 |
-| 2026-06-16 | **REUSE-WP-0016** closed priority 28 (interactive `maintain`, `--auto`, templates) |
+| 2026-06-16 | **REUSE-WP-0016** closed priority 28 (interactive `maintain`, `--auto`, templates) |
+| 2026-07-07 | **REUSE-WP-0018** partially closed priority 29 (`plan-check` deterministic matching + State Hub capability-request bridge; LLM rerank and ecosystem rollout remain open) |
--- a/docs/RegistryFederation.md
+++ b/docs/RegistryFederation.md
@@ -159,9 +159,9 @@ Copy `templates/Makefile.registry.fragment` for `make registry-maintain` /
 5. Optionally `reuse-surface hub sync --merge` to refresh local `sources.yaml`.

 **Current blocks (2026-06-16):** `state-hub`, `feature-control`,
-`identity-canon`, and `shard-wiki` raw URLs return **303** (not published).
-See `history/2026-06-16-hub-registration-blocks.md` for probe evidence and owner
-follow-ups.
+`identity-canon`, `shard-wiki`, and `config-atlas` raw URLs return **303** (not
+published). See `history/2026-06-16-hub-registration-blocks.md` for probe evidence
+and owner follow-ups.

 ## Compose workflow

@@ -191,6 +191,19 @@ remote sources without cache fail compose with a clear error.
 `warn` (default): duplicate IDs across sources are kept but reported as
 warnings. Consumers must inspect `source_repo` before choosing an entry.

+### Id namespace ownership
+
+Federation aggregates `capability.*` ids. A few repos own **distinct id families**
+that are *not* capability indexes and therefore never collide with `capability.*`:
+
+| Namespace | Owner repo | Index (not federated here) |
+|---|---|---|
+| `surface.*` (configuration surfaces) | `config-atlas` | `registry/indexes/surfaces.yaml` |
+
+config-atlas federates only its `capabilities.yaml` (the atlas capability itself);
+its `surface.*` registry is a typed sibling. The `surface.*` namespace is reserved
+for config-atlas so the two id families stay orthogonal under `collision_policy`.
+
 ### Owner migration and deduplication

 After REUSE-WP-0014, many capabilities remain in both `reuse-surface` and their
@@ -284,6 +297,23 @@ Register published raw index URLs on the hub, or enable a `url` source in
 endpoint requires a token. Agents without sibling repo clones can discover
 capabilities from the hub or from HTTP sources plus the local index.

+### Query before building (`plan-check`)
+
+Before drafting a new workplan, run `reuse-surface plan-check` (REUSE-WP-0018)
+against a draft workplan file or a free-text intent. It matches your intent
+against `registry/indexes/federated.yaml` and returns a `reuse | extend | new`
+verdict — advisory only, never a gate:
+
+```bash
+reuse-surface plan-check workplans/XXX-WP-NNNN-something.md
+reuse-surface plan-check --intent "parse invoices and file evidence"
+```
+
+On a `new` verdict, `--file-request` bridges the gap to a State Hub
+capability request so other domains can see the unmet need; `report gaps
+--check-capability-requests` surfaces open requests with no matching
+federated capability. See `specs/PlanCheck.md` for the full design.
+
 ## Relation graphs

 ```bash
--- a/history/2026-07-06-coverage-classification.md
+++ b/history/2026-07-06-coverage-classification.md
@@ -0,0 +1,106 @@
+# Coverage classification sweep (REUSE-WP-0017-T02)
+
+Classification of the 51 empty-scaffold repos identified in the 2026-07-06
+gap report, bucketed into `has-capability` (candidate for a drafted registry
+entry) vs `no-capability` (candidate for an explicit
+`registry/NO_CAPABILITIES.md` marker). Produced by an Explore-agent survey of
+each repo's INTENT/SCOPE/README and top-level layout; rationale is grounded
+in what was actually read, not guessed.
+
+**Status: confirmed by Bernd 2026-07-06.** Proceeding to T03/T04 with the two
+data-quality adjustments noted below applied.
+
+**Summary:** 37 has-capability, 13 no-capability, 0 missing (all 51
+directories exist and are valid git repos).
+
+| Repo | Bucket | Rationale | Candidate capability id |
+|---|---|---|---|
+| agentic-resources | no-capability | INTENT/SCOPE are aspirational HR-for-agents vision prose; no src/, no package manifest, only docs/registry/workplans | |
+| artifact-store | has-capability | Real Python service (67 files, pyproject, migrations, schemas) implementing a generic artifact registry/storage gateway with provenance & retention | `capability.artifact.store` |
+| can-you-assist | has-capability | Real `cya` CLI package (45 files, pyproject) — console-native LLM assistant with history/memory | `capability.cli.assistant` |
+| citation-engine | has-capability | TS package (45 files) implementing the citation-evidence domain model/API contracts | `capability.citation.engine` |
+| citation-evidence | has-capability | TS/Vite app (90 files) — integration shell/reference implementation coordinating the citation-evidence subsystems | `capability.citation.evidence-workspace` |
+| citation-work | no-capability | Only INTENT/SCOPE/registry/workplans; no src or code implementing the described review workbench | |
+| coordination-engine | no-capability | Ambitious framework prose in INTENT, but only history/spec/registry dirs — no runtime code | |
+| domain-tree | no-capability | Only registry/workplans; SCOPE explicitly defers ownership to State Hub, no implementation | |
+| email-connect | has-capability | Real Python service (24 files, pyproject, config, spec) — headless email send/track/evidence service with coordination-engine adapter contract | `capability.email.connector` |
+| evidence-anchor | no-capability | Only INTENT/SCOPE/registry/workplans; anchoring/highlighting layer described but not implemented | |
+| evidence-binder | no-capability | Only INTENT/SCOPE/registry/workplans; binding model described but not implemented | |
+| evidence-source | no-capability | Only INTENT/SCOPE/registry/workplans; ingestion/extraction layer described but not implemented | |
+| guide-board | has-capability | Real Python package (40 files, pyproject, extensions, profiles) — certification/compliance evidence framework with extension architecture | `capability.compliance.evidence-framework` |
+| helix-forge | no-capability | Draft-status (intent_version 0.1.0) capability-ecosystem vision; only design assets, standards docs, and one bootstrap script, no packaged implementation | |
+| hub-core | has-capability | Real Python library (81 files, pyproject) providing reusable FastAPI/SQLAlchemy/MCP primitives shared across FOS hub services | `capability.hub.core-library` |
+| human-resources | no-capability | Only aspirational HR-for-humans intent prose plus registry/workplans; no implementation | |
+| ihp-railiance-probe | no-capability | Self-described in its own INTENT as "a probe — not a product," purely a pipeline-validation canary app | |
+| info-tech-canon | has-capability | Real Python service (18 files, pyproject, canon.yaml) implementing a concrete "infospace" service surface (CLI, importable functions, read-only HTTP API) on top of the canon corpus | `capability.canon.info-tech` |
+| infospace-bench | has-capability | Real Python workspace/CLI (75 files, pyproject, examples) for creating/evaluating structured "infospaces" | `capability.knowledge.infospace-workspace` |
+| inter-hub | has-capability | Haskell/IHP app implementing the Interaction Hub Framework (IHF) — governed interaction substrate with Main.hs, Application, Web, contracts, specs | `capability.hub.interaction-framework` |
+| issue-core | has-capability | Real Python package (45 files) already carrying its own `CAPABILITY-issue-tracking.yaml` and `.capability/` dir — issue-tracking service | `capability.issue.tracking` |
+| kaizen-agentic | has-capability | Real Python package (57 files, pyproject) — 18-agent library plus agency/memory/coordination framework for deployed project agents | `capability.agent.kaizen-framework` |
+| key-cape | has-capability | Real Python service (56 files, spec, config) implementing the lightweight-mode NetKingdom IAM profile (OIDC/PKCE via Authelia/LLDAP/privacyIDEA) | `capability.iam.key-cape` |
+| kontextual-engine | has-capability | Large Python package (123 files, pyproject, tpsc.yaml) — context engine with examples/docs | `capability.context.engine` |
+| llm-connect | has-capability | Real Python package (62 files, pyproject, contracts) — provider-neutral LLM connector library | `capability.llm.connector` |
+| markitect-filter | has-capability | Small but real Python package (10 files, pyproject, examples) — markdown filtering component of the Markitect family | `capability.markitect.filter` |
+| markitect-main | has-capability | Large legacy platform (application/domain/services dirs, pyproject, package.json) — markitect umbrella product, now being split into successor repos | `capability.markitect.platform` |
+| markitect-quarkdown | has-capability | Small real Python package (adapter.py, pyproject) — Quarkdown integration adapter for Markitect | `capability.markitect.quarkdown-adapter` |
+| markitect-tool | has-capability | Large Python package (144 files, pyproject, sbom-tools.yaml) — markdown-native toolkit/CLI, syntax-layer successor to markitect-main | `capability.markitect.tool` |
+| net-kingdom | has-capability | Real tooling under tools/ (playbook-capability-contract, security-bootstrap-console, iam-profile-conformance, each with README+py) plus canon schemas — IAM/security tooling suite, despite no top-level src/pyproject | `capability.security.iam-tooling` |
+| open-cmis-tck | has-capability | Real Python package (14 files, pyproject, adapters/runners/runtime) — CMIS technology compatibility kit | `capability.cmis.tck` |
+| open-reuse | has-capability | Real Python package (cli.py, registry.py, validate.py) — reuse-registry CLI/validator (the tool underlying this very classification workflow) | `capability.reuse.registry-cli` |
+| ops-bridge | has-capability | Real Python CLI (36 files, pyproject) — SSH reverse-tunnel lifecycle manager keeping remote nodes connected to the State Hub (matches the "bridge" skill) | `capability.ops.tunnel-bridge` |
+| ops-hub | no-capability | Only a single diagnostic bootstrap-API probe script (interhub_gate_probe.py) exists; the described "operational truth surface" (hosts/services/incidents/runbooks) isn't implemented yet | |
+| phase-memory | has-capability | Real Python package (59 files, pyproject) — profile-driven memory operating layer producing deterministic dry-run retention/compaction actions | `capability.memory.phase-store` |
+| railiance-apps | has-capability | Real helm charts, k8s manifests, and reusable smoke-test/check tooling (tools/*.sh) for deploying/verifying Railiance workloads | `capability.railiance.k8s-deploy-tooling` |
+| railiance-cluster | has-capability | Real bin/railiance CLI, lib/ scripts, and ansible playbooks (bootstrap/harden) for standing up Railiance cluster nodes | `capability.railiance.cluster-bootstrap` |
+| railiance-enablement | has-capability | Real promote-repo-to-forgejo.sh tool plus reusable CI workflow templates (container-build-push, ci-smoke) | `capability.railiance.ci-enablement` |
+| railiance-fabric | has-capability | Real Python package (44 files, pyproject, schemas) — railiance_fabric catalog/export tooling | `capability.railiance.fabric-catalog` |
+| railiance-forge | has-capability | Real runner-management tools/scripts (gitea/forgejo runner status/activation) and helm values for the CI runner substrate | `capability.railiance.runner-ops` |
+| railiance-infra | has-capability | Real ansible/terraform/scripts (Hetzner provisioning, SSH CA bootstrap, playbooks) plus a capabilities/ playbooks dir — infra-as-code automation | `capability.railiance.infra-automation` |
+| railiance-platform | has-capability | Extensive real scripts/ (OpenBao/Vault apply/verify, credential-change Python tooling) — secrets/credential platform automation | `capability.railiance.secrets-platform` |
+| repo-scoping | has-capability | Real Python package (88 files, pyproject, migrations) — repo scoping/classification service | `capability.repo.scoping` |
+| repo-seed | has-capability | Already publishes a real capability entry (`registry/capabilities/capability.infotech.repo-template.md`) — git repo template with State Hub onboarding scaffold | `capability.infotech.repo-template` |
+| tegwick-control | no-capability | Personal life/company planning notes (areas/, agent-tasks/) — a private portfolio-tracking meta-repo, not a reusable component | |
+| the-custodian | has-capability | Real Python runtime (runtime/agent.py + pyproject) and tools/ scripts (classification batching, Gitea SSH inventory) — the custodian control-plane agent | `capability.custodian.runtime-agent` |
+| user-engine | has-capability | Real Python package (36 files, pyproject, migrations) — user/identity domain service | `capability.identity.user-engine` |
+| vantage-point | has-capability | Substantial draft protocol spec (nbgm-spec-v0.1.md) defining the Network-Based Graph Model — a well-defined, versioned data model spec, even without code yet | `capability.graph.nbgm-spec` |
+| vergabe-teilnahme | has-capability | Full Django application (413 files, manage.py, vergabe_teilnahme package, vite frontend) for German public-procurement (Vergabe) tender participation | `capability.procurement.vergabe-teilnahme` |
+| whynot-control | no-capability | Business-signal/beta-tracking scaffolding (betas/, prototypes/, offers/, signals/) with only README stubs — no independent reusable component | |
+| whynot-design | has-capability | Real JS design-system package (9+ src files: elements/atoms, chrome, layout, icons, styles) with adapters/tokens — cross-framework design system | `capability.design.whynot-system` |
+
+## Notes on borderline calls
+
+- **repo-seed** already has a capability entry (`capability.infotech.repo-template`)
+  in the federated index — it shouldn't have been in the empty-scaffold list at
+  all; the roster's `capability_count` for it is stale. Flag as a data-quality
+  fix alongside T03/T04, not a fresh draft.
+- **issue-core** already carries its own `CAPABILITY-issue-tracking.yaml` and
+  `.capability/` directory outside the standard `registry/` layout — likely a
+  pre-existing capability description in a non-standard location that needs
+  migrating into `registry/capabilities/`, not a from-scratch draft.
+- **vantage-point** has no code yet, only a versioned protocol spec — flagged
+  `has-capability` on the strength of the spec itself (D-axis can be honest
+  and non-zero for a documented model; A-axis should stay low/A0 until there's
+  an implementation).
+- **net-kingdom** and **railiance-*** repos generally lack a top-level
+  `pyproject.toml`/package manifest but do have real, runnable tooling under
+  `tools/`/`scripts/` — maturity vectors for these should reflect
+  script-level availability (likely A1–A2), not assume packaged distribution.
+- 13 no-capability repos cluster into two patterns: **vision-only** (INTENT/SCOPE
+  prose with no implementation — agentic-resources, citation-work,
+  coordination-engine, domain-tree, evidence-anchor, evidence-binder,
+  evidence-source, human-resources, helix-forge, ops-hub) and **explicitly
+  out-of-scope for reuse** (ihp-railiance-probe is a self-described probe,
+  tegwick-control and whynot-control are personal/business tracking, not
+  product components).
+
+## Next steps (blocked on review)
+
+- **T03** (mark no-capability): write `registry/NO_CAPABILITIES.md` into the
+  13 confirmed no-capability repos, set `capability_status: none` in the
+  roster.
+- **T04** (draft entries): run `establish --discover` for the 37 (35, net of
+  the two data-quality fixes above) confirmed has-capability repos in cohorts
+  of ~10, honest low-maturity first pass.
+
+**Awaiting Bernd's confirmation of this bucket split before T03/T04 proceed**,
+per the workplan's human-review-checkpoint design principle.
--- a/history/2026-07-06-t04-review-summary.md
+++ b/history/2026-07-06-t04-review-summary.md
@@ -0,0 +1,171 @@
+# REUSE-WP-0017-T04 review summary
+
+> **Update 2026-07-07:** `inter-hub` has been retired (Haskell/IHP
+> build-chain problems) and superseded by `core-hub` (Python/FastAPI/Postgres).
+> Its capability entry was reassessed and marked `deprecated` — see
+> `history/2026-07-07-inter-hub-retirement.md`. The D3/A1/C1/R0 vector in
+> the table below is now stale for that one row; current vector is
+> D5/A1/C3/R0.
+
+Prepared for the T05 human-review-and-publish-pass checkpoint. Everything
+below is generated from the actual files committed in each sibling repo
+(not from drafting notes), so it reflects what would actually get pushed
+and published.
+
+**Coverage: 61/61.** 48 repos have a capability entry, 13 have an explicit
+`registry/NO_CAPABILITIES.md` marker, 0 remain unclassified.
+
+**What's new this session (T02–T04):** 30 sibling repos got a first commit —
+13 no-capability markers (T03) and 17 newly drafted capability entries
+(the first two T04 cohorts + this final cohort — see per-cohort commit
+messages in `workplans/REUSE-WP-0017-capability-coverage-campaign.md` for
+the exact 10/10/17 split). The other 18 `has` rows below already existed
+before this workplan (activity-core, audit-core, config-atlas,
+feature-control, flex-auth, identity-canon, ops-warden, repo-seed,
+reuse-surface, shard-wiki, state-hub, plus the ones drafted in cohorts
+1–2 — see the table for the full picture; cohort provenance is in the
+workplan file, not repeated here).
+
+**Everything below is committed locally only.** Nothing has been pushed to
+any sibling repo's remote. T05 is where you review, then push +
+publish-check + hub refresh + `federation compose` happen.
+
+## How to review a single entry
+
+```bash
+cd ~/<repo-slug>
+git log -1 --stat          # see exactly what was added
+git show HEAD               # full diff
+cat registry/capabilities/<id>.md   # or registry/NO_CAPABILITIES.md
+```
+
+To push everything after review (per-repo, once you're satisfied):
+
+```bash
+git -C ~/<repo-slug> push origin main
+```
+
+## Things worth a closer look before pushing
+
+1. **`the-custodian`** — the repo root carries an NDA/confidentiality
+   notice. The entry (`capability.agents.custodian-runtime-tooling`) is
+   deliberately scoped to only the non-confidential `runtime/` agent
+   framework and `tools/` repo-classification scripts; canon/memory content
+   is explicitly excluded in `discovery.excludes` and
+   `consumer_guidance.not_recommended_for`. Please double-check this
+   scoping is exactly right before pushing — this is the one entry where
+   getting the boundary wrong has real consequences.
+2. **`vergabe-teilnahme`** — its own `SCOPE.md` is an unfilled template, so
+   the entry is honestly low (D1/A1/C0/R0) with a limitation note that
+   filling in SCOPE.md should happen before further promotion.
+3. **`markitect-main`** — registered as a *superseded legacy platform*,
+   with `consumer_guidance.not_recommended_for` pointing new consumers at
+   its three successors (`markitect-tool`, `infospace-bench`,
+   `kontextual-engine`). Worth confirming that's the framing you want on
+   the record.
+4. **`issue-core`** — migrated its own pre-existing
+   `CAPABILITY-issue-tracking.yaml` (a rich, non-standard capability
+   manifest with 109 tests / 61% coverage documented) into the standard
+   `registry/capabilities/` location, rather than drafting fresh. Worth
+   confirming nothing was lost in translation.
+5. **Stale repo-seed-template READMEs** — `inter-hub`, `open-reuse`, and
+   `vantage-point` all still show the generic `repo-seed` bootstrap README
+   at their repo root; I used each repo's `SCOPE.md`/`INTENT.md` instead
+   (noted in each entry's discovery rationale) since those are accurate.
+   The stale READMEs themselves are a small, separate cleanup — not fixed
+   here, out of scope for this workplan.
+6. **Forgejo-transition tooling surfaced along the way** — `railiance-enablement`
+   (`tools/promote-repo-to-forgejo.sh`), `railiance-apps`
+   (`tools/forgejo-smoke.sh`), and `the-custodian`
+   (`tools/patch-forgejo-remote-urls.sh`) all ship tooling directly relevant
+   to REUSE-WP-0019's host-migration inventory (T01) — worth cross-referencing
+   when that workplan starts.
+7. **Two pre-existing roster rows had a stale `seed_capability_ids: []`**
+   despite having real, already-published entries: `activity-core`
+   (`capability.activity.event-coordinate`) and `ops-warden`
+   (`capability.security.ssh-certificate-issuance`). Fixed as a small
+   incidental correction in the roster — not new drafts, just a bookkeeping
+   gap from before this workplan.
+8. **`config-atlas`** remains `publish_check: fail` (303 error) — tracked
+   separately as REUSE-WP-0017-T06, likely related to the Gitea→Forgejo
+   transition (REUSE-WP-0019-T01).
+
+## All 48 capability entries
+
+| Repo | Capability ID | Vector (D/A/C/R) | Summary |
+|---|---|---|---|
+| `activity-core` | `capability.activity.event-coordinate` | D3/A1/C1/R0 | Coordinate structured responses to cross-domain events through activity workflows and automation. |
+| `artifact-store` | `capability.infotech.artifact-store` | D3/A1/C1/R0 | Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts. |
+| `audit-core` | `capability.audit.event-retain` | D4/A2/C2/R1 | Collect, normalize, retain, and search audit events with integrity evidence across tenants. |
+| `can-you-assist` | `capability.agents.cli-assistant` | D2/A2/C1/R0 | Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help. |
+| `citation-engine` | `capability.infotech.citation-engine` | D3/A1/C1/R0 | Core domain model and engine services for the citation-evidence ecosystem — shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers. |
+| `citation-evidence` | `capability.infotech.citation-evidence-workspace` | D4/A1/C1/R0 | Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations — the umbrella application over the citation-evidence six-package design. |
+| `config-atlas` | `capability.infotech.config-surface-atlas` | D5/A0/C2/R2 | Read-first, cross-kind map and evidence layer for configuration surfaces — what configures a system, who owns it, its scope, and where the source of truth lives. |
+| `email-connect` | `capability.infotech.email-connector` | D2/A1/C1/R0 | Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports. |
+| `feature-control` | `capability.feature-control.evaluate` | D5/A4/C3/R3 | Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context. |
+| `flex-auth` | `capability.authorization.policy-evaluate` | D4/A2/C2/R1 | Evaluate access decisions from policy-as-code rules for subjects, resources, and actions. |
+| `guide-board` | `capability.communication.compliance-evidence-framework` | D2/A2/C1/R0 | Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture. |
+| `hub-core` | `capability.infotech.hub-core-library` | D2/A1/C1/R1 | Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs. |
+| `identity-canon` | `capability.identity.subject-resolution` | D3/A0/C1/R0 | Resolve who or what is acting in a context by mapping principals, accounts, actors, and identifiers to a stable subject model. |
+| `info-tech-canon` | `capability.infotech.canon-service` | D2/A2/C1/R0 | Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon information-processing infospace, backed by infospace-bench. |
+| `infospace-bench` | `capability.communication.infospace-workspace` | D3/A1/C2/R1 | Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main. |
+| `inter-hub` | `capability.infotech.interaction-hub-framework` | D3/A1/C1/R0 | Specification and reference implementation of a governed, observable interaction substrate connecting rendered UI widgets to structured feedback, requirements, decisions, implementation changes, and observed outcomes. |
+| `issue-core` | `capability.infotech.issue-tracking` | D4/A2/C2/R1 | Unified Python/CLI interface for issue tracking across Gitea, GitHub, and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents. |
+| `kaizen-agentic` | `capability.agents.kaizen-framework` | D3/A2/C1/R0 | AI agency framework providing 18 specialized deployable agent instruction sets plus persistent, project-scoped memory and cross-agent coordination via a Coach meta-agent. |
+| `key-cape` | `capability.iam.key-cape` | D4/A2/C2/R1 | Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against implementation internals. |
+| `kontextual-engine` | `capability.communication.context-engine` | D4/A1/C1/R0 | Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge. |
+| `llm-connect` | `capability.agents.llm-connector` | D3/A2/C2/R1 | Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers. |
+| `markitect-filter` | `capability.communication.markitect-source-adapters` | D2/A1/C1/R0 | Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract. |
+| `markitect-main` | `capability.communication.markitect-legacy-platform` | D3/A1/C1/R0 | Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine. |
+| `markitect-quarkdown` | `capability.communication.markitect-quarkdown-adapter` | D3/A1/C1/R0 | Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown. |
+| `markitect-tool` | `capability.communication.markitect-toolkit` | D4/A2/C2/R1 | Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main. |
+| `net-kingdom` | `capability.security.iam-tooling-suite` | D3/A2/C1/R1 | Dynamic, self-optimizing security platform for Kubernetes-deployed IT infrastructure; owns canonical IAM/security standards and executable conformance tooling (IAM profile conformance, playbook capability contract validation, security bootstrap console). |
+| `open-cmis-tck` | `capability.cmis.tck` | D2/A1/C1/R0 | CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework. |
+| `open-reuse` | `capability.infotech.oss-integration-continuity` | D2/A1/C1/R0 | Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves. |
+| `ops-bridge` | `capability.ops.tunnel-bridge` | D3/A2/C2/R1 | CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events. |
+| `ops-warden` | `capability.security.ssh-certificate-issuance` | D4/A3/C3/R2 | Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward operational access routing across NetKingdom security lanes. |
+| `phase-memory` | `capability.memory.phase-planning` | D3/A1/C1/R0 | Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation. |
+| `railiance-apps` | `capability.railiance.workload-deployment-tooling` | D3/A2/C1/R1 | S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack — application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services. |
+| `railiance-cluster` | `capability.railiance.cluster-bootstrap` | D3/A2/C1/R0 | Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment. |
+| `railiance-enablement` | `capability.railiance.ci-enablement` | D3/A2/C2/R1 | S4 Developer Enablement layer of the Railiance OAS Stack — reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime. |
+| `railiance-fabric` | `capability.railiance.fabric-graph` | D3/A1/C1/R0 | Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings. |
+| `railiance-forge` | `capability.railiance.forge-infrastructure` | D3/A1/C1/R0 | Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate. |
+| `railiance-infra` | `capability.railiance.infra-provisioning` | D4/A2/C2/R1 | Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth. |
+| `railiance-platform` | `capability.railiance.platform-services` | D3/A2/C1/R0 | S3 Platform Services layer of the Railiance OAS Stack — shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage. |
+| `repo-scoping` | `capability.agents.repo-scoping-service` | D2/A2/C1/R0 | Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI. |
+| `repo-seed` | `capability.infotech.repo-template` | D3/A3/C2/R2 | Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions. |
+| `reuse-surface` | `capability.registry.register` | D3/A4/C2/R3 | Register a new capability so it becomes visible for planning and implementation reuse. |
+| `shard-wiki` | `capability.wiki.shard-orchestration` | D5/A2/C2/R1 | Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history. |
+| `state-hub` | `capability.statehub.progress-log` | D4/A4/C3/R3 | Record progress events, decisions, and session notes against workstreams and tasks in State Hub. |
+| `the-custodian` | `capability.agents.custodian-runtime-tooling` | D2/A1/C1/R0 | Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos. |
+| `user-engine` | `capability.identity.user-engine` | D4/A1/C2/R0 | Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys. |
+| `vantage-point` | `capability.graph.nbgm-spec` | D2/A0/C1/R0 | Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains. |
+| `vergabe-teilnahme` | `capability.procurement.vergabe-teilnahme` | D1/A1/C0/R0 | Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation — Ausschreibungs- und Teilnahme-Management-System. |
+| `whynot-design` | `capability.design.whynot-system` | D3/A2/C2/R1 | Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters. |
+
+## All 13 explicit no-capability markers
+
+| Repo | Reason |
+|---|---|
+| `agentic-resources` | INTENT/SCOPE are aspirational HR-for-agents vision prose; no src/, no package manifest — vision-stage only, nothing implemented to reuse. |
+| `citation-work` | Only INTENT/SCOPE/registry/workplans describing a review workbench; no source implementing it yet. |
+| `coordination-engine` | Ambitious coordination-framework prose in INTENT, but only history/spec/registry dirs exist — no runtime code yet. |
+| `domain-tree` | Only registry/workplans; SCOPE explicitly defers ownership of implementation to State Hub. |
+| `evidence-anchor` | Only INTENT/SCOPE/registry/workplans; the anchoring/highlighting layer is described but not implemented. |
+| `evidence-binder` | Only INTENT/SCOPE/registry/workplans; the binding model is described but not implemented. |
+| `evidence-source` | Only INTENT/SCOPE/registry/workplans; the ingestion/extraction layer is described but not implemented. |
+| `helix-forge` | Draft-status (intent_version 0.1.0) capability-ecosystem vision; only design assets and standards docs exist, no packaged implementation. |
+| `human-resources` | Aspirational HR-for-humans intent prose plus registry/workplans; no implementation. |
+| `ihp-railiance-probe` | Self-described in its own INTENT as a probe, not a product — a pipeline-validation canary app, not intended for reuse. |
+| `ops-hub` | Only a single diagnostic bootstrap-API probe script exists; the described operational-truth surface (hosts/services/incidents/runbooks) isn't implemented yet. |
+| `tegwick-control` | Personal life/company planning notes (areas/, agent-tasks/) — a private portfolio-tracking meta-repo, not a reusable product component. |
+| `whynot-control` | Business-signal/beta-tracking scaffolding (betas/, prototypes/, offers/, signals/) with only README stubs — no independent reusable component. |
+
+## Next steps (T05)
+
+1. Review the flagged items above, especially #1 (the-custodian confidentiality scoping).
+2. Spot-check a sample of entries against the actual repos if you want deeper confidence beyond this summary.
+3. Push the sibling-repo commits (30 repos have new commits this session; see `git log --oneline -1` in each).
+4. `establish --publish-check` per repo where the raw URL needs confirming.
+5. `reuse-surface federation compose` + catalog + graph regeneration in this repo.
+6. Then T06 (config-atlas 303 fix) can proceed independently.
--- a/history/2026-07-07-inter-hub-retirement.md
+++ b/history/2026-07-07-inter-hub-retirement.md
@@ -0,0 +1,65 @@
+# inter-hub retirement and maturity reassessment
+
+Follow-up to the REUSE-WP-0017 coverage sweep, requested by Bernd after
+reviewing `history/2026-07-06-t04-review-summary.md` and the READMEs
+written for `inter-hub`/`open-reuse`/`vantage-point`.
+
+## Decision
+
+`inter-hub` (the Haskell/IHP Interaction Hub Framework implementation) is
+**retired** due to persistent build-chain problems. The same framework
+ambition is being rebuilt on a more convenient technology stack as
+**`core-hub`** (Python/FastAPI/Postgres, contract-first). This is an owner
+decision (Bernd), not a reuse-surface judgment call.
+
+`core-hub` already exists as a repo (`~/core-hub`, first commit
+2026-06-27) with its own self-authored capability entry
+(`capability.infotech.core-hub`, D3/A1/C1/R1) — it was created after the
+last workstation roster snapshot (2026-06-16) and REUSE-WP-0017's coverage
+sweep, so it isn't yet part of reuse-surface's federation sources or the
+61-repo roster. `core-hub/SCOPE.md` explicitly frames itself as the
+"Gen 3" successor to `inter-hub` ("Gen 2") and `state-hub` ("Gen 1"), and
+already scopes in Inter-Hub `/api/v2` compatibility and a data-migration
+plan.
+
+## Maturity reassessment for `capability.infotech.interaction-hub-framework`
+
+The original REUSE-WP-0017-T04 first-pass entry (2026-07-06) rated this
+D3/A1/C1/R0 with availability confidence explicitly flagged low ("not
+independently verified in this sweep"). A deeper look at `SCOPE.md`'s own
+per-phase log, prompted by writing `inter-hub`'s real README, showed
+Phases 0–9 complete: real `Web/Controller/` modules (governance,
+requirements, hub capability manifests, federated policy overlays,
+deployment records, agent registrations, webhooks), a `Test/` suite, and a
+versioned external API (`/api/v2`) with OpenAPI, OAuth client credentials,
+generated SDKs, and rate limiting — a substantial working reference
+implementation, not a paper spec.
+
+New vector: **D5 / A1 / C3 / R0**, `status: deprecated`.
+
+| Axis | Change | Why |
+|---|---|---|
+| Discovery | D3 → D5 | Undersold on first pass; Phases 0-9 are genuinely documented and delivered |
+| Availability | A1 → A1 (held) | Deliberately **not** raised — the Haskell/IHP build chain is the specific reason for retirement. Feature completeness and build/deploy reliability are different axes; this is exactly the case where they diverge |
+| Completeness | C1 → C3 | Nine implementation phases delivered against the original spec's traceability chain |
+| Reliability | R0 → R0 (held) | The retirement itself is the reliability signal — a feature-complete implementation that could not be kept dependably buildable. Recorded as an incident, not glossed over |
+
+`relations.related_to` now points at `capability.infotech.core-hub`.
+`consumer_guidance` reframed: recommended only for historical
+reference/prior-art study; explicitly not recommended for new integration
+work.
+
+Committed and pushed directly in `~/inter-hub` (single-repo change, not a
+mass push): commit `cffdf9e`.
+
+## Not done (out of scope for this follow-up)
+
+- `core-hub` is not yet added to reuse-surface's `local-repo-roster.yaml`
+  or `registry/federation/sources.yaml` — it wasn't part of the original
+  61-repo coverage sweep and adding it means a fresh registration pass
+  (publish-check, hub registration) of its own. Worth doing as a small
+  follow-up so the `related_to` relation resolves inside reuse-surface's
+  own federated index, not just as a prose pointer.
+- `core-hub`'s own capability entry (D3/A1/C1/R1) was not touched — it's
+  self-authored and self-governed by that repo, not part of this
+  reassessment.
--- a/registry/federation/local-repo-roster.yaml
+++ b/registry/federation/local-repo-roster.yaml
@@ -1,25 +1,30 @@
 version: 1
-updated: '2026-06-16'
+updated: '2026-06-26'
 workstation_root: /home/worsch
 definition: All git repositories one level under the workstation home directory (e.g.
  /home/worsch/<slug> with a .git directory). Excludes nested worktrees and non-git
  folders.
 summary:
-  total: 60
-  established: 60
+  total: 61
+  established: 61
  pending: 0
  with_reuse_surface_seed: 8
-  hub_registered: 60
-  publish_pass: 60
+  hub_registered: 61
+  publish_pass: 61
  publish_fail: 0
-  publish_sweep: '2026-06-16'
+  publish_sweep: '2026-07-07'
+  capability_status_has: 48
+  capability_status_none: 13
+  capability_status_pending: 0
 repos:
 - slug: activity-core
  path: /home/worsch/activity-core
  status: established
  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.activity.event-coordinate
  hub_registered: true
  publish_check: pass
  batch: B01
@@ -27,6 +32,7 @@ repos:
  path: /home/worsch/agentic-resources
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -35,9 +41,11 @@ repos:
 - slug: artifact-store
  path: /home/worsch/artifact-store
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.artifact-store
  hub_registered: true
  publish_check: pass
  batch: B01
@@ -45,6 +53,7 @@ repos:
  path: /home/worsch/audit-core
  status: established
  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.audit.event-retain
@@ -54,27 +63,33 @@ repos:
 - slug: can-you-assist
  path: /home/worsch/can-you-assist
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.agents.cli-assistant
  hub_registered: true
  publish_check: pass
  batch: B01
 - slug: citation-engine
  path: /home/worsch/citation-engine
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.citation-engine
  hub_registered: true
  publish_check: pass
  batch: B01
 - slug: citation-evidence
  path: /home/worsch/citation-evidence
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.citation-evidence-workspace
  hub_registered: true
  publish_check: pass
  batch: B01
@@ -82,15 +97,31 @@ repos:
  path: /home/worsch/citation-work
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
  publish_check: pass
  batch: B01
+- slug: config-atlas
+  path: /home/worsch/config-atlas
+  status: established
+  capability_count: 1
+  capability_status: has
+  seed_from_reuse_surface: false
+  seed_capability_ids:
+  - capability.infotech.config-surface-atlas
+  hub_registered: true
+  publish_check: pass
+  publish_note: local publish-check passes; hub registration completed
+    2026-07-07 (config-atlas now present among the 61 sources at
+    https://reuse.coulomb.social/v1/federated). REUSE-WP-0017-T06 closed.
+  batch: B02
 - slug: coordination-engine
  path: /home/worsch/coordination-engine
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -100,6 +131,7 @@ repos:
  path: /home/worsch/domain-tree
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -108,9 +140,11 @@ repos:
 - slug: email-connect
  path: /home/worsch/email-connect
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.email-connector
  hub_registered: true
  publish_check: pass
  batch: B02
@@ -118,6 +152,7 @@ repos:
  path: /home/worsch/evidence-anchor
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -127,6 +162,7 @@ repos:
  path: /home/worsch/evidence-binder
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -136,6 +172,7 @@ repos:
  path: /home/worsch/evidence-source
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -145,6 +182,7 @@ repos:
  path: /home/worsch/feature-control
  status: established
  capability_count: 3
+  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.feature-control.evaluate
@@ -157,6 +195,7 @@ repos:
  path: /home/worsch/flex-auth
  status: established
  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.authorization.policy-evaluate
@@ -166,9 +205,11 @@ repos:
 - slug: guide-board
  path: /home/worsch/guide-board
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.communication.compliance-evidence-framework
  hub_registered: true
  publish_check: pass
  batch: B02
@@ -176,6 +217,7 @@ repos:
  path: /home/worsch/helix-forge
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -184,9 +226,11 @@ repos:
 - slug: hub-core
  path: /home/worsch/hub-core
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.hub-core-library
  hub_registered: true
  publish_check: pass
  batch: B02
@@ -194,6 +238,7 @@ repos:
  path: /home/worsch/human-resources
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -203,6 +248,7 @@ repos:
  path: /home/worsch/identity-canon
  status: established
  capability_count: 2
+  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.identity.subject-resolution
@@ -214,6 +260,7 @@ repos:
  path: /home/worsch/ihp-railiance-probe
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -222,144 +269,176 @@ repos:
 - slug: info-tech-canon
  path: /home/worsch/info-tech-canon
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.canon-service
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: infospace-bench
  path: /home/worsch/infospace-bench
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.communication.infospace-workspace
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: inter-hub
  path: /home/worsch/inter-hub
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.interaction-hub-framework
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: issue-core
  path: /home/worsch/issue-core
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.issue-tracking
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: kaizen-agentic
  path: /home/worsch/kaizen-agentic
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.agents.kaizen-framework
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: key-cape
  path: /home/worsch/key-cape
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.iam.key-cape
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: kontextual-engine
  path: /home/worsch/kontextual-engine
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.communication.context-engine
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: llm-connect
  path: /home/worsch/llm-connect
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.agents.llm-connector
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: markitect-filter
  path: /home/worsch/markitect-filter
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.communication.markitect-source-adapters
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: markitect-main
  path: /home/worsch/markitect-main
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.communication.markitect-legacy-platform
  hub_registered: true
  publish_check: pass
  batch: B03
 - slug: markitect-quarkdown
  path: /home/worsch/markitect-quarkdown
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.communication.markitect-quarkdown-adapter
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: markitect-tool
  path: /home/worsch/markitect-tool
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.communication.markitect-toolkit
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: net-kingdom
  path: /home/worsch/net-kingdom
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.security.iam-tooling-suite
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: open-cmis-tck
  path: /home/worsch/open-cmis-tck
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.cmis.tck
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: open-reuse
  path: /home/worsch/open-reuse
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.oss-integration-continuity
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: ops-bridge
  path: /home/worsch/ops-bridge
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.ops.tunnel-bridge
  hub_registered: true
  publish_check: pass
  batch: B04
@@ -367,6 +446,7 @@ repos:
  path: /home/worsch/ops-hub
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -376,53 +456,65 @@ repos:
  path: /home/worsch/ops-warden
  status: established
  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.security.ssh-certificate-issuance
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: phase-memory
  path: /home/worsch/phase-memory
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.memory.phase-planning
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: railiance-apps
  path: /home/worsch/railiance-apps
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.railiance.workload-deployment-tooling
  hub_registered: true
  publish_check: pass
  batch: B04
 - slug: railiance-cluster
  path: /home/worsch/railiance-cluster
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.railiance.cluster-bootstrap
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-enablement
  path: /home/worsch/railiance-enablement
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.railiance.ci-enablement
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-fabric
  path: /home/worsch/railiance-fabric
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.railiance.fabric-graph
  hub_registered: true
  publish_check: pass
  batch: B05
@@ -430,45 +522,55 @@ repos:
 - slug: railiance-forge
  path: /home/worsch/railiance-forge
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.railiance.forge-infrastructure
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-infra
  path: /home/worsch/railiance-infra
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.railiance.infra-provisioning
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: railiance-platform
  path: /home/worsch/railiance-platform
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.railiance.platform-services
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: repo-scoping
  path: /home/worsch/repo-scoping
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.agents.repo-scoping-service
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: repo-seed
  path: /home/worsch/repo-seed
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.infotech.repo-template
  hub_registered: true
  publish_check: pass
  batch: B05
@@ -476,6 +578,7 @@ repos:
  path: /home/worsch/reuse-surface
  status: established
  capability_count: 3
+  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.registry.register
@@ -487,6 +590,7 @@ repos:
  path: /home/worsch/shard-wiki
  status: established
  capability_count: 8
+  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.wiki.shard-orchestration
@@ -504,6 +608,7 @@ repos:
  path: /home/worsch/state-hub
  status: established
  capability_count: 2
+  capability_status: has
  seed_from_reuse_surface: true
  seed_capability_ids:
  - capability.statehub.progress-log
@@ -515,6 +620,7 @@ repos:
  path: /home/worsch/tegwick-control
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -523,36 +629,44 @@ repos:
 - slug: the-custodian
  path: /home/worsch/the-custodian
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.agents.custodian-runtime-tooling
  hub_registered: true
  publish_check: pass
  batch: B05
 - slug: user-engine
  path: /home/worsch/user-engine
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.identity.user-engine
  hub_registered: true
  publish_check: pass
  batch: B06
 - slug: vantage-point
  path: /home/worsch/vantage-point
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.graph.nbgm-spec
  hub_registered: true
  publish_check: pass
  batch: B06
 - slug: vergabe-teilnahme
  path: /home/worsch/vergabe-teilnahme
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.procurement.vergabe-teilnahme
  hub_registered: true
  publish_check: pass
  batch: B06
@@ -560,6 +674,7 @@ repos:
  path: /home/worsch/whynot-control
  status: established
  capability_count: 0
+  capability_status: none
  seed_from_reuse_surface: false
  seed_capability_ids: []
  hub_registered: true
@@ -568,9 +683,11 @@ repos:
 - slug: whynot-design
  path: /home/worsch/whynot-design
  status: established
-  capability_count: 0
+  capability_count: 1
+  capability_status: has
  seed_from_reuse_surface: false
-  seed_capability_ids: []
+  seed_capability_ids:
+  - capability.design.whynot-system
  hub_registered: true
  publish_check: pass
  batch: B06
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -58,6 +58,18 @@ sources:
  domain: helix_forge
  cache_ttl_seconds: 86400
  auth_header: Authorization
+- repo: config-atlas
+  url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
+  enabled: true
+  required: false
+  domain: helix_forge
+  description: >-
+    Configuration Surface Atlas. Owns the `surface.*` id namespace (configuration
+    surfaces in registry/indexes/surfaces.yaml) as a typed sibling of `capability.*`;
+    only its capability index is federated here. Raw URL returns 303 until publish
+    is resolved (same block as state-hub/feature-control).
+  cache_ttl_seconds: 86400
+  auth_header: Authorization
 - repo: coordination-engine
  url: https://gitea.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
  enabled: true
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-06-18'
+updated: '2026-06-26'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -37,6 +37,10 @@ sources:
  count: 0
  url: https://gitea.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/citation-work.yaml
+- repo: config-atlas
+  count: 1
+  url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
+  cache: registry/federation/cache/config-atlas.yaml
 - repo: coordination-engine
  count: 0
  url: https://gitea.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
@@ -82,7 +86,7 @@ sources:
  url: https://gitea.coulomb.social/coulomb/hub-core/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/hub-core.yaml
 - repo: human-resources
-  count: 0
+  count: 1
  url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/human-resources.yaml
 - repo: identity-canon
@@ -202,7 +206,7 @@ sources:
  url: https://gitea.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/repo-scoping.yaml
 - repo: repo-seed
-  count: 0
+  count: 1
  url: https://gitea.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
  cache: registry/federation/cache/repo-seed.yaml
 - repo: reuse-surface
@@ -355,6 +359,25 @@ capabilities:
  source_repo: feature-control
  source_url: https://gitea.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
  source_index: registry/federation/cache/feature-control.yaml
+- id: capability.hr.workflow-catalog
+  name: HR Workflow Catalog
+  summary: Markdown-first registry of HR planning workflows with an iterative assessment
+    loop tied to INTENT phases.
+  vector: D3 / A1 / C1 / R0
+  domain: consumer
+  status: draft
+  owner: human-resources
+  path: registry/capabilities/capability.hr.workflow-catalog.md
+  tags:
+  - hr
+  - workflows
+  - assessment
+  - planning
+  consumption_modes:
+  - informational
+  source_repo: human-resources
+  source_url: https://gitea.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/human-resources.yaml
 - id: capability.identity.subject-resolution
  name: Identity Subject Resolution
  summary: Resolve who or what is acting by mapping principals, accounts, actors,
@@ -391,6 +414,48 @@ capabilities:
  source_repo: identity-canon
  source_url: https://gitea.coulomb.social/coulomb/identity-canon/raw/main/registry/indexes/capabilities.yaml
  source_index: registry/federation/cache/identity-canon.yaml
+- id: capability.infotech.config-surface-atlas
+  name: Configuration Surface Atlas
+  summary: "Read-first, cross-kind map and evidence layer for configuration surfaces\
+    \ \u2014 what configures a system, who owns it, its scope, and where the source\
+    \ of truth lives."
+  vector: D5 / A0 / C2 / R2
+  domain: infotech
+  status: draft
+  owner: config-atlas
+  path: registry/capabilities/capability.infotech.config-surface-atlas.md
+  tags:
+  - configuration
+  - registry
+  - control-plane
+  - effective-config
+  - evidence
+  consumption_modes:
+  - informational
+  - source module
+  source_repo: config-atlas
+  source_url: https://gitea.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/config-atlas.yaml
+- id: capability.infotech.repo-template
+  name: Coulomb Repository Template
+  summary: Bootstrap new git repositories with agent instructions, registry scaffold,
+    and State Hub onboarding conventions.
+  vector: D3 / A3 / C2 / R2
+  domain: infotech
+  status: draft
+  owner: repo-seed
+  path: registry/capabilities/capability.infotech.repo-template.md
+  tags:
+  - template
+  - bootstrap
+  - state-hub
+  - onboarding
+  consumption_modes:
+  - git clone
+  - informational
+  source_repo: repo-seed
+  source_url: https://gitea.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/repo-seed.yaml
 - id: capability.registry.register
  name: Capability Registration
  summary: Register a new capability so it becomes visible for planning and implementation
--- a/reuse_surface/cli.py
+++ b/reuse_surface/cli.py
@@ -20,6 +20,16 @@ from reuse_surface.hub_sync import (
    write_sources_manifest,
 )
 from reuse_surface.overlaps import find_overlaps
+from reuse_surface.statehub_bridge import list_open_capability_requests
+from reuse_surface.plan_check import (
+    format_plan_check_json,
+    format_plan_check_markdown,
+    load_query_from_intent,
+    load_query_from_workplan,
+    maybe_file_capability_request,
+    record_outcome,
+    run_plan_check,
+)
 from reuse_surface.reports import (
    cohort_filters_from_args,
    collect_gap_report,
@@ -578,16 +588,85 @@ def cmd_report_cohorts(args: argparse.Namespace) -> int:
    return 0


+def cmd_plan_check(args: argparse.Namespace) -> int:
+    if args.workplan and args.intent:
+        print("error: pass either a workplan file or --intent, not both", file=sys.stderr)
+        return 1
+    if args.workplan:
+        path = Path(args.workplan).resolve()
+        if not path.exists():
+            print(f"error: workplan not found: {path}", file=sys.stderr)
+            return 1
+        query = load_query_from_workplan(path)
+    elif args.intent:
+        query = load_query_from_intent(args.intent)
+    else:
+        print("error: provide a workplan file or --intent", file=sys.stderr)
+        return 1
+
+    result = run_plan_check(
+        query,
+        reuse_threshold=args.reuse_threshold,
+        extend_threshold=args.extend_threshold,
+    )
+
+    if args.record_outcome:
+        record_outcome(result, args.record_outcome, consumer_repo=args.consumer_repo)
+
+    filed = None
+    if args.file_request and result["verdict"] == "new":
+        filed = maybe_file_capability_request(
+            result,
+            requesting_domain=args.requesting_domain,
+            requesting_agent=args.consumer_repo,
+        )
+
+    if args.format == "json":
+        if filed is not None:
+            result["filed_capability_request"] = filed
+        print(format_plan_check_json(result))
+    else:
+        print(format_plan_check_markdown(result), end="")
+        if args.file_request and result["verdict"] == "new":
+            if filed:
+                print(f"\nFiled State Hub capability request: {filed.get('id')}")
+            else:
+                print("\nState Hub unreachable — capability request not filed.")
+    return 0
+
+
 def cmd_report_gaps(args: argparse.Namespace) -> int:
    roster_path = Path(args.roster).resolve() if args.roster else default_roster_path()
    if not roster_path.exists():
        print(f"error: roster not found: {roster_path}", file=sys.stderr)
        return 1
    report = collect_gap_report(roster_path)
+
+    if args.check_capability_requests:
+        open_requests = list_open_capability_requests()
+        report["open_capability_requests"] = (
+            [
+                {"id": r["id"], "title": r["title"], "requesting_domain": r.get("requesting_domain_slug")}
+                for r in open_requests
+            ]
+            if open_requests is not None
+            else None
+        )
+
    if args.format == "json":
        print(format_gap_json(report))
    else:
        print(format_gap_markdown(report), end="")
+        if args.check_capability_requests:
+            requests_ = report["open_capability_requests"]
+            print("\n## Open State Hub capability requests (no matching federated capability)\n")
+            if requests_ is None:
+                print("_State Hub unreachable — skipped._\n")
+            elif not requests_:
+                print("- none\n")
+            else:
+                for r in requests_:
+                    print(f"- `{r['id']}` ({r['requesting_domain']}): {r['title']}")
    return 0


@@ -697,6 +776,44 @@ def main(argv: list[str] | None = None) -> int:
    )
    overlaps.set_defaults(func=cmd_overlaps)

+    plan_check = subparsers.add_parser(
+        "plan-check",
+        help="match a draft workplan or intent against the federated capability index",
+    )
+    plan_check.add_argument(
+        "workplan", nargs="?", help="path to a workplan file (frontmatter + body)"
+    )
+    plan_check.add_argument("--intent", help="free-text intent instead of a workplan file")
+    plan_check.add_argument(
+        "--format", choices=["markdown", "json"], default="markdown"
+    )
+    plan_check.add_argument(
+        "--reuse-threshold", type=float, default=0.45,
+        help="score at or above which the verdict is 'reuse'",
+    )
+    plan_check.add_argument(
+        "--extend-threshold", type=float, default=0.22,
+        help="score at or above which the verdict is 'extend'",
+    )
+    plan_check.add_argument(
+        "--record-outcome",
+        choices=["reused", "extended", "new", "skipped"],
+        help="append this outcome to registry/telemetry/plan-check-events.jsonl",
+    )
+    plan_check.add_argument(
+        "--consumer-repo", default="reuse-surface",
+        help="repo slug recorded with --record-outcome and --file-request",
+    )
+    plan_check.add_argument(
+        "--file-request", action="store_true",
+        help="on a 'new' verdict, file a State Hub capability request for the gap",
+    )
+    plan_check.add_argument(
+        "--requesting-domain", default="infotech",
+        help="domain slug recorded on a filed capability request",
+    )
+    plan_check.set_defaults(func=cmd_plan_check)
+
    catalog = subparsers.add_parser(
        "catalog", help="generate human-readable capability catalog"
    )
@@ -808,6 +925,12 @@ def main(argv: list[str] | None = None) -> int:
        choices=["markdown", "json"],
        default="markdown",
    )
+    gaps.add_argument(
+        "--check-capability-requests",
+        action="store_true",
+        help="also list open State Hub capability requests with no matching "
+        "federated capability (requires State Hub reachable at 127.0.0.1:8000)",
+    )
    gaps.set_defaults(func=cmd_report_gaps)

    stats = subparsers.add_parser("stats", help="registry maturity and federation stats")
--- a/reuse_surface/plan_check.py
+++ b/reuse_surface/plan_check.py
@@ -0,0 +1,299 @@
+from __future__ import annotations
+
+import json
+import re
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from reuse_surface.federation import FEDERATED_INDEX_PATH
+from reuse_surface.overlaps import TOKEN_RE
+from reuse_surface.registry import ROOT, load_index
+from reuse_surface.statehub_bridge import file_capability_request
+
+TELEMETRY_PATH = ROOT / "registry" / "telemetry" / "plan-check-events.jsonl"
+
+STALE_DAYS = 14
+DEFAULT_REUSE_THRESHOLD = 0.45
+DEFAULT_EXTEND_THRESHOLD = 0.22
+DEFAULT_TIE_WINDOW = 0.05
+
+
+@dataclass
+class MatchQuery:
+    source: str
+    text: str
+    workplan_id: str | None = None
+    workplan_path: str | None = None
+    tokens: set[str] = field(default_factory=set)
+
+
+@dataclass
+class Match:
+    id: str
+    score: float
+    kind: str
+    vector: str | None = None
+    owner: str | None = None
+    summary: str | None = None
+
+
+def _tokens(text: str) -> set[str]:
+    return set(TOKEN_RE.findall(text.lower()))
+
+
+def load_query_from_workplan(path: Path) -> MatchQuery:
+    text = path.read_text(encoding="utf-8")
+    match = re.match(r"^---\n(.*?)\n---\n?(.*)$", text, re.DOTALL)
+    if not match:
+        raise ValueError(f"{path}: missing YAML front matter")
+    front = yaml.safe_load(match.group(1)) or {}
+    body = match.group(2)
+
+    parts = [str(front.get("title") or front.get("id") or path.stem)]
+    for heading in ("Core Idea", "Problem statement", "One-liner"):
+        section = re.search(
+            rf"^##\s+{re.escape(heading)}\s*\n(.*?)(?:\n##\s|\Z)",
+            body,
+            re.DOTALL | re.MULTILINE,
+        )
+        if section:
+            parts.append(section.group(1).strip())
+    if len(parts) == 1:
+        intro = body.strip().split("\n\n", 1)[0]
+        parts.append(intro)
+
+    blob = "\n".join(p for p in parts if p)
+    return MatchQuery(
+        source="workplan",
+        text=blob,
+        workplan_id=front.get("id"),
+        workplan_path=str(path),
+        tokens=_tokens(blob),
+    )
+
+
+def load_query_from_intent(intent: str) -> MatchQuery:
+    return MatchQuery(source="intent", text=intent, tokens=_tokens(intent))
+
+
+def _federated_entry_blob(item: dict[str, Any]) -> str:
+    parts = [
+        item.get("name", ""),
+        item.get("summary", ""),
+        " ".join(item.get("tags", [])),
+    ]
+    return " ".join(str(p) for p in parts if p)
+
+
+def load_federated_capabilities() -> tuple[list[dict[str, Any]], str | None]:
+    """Returns (capabilities, updated_date). Falls back to the local index
+    if the composed federated index doesn't exist yet."""
+    if FEDERATED_INDEX_PATH.exists():
+        data = yaml.safe_load(FEDERATED_INDEX_PATH.read_text(encoding="utf-8"))
+        return data.get("capabilities", []), data.get("updated")
+    data = load_index()
+    return data.get("capabilities", []), data.get("updated")
+
+
+def _staleness_warning(updated: str | None) -> str | None:
+    if not updated:
+        return None
+    try:
+        updated_date = datetime.strptime(updated, "%Y-%m-%d").replace(
+            tzinfo=timezone.utc
+        )
+    except ValueError:
+        return None
+    age_days = (datetime.now(timezone.utc) - updated_date).days
+    if age_days > STALE_DAYS:
+        return f"federated index is {age_days} days old (last composed {updated})"
+    return None
+
+
+def _vector_rank(vector: str | None) -> tuple[int, int]:
+    """Higher discovery/availability levels rank first among near-tied scores."""
+    if not vector:
+        return (0, 0)
+    m = re.match(r"D(\d+)\s*/\s*A(\d+)", vector)
+    if not m:
+        return (0, 0)
+    return (int(m.group(1)), int(m.group(2)))
+
+
+def match_query(
+    query: MatchQuery,
+    capabilities: list[dict[str, Any]],
+    *,
+    tie_window: float = DEFAULT_TIE_WINDOW,
+) -> list[Match]:
+    if not query.tokens or not capabilities:
+        return []
+
+    scored: list[Match] = []
+    for item in capabilities:
+        blob = _federated_entry_blob(item)
+        tokens = _tokens(blob)
+        if not tokens:
+            continue
+        score = len(query.tokens & tokens) / len(query.tokens | tokens)
+        if score <= 0:
+            continue
+        scored.append(
+            Match(
+                id=item["id"],
+                score=round(score, 4),
+                kind="deterministic",
+                vector=item.get("vector"),
+                owner=item.get("owner"),
+                summary=item.get("summary"),
+            )
+        )
+
+    if not scored:
+        return []
+
+    scored.sort(key=lambda m: m.score, reverse=True)
+    top_score = scored[0].score
+    tied = [m for m in scored if top_score - m.score <= tie_window]
+    rest = [m for m in scored if top_score - m.score > tie_window]
+    tied.sort(key=lambda m: (_vector_rank(m.vector), m.score), reverse=True)
+    return tied + rest
+
+
+def verdict_for_score(
+    top_score: float,
+    *,
+    reuse_threshold: float = DEFAULT_REUSE_THRESHOLD,
+    extend_threshold: float = DEFAULT_EXTEND_THRESHOLD,
+) -> str:
+    if top_score >= reuse_threshold:
+        return "reuse"
+    if top_score >= extend_threshold:
+        return "extend"
+    return "new"
+
+
+def run_plan_check(
+    query: MatchQuery,
+    *,
+    reuse_threshold: float = DEFAULT_REUSE_THRESHOLD,
+    extend_threshold: float = DEFAULT_EXTEND_THRESHOLD,
+    tie_window: float = DEFAULT_TIE_WINDOW,
+    top_n: int = 5,
+) -> dict[str, Any]:
+    capabilities, updated = load_federated_capabilities()
+    matches = match_query(query, capabilities, tie_window=tie_window)
+    top_score = matches[0].score if matches else 0.0
+    verdict = verdict_for_score(
+        top_score, reuse_threshold=reuse_threshold, extend_threshold=extend_threshold
+    )
+    return {
+        "query": {
+            "source": query.source,
+            "text": query.text,
+            "workplan_id": query.workplan_id,
+            "workplan_path": query.workplan_path,
+        },
+        "verdict": verdict,
+        "top_score": top_score,
+        "matches": [
+            {
+                "id": m.id,
+                "score": m.score,
+                "vector": m.vector,
+                "owner": m.owner,
+                "summary": m.summary,
+                "kind": m.kind,
+            }
+            for m in matches[:top_n]
+        ],
+        "federated_index_updated": updated,
+        "federated_index_stale_warning": _staleness_warning(updated),
+    }
+
+
+def format_plan_check_markdown(result: dict[str, Any]) -> str:
+    lines = [f"# Plan check: {result['verdict']}", ""]
+    query = result["query"]
+    label = query.get("workplan_id") or query["text"][:80]
+    lines.append(f"**Query ({query['source']}):** {label}")
+    lines.append("")
+
+    matches = result.get("matches", [])
+    if matches:
+        lines.append("## Matches")
+        for m in matches:
+            vec = f" ({m['vector']})" if m.get("vector") else ""
+            owner = f" — {m['owner']}" if m.get("owner") else ""
+            lines.append(f"- `{m['id']}`{vec}{owner} — score {m['score']:.2f} [{m['kind']}]")
+            if m.get("summary"):
+                lines.append(f"  > {m['summary']}")
+    else:
+        lines.append("_No matches found in the federated index._")
+    lines.append("")
+
+    verdict = result["verdict"]
+    if verdict == "reuse":
+        lines.append("**Verdict: REUSE** — an existing capability already covers this; link it instead of building new.")
+    elif verdict == "extend":
+        lines.append("**Verdict: EXTEND** — scope overlaps closely enough that extending the top match is likely cheaper than a new capability.")
+    else:
+        lines.append("**Verdict: NEW** — no close match in the federated index; proceed.")
+
+    warning = result.get("federated_index_stale_warning")
+    if warning:
+        lines.append("")
+        lines.append(f"⚠ {warning}")
+
+    return "\n".join(lines) + "\n"
+
+
+def format_plan_check_json(result: dict[str, Any]) -> str:
+    return json.dumps(result, indent=2, sort_keys=True)
+
+
+def maybe_file_capability_request(
+    result: dict[str, Any],
+    *,
+    requesting_domain: str,
+    requesting_agent: str,
+) -> dict[str, Any] | None:
+    """On a 'new' verdict, file a State Hub capability request for the gap.
+    Returns None (and does nothing) for any other verdict, or if the hub is
+    unreachable -- this never blocks plan-check's primary output."""
+    if result["verdict"] != "new":
+        return None
+    query = result["query"]
+    title = (query.get("workplan_id") or query["text"])[:120]
+    return file_capability_request(
+        title=f"plan-check gap: {title}",
+        description=query["text"],
+        requesting_domain=requesting_domain,
+        requesting_agent=requesting_agent,
+        requesting_workplan_id=query.get("workplan_id"),
+    )
+
+
+def record_outcome(
+    result: dict[str, Any],
+    outcome: str,
+    *,
+    consumer_repo: str = "reuse-surface",
+) -> Path:
+    TELEMETRY_PATH.parent.mkdir(parents=True, exist_ok=True)
+    top_match = result["matches"][0]["id"] if result.get("matches") else None
+    event = {
+        "ts": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+        "consumer_repo": consumer_repo,
+        "capability_id": top_match,
+        "verdict": result["verdict"],
+        "outcome": outcome,
+        "source": "plan-check",
+    }
+    with TELEMETRY_PATH.open("a", encoding="utf-8") as handle:
+        handle.write(json.dumps(event, sort_keys=True) + "\n")
+    return TELEMETRY_PATH
--- a/reuse_surface/reports.py
+++ b/reuse_surface/reports.py
@@ -110,6 +110,9 @@ def collect_gap_report(
        r for r in repos
        if r.get("status") == "established" and r.get("capability_count", 0) == 0
    ]
+    unclassified = [r for r in empty_scaffolds if r.get("capability_status", "pending") == "pending"]
+    explicit_none = [r for r in empty_scaffolds if r.get("capability_status") == "none"]
+    covered = [r for r in repos if r.get("capability_status") in ("has", "none")]
    seeded = [r for r in repos if r.get("seed_from_reuse_surface")]
    dedup_pending = [
        {
@@ -133,6 +136,11 @@ def collect_gap_report(
        ],
        "empty_scaffold_count": len(empty_scaffolds),
        "empty_scaffolds": [r["slug"] for r in empty_scaffolds],
+        "unclassified_count": len(unclassified),
+        "unclassified": [r["slug"] for r in unclassified],
+        "explicit_none_count": len(explicit_none),
+        "explicit_none": [r["slug"] for r in explicit_none],
+        "coverage_ratio": f"{len(covered)}/{len(repos)}" if repos else "0/0",
        "seeded_repos": [
            {
                "slug": r["slug"],
@@ -180,11 +188,23 @@ def format_gap_markdown(report: dict[str, Any]) -> str:
        lines.append("- none (owner rows migrated to canonical repos)")
    lines.append("")

-    empty_count = report.get("empty_scaffold_count", 0)
-    lines.append(f"## Empty scaffolds ({empty_count})")
-    slugs = report.get("empty_scaffolds", [])
-    if slugs:
-        for slug in slugs:
+    lines.append(f"**Capability coverage:** {report.get('coverage_ratio', '?')} "
+                 "(repos with a capability or an explicit no-capability marker)")
+    lines.append("")
+
+    unclassified = report.get("unclassified", [])
+    lines.append(f"## Unclassified scaffolds ({report.get('unclassified_count', len(unclassified))})")
+    if unclassified:
+        for slug in unclassified:
+            lines.append(f"- `{slug}`")
+    else:
+        lines.append("- none")
+    lines.append("")
+
+    explicit_none = report.get("explicit_none", [])
+    lines.append(f"## Explicitly no-capability ({report.get('explicit_none_count', len(explicit_none))})")
+    if explicit_none:
+        for slug in explicit_none:
            lines.append(f"- `{slug}`")
    else:
        lines.append("- none")
--- a/reuse_surface/statehub_bridge.py
+++ b/reuse_surface/statehub_bridge.py
@@ -0,0 +1,103 @@
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.parse
+import urllib.request
+from typing import Any
+
+DEFAULT_BASE_URL = "http://127.0.0.1:8000"
+TIMEOUT_SECONDS = 5
+LIST_TIMEOUT_SECONDS = 20
+
+# Observed status vocabulary (2026-07): "requested", "completed". No fixed
+# enum is published by the API (free-form string field) -- treat anything
+# not in this terminal set as still-open rather than assuming a closed list.
+TERMINAL_STATUSES = {"completed", "cancelled", "rejected", "resolved", "closed"}
+
+
+def _request(
+    method: str,
+    path: str,
+    base_url: str,
+    *,
+    body: dict[str, Any] | None = None,
+    params: dict[str, str] | None = None,
+    timeout: int = TIMEOUT_SECONDS,
+) -> dict[str, Any] | list[Any]:
+    url = f"{base_url.rstrip('/')}{path}"
+    if params:
+        query = "&".join(
+            f"{k}={urllib.parse.quote(v)}" for k, v in params.items() if v
+        )
+        if query:
+            url = f"{url}?{query}"
+    data = json.dumps(body).encode("utf-8") if body is not None else None
+    request = urllib.request.Request(
+        url,
+        data=data,
+        method=method,
+        headers={"Content-Type": "application/json", "User-Agent": "reuse-surface/0.1"},
+    )
+    with urllib.request.urlopen(request, timeout=timeout) as response:
+        return json.loads(response.read().decode("utf-8"))
+
+
+def state_hub_reachable(base_url: str = DEFAULT_BASE_URL) -> bool:
+    try:
+        _request("GET", "/state/health", base_url)
+        return True
+    except (urllib.error.URLError, TimeoutError, OSError):
+        return False
+
+
+def file_capability_request(
+    *,
+    title: str,
+    description: str,
+    requesting_domain: str,
+    requesting_agent: str,
+    capability_type: str = "reuse-surface-new-verdict",
+    requesting_workplan_id: str | None = None,
+    base_url: str = DEFAULT_BASE_URL,
+) -> dict[str, Any] | None:
+    """Files a State Hub capability request for a plan-check 'new' verdict.
+
+    Returns the created request record, or None if the hub is unreachable
+    (degrades gracefully -- plan-check never blocks on this)."""
+    if not state_hub_reachable(base_url):
+        return None
+    body = {
+        "title": title,
+        "description": description,
+        "capability_type": capability_type,
+        "requesting_domain": requesting_domain,
+        "requesting_agent": requesting_agent,
+        "requesting_workplan_id": requesting_workplan_id,
+    }
+    try:
+        return _request("POST", "/capability-requests/", base_url, body=body)
+    except (urllib.error.URLError, TimeoutError, OSError):
+        return None
+
+
+def list_open_capability_requests(
+    base_url: str = DEFAULT_BASE_URL,
+) -> list[dict[str, Any]] | None:
+    """Returns capability requests whose status is not terminal (see
+    TERMINAL_STATUSES), or None if the hub is unreachable. A request can
+    carry a catalog_entry_id while still 'requested' (routed, not
+    fulfilled), so status -- not catalog_entry_id presence -- is the open
+    signal. The list endpoint can be slow (observed ~7s with a handful of
+    rows); a longer timeout than the health check is used deliberately."""
+    if not state_hub_reachable(base_url):
+        return None
+    try:
+        requests_ = _request(
+            "GET", "/capability-requests/", base_url, timeout=LIST_TIMEOUT_SECONDS
+        )
+    except (urllib.error.URLError, TimeoutError, OSError):
+        return None
+    if not isinstance(requests_, list):
+        return []
+    return [r for r in requests_ if r.get("status") not in TERMINAL_STATUSES]
--- a/schemas/plan-check-result.schema.json
+++ b/schemas/plan-check-result.schema.json
@@ -0,0 +1,54 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://reuse-surface.local/schemas/plan-check-result.schema.json",
+  "title": "PlanCheckResult",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["query", "verdict", "top_score", "matches"],
+  "properties": {
+    "query": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "text"],
+      "properties": {
+        "source": {"type": "string", "enum": ["workplan", "intent"]},
+        "text": {"type": "string", "minLength": 1},
+        "workplan_id": {"type": ["string", "null"]},
+        "workplan_path": {"type": ["string", "null"]}
+      }
+    },
+    "verdict": {
+      "type": "string",
+      "enum": ["reuse", "extend", "new"]
+    },
+    "top_score": {
+      "type": "number",
+      "minimum": 0,
+      "maximum": 1
+    },
+    "matches": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "score", "kind"],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^capability\\.[a-z0-9]+(\\.[a-z0-9-]+)+$"
+          },
+          "score": {"type": "number", "minimum": 0, "maximum": 1},
+          "vector": {"type": ["string", "null"]},
+          "owner": {"type": ["string", "null"]},
+          "summary": {"type": ["string", "null"]},
+          "kind": {
+            "type": "string",
+            "enum": ["deterministic", "llm", "related"]
+          }
+        }
+      }
+    },
+    "federated_index_updated": {"type": ["string", "null"]},
+    "federated_index_stale_warning": {"type": ["string", "null"]}
+  }
+}
--- a/schemas/reuse-event.schema.json
+++ b/schemas/reuse-event.schema.json
@@ -0,0 +1,29 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://reuse-surface.local/schemas/reuse-event.schema.json",
+  "title": "ReuseEvent",
+  "description": "One line of registry/telemetry/plan-check-events.jsonl, or one POST /v1/reuse-events body (REUSE-WP-0019-T04). Shared schema so plan-check's local fallback and the hub's telemetry store never diverge.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["ts", "consumer_repo", "verdict", "source"],
+  "properties": {
+    "ts": {"type": "string", "format": "date-time"},
+    "consumer_repo": {"type": "string", "minLength": 1},
+    "capability_id": {
+      "type": ["string", "null"],
+      "pattern": "^capability\\.[a-z0-9]+(\\.[a-z0-9-]+)+$"
+    },
+    "verdict": {
+      "type": "string",
+      "enum": ["reuse", "extend", "new"]
+    },
+    "outcome": {
+      "type": ["string", "null"],
+      "enum": ["reused", "extended", "new", "skipped", null]
+    },
+    "source": {
+      "type": "string",
+      "enum": ["plan-check", "manual", "hub"]
+    }
+  }
+}
--- a/specs/PlanCheck.md
+++ b/specs/PlanCheck.md
@@ -0,0 +1,169 @@
+# Plan Check
+
+**Repository:** `reuse-surface`
+**Artifact:** `specs/PlanCheck.md`
+**Status:** Draft 0.1 (REUSE-WP-0018-T01)
+**Schema:** `schemas/plan-check-result.schema.json`
+
+---
+
+## 1. Purpose
+
+`plan-check` closes the consumption loop the registry has lacked since
+inception: nothing today nudges an agent planning work in a sibling repo to
+query the federated capability index before building. The registry has been
+write-mostly. `plan-check` is the query-before-build step — advisory, not a
+gate — that matches a draft workplan or a free-text intent against the
+federated index and returns a verdict: reuse it, extend it, or it's genuinely
+new.
+
+This spec covers the deterministic matching core (T02) and its interfaces
+with the optional LLM rerank (T03) and the State Hub capability-request
+bridge (T04). It does not cover the ecosystem rollout (T05) — the
+session-protocol convention is designed once this spec is implemented and
+dogfooded in this repo.
+
+## 2. Design principles
+
+1. **Deterministic core, LLM assist optional.** Keyword/scope/relation
+   matching against `registry/indexes/federated.yaml` works with no external
+   dependency. `LLM_CONNECT_URL` unlocks a semantic rerank pass; its absence
+   degrades gracefully, never blocks.
+2. **Advisory, not blocking.** `plan-check` never fails a workplan into
+   existence or refuses to let one be created. Adoption comes from the tool
+   being useful and from convention (REUSE-WP-0018-T05), not from a gate.
+3. **Deterministic matches always rank first.** Whatever the LLM rerank
+   proposes, it is listed after — and clearly labeled apart from — the
+   deterministic candidates, so a human or agent can trust the base result
+   even with `--no-llm`.
+4. **Every invocation is a data point.** `--record-outcome` writes an
+   append-only fact. This is the raw material for REUSE-WP-0019's reuse
+   telemetry — `plan-check` and telemetry share one event schema from day
+   one so nothing needs migrating later.
+
+## 3. Input model
+
+Two input shapes, mutually exclusive:
+
+| Input | How it's read |
+|---|---|
+| Workplan file | Parsed like `registry_update.py`'s git-diff signal collector: YAML frontmatter (`---`-delimited) plus the Markdown body. `title`, the one-liner in the intro paragraph, and any `## Problem statement` / `## Core Idea` heading content feed the match blob. |
+| `--intent "free text"` | Used verbatim as the match blob. |
+
+Both normalize to the same internal `MatchQuery { text: str, tokens: set[str] }`
+before matching — the matcher does not care which input shape it came from.
+
+## 4. Matching pipeline
+
+Reuses the token-Jaccard approach already proven in `overlaps.py`
+(`TOKEN_RE`, `_tokens`) rather than inventing a second scoring method in the
+same codebase:
+
+1. **Tokenize** the query blob with the existing `TOKEN_RE`.
+2. **Score** against every federated capability's blob (`name` + `summary` +
+   `tags` + `discovery.intent` + `discovery.includes`, mirroring
+   `overlaps._entry_blob`) via Jaccard similarity.
+3. **Rank signal, not just tie-break:** among candidates within
+   `--tie-window` (default 0.05) of the top score, prefer the entry with the
+   higher discovery/availability vector (a more mature capability is a safer
+   reuse bet at equal textual match).
+4. **Relation expansion:** if a top candidate has `relations.supports` or
+   `relations.related_to` entries, surface them as secondary candidates
+   labeled `related` rather than silently dropped.
+
+## 5. Verdict model
+
+| Verdict | Condition | Meaning |
+|---|---|---|
+| `reuse` | top score ≥ `--reuse-threshold` (default 0.45) | An existing capability already covers this need — link it, don't rebuild it. |
+| `extend` | top score in `[--extend-threshold, --reuse-threshold)` (default 0.22–0.45) | Scope overlaps a capability closely enough that extending it is very likely cheaper than a new one — surfaced with an explicit "consider extending" framing. |
+| `new` | top score < `--extend-threshold`, or no federated capabilities exist | No good match. Proceed; optionally file a capability request (T04). |
+
+Thresholds are CLI flags, not hardcoded, because the right cutoff will drift
+as coverage and entry quality improve (see REUSE-WP-0017). Defaults come from
+the same threshold reasoning as `overlaps.py`'s `--threshold 0.28` default,
+shifted since plan-check matches short intent text against short summaries
+rather than long entry-to-entry blobs.
+
+## 6. Output
+
+### Markdown (TTY default)
+
+```text
+# Plan check: reuse | extend | new
+
+**Query:** <workplan title or intent text>
+
+## Top match
+- `capability.infotech.issue-tracking` (score 0.52, D4/A2/C2/R1) — issue-core
+  > Unified Python/CLI interface for issue tracking across Gitea, GitHub, and GitLab...
+
+## Other candidates
+- ...
+
+## Related (via relations.*)
+- ...
+
+Verdict: REUSE — link this capability instead of building new.
+```
+
+### JSON (`--format json`, agent-consumable)
+
+Validated against `schemas/plan-check-result.schema.json`:
+
+```json
+{
+  "query": {"source": "workplan|intent", "text": "...", "workplan_id": "..."},
+  "verdict": "reuse|extend|new",
+  "top_score": 0.52,
+  "matches": [
+    {"id": "capability.infotech.issue-tracking", "score": 0.52, "vector": "D4/A2/C2/R1", "owner": "issue-core", "kind": "deterministic|llm|related"}
+  ],
+  "federated_index_updated": "2026-07-06",
+  "federated_index_stale_warning": null
+}
+```
+
+`federated_index_stale_warning` is set when `federated.yaml`'s `updated`
+field is older than 14 days — a cheap freshness signal until
+REUSE-WP-0019's automatic recompose lands.
+
+## 7. Outcome recording (`--record-outcome`)
+
+Append-only JSONL under `registry/telemetry/plan-check-events.jsonl`
+(reuse-surface's own copy; sibling repos get their own via the same schema
+when they adopt T05). One line per invocation:
+
+```json
+{"ts": "2026-07-07T10:00:00Z", "consumer_repo": "reuse-surface", "capability_id": "capability.infotech.issue-tracking", "verdict": "reuse", "outcome": "reused|extended|new|skipped", "source": "plan-check"}
+```
+
+This schema is deliberately identical to the reuse-event schema
+REUSE-WP-0019-T04 will implement server-side — `plan-check`'s local JSONL
+file is the fallback path when the hub is unreachable, and the same record
+shape posts to `POST /v1/reuse-events` once T04/WP-0019 exist. No local
+telemetry write ever blocks the primary command.
+
+## 8. Relationship to T03 (LLM rerank) and T04 (State Hub bridge)
+
+- **T03** adds an optional post-pass: send the deterministic top-N candidates
+  plus the query text to `llm-connect` for a semantic confidence score and
+  possible reordering *within* the deterministic candidate set. It does not
+  invent new candidates outside what deterministic matching already found —
+  keeps the "deterministic matches always rank first" guarantee simple to
+  reason about. Schema-constrained JSON response, mirrors the
+  `maintain_llm.py` pattern (graceful skip on missing `LLM_CONNECT_URL`,
+  reject malformed responses rather than guess).
+- **T04** wires `new` verdicts to `POST /messages/` (State Hub
+  `request_capability`-equivalent) and reads back open capability requests
+  for `report gaps` to list unmatched. Deferred to its own task since it
+  depends on State Hub API shapes this spec does not need to pin down yet.
+
+## 9. Non-goals
+
+- Blocking or gating workplan creation (§2.2).
+- Embedding-based / vector-similarity matching — token-Jaccard is the
+  deterministic core for consistency with `overlaps.py`; embeddings are an
+  LLM-rerank concern (T03), not a second deterministic path.
+- Editing sibling repos' rules files directly — that's the template
+  propagation mechanism's job (T05), not this tool's.
--- a/templates/NO_CAPABILITIES.template.md
+++ b/templates/NO_CAPABILITIES.template.md
@@ -0,0 +1,24 @@
+---
+# Copy this file to registry/NO_CAPABILITIES.md in the target repo.
+# It marks the repo as reviewed with no reusable capability to register,
+# converting an "empty scaffold" from ambiguous to informative.
+repo: <slug>
+reason: >
+  One or two sentences on why this repo has nothing to register — e.g.
+  personal experiment, fork with no independent scope, docs/canon-only,
+  probe/spike not intended for reuse.
+reviewed: "YYYY-MM-DD"
+reviewed_by: <person-or-agent>
+revisit: >
+  Optional. Note a condition or date under which this repo should be
+  reclassified (e.g. "revisit if the probe becomes a maintained service").
+---
+
+# No reusable capability
+
+This repo was reviewed for the `reuse-surface` capability registry
+(REUSE-WP-0017 coverage campaign) and has no capability to register at this
+time. See the `reason` field above.
+
+Set `capability_status: none` for this repo's row in
+`local-repo-roster.yaml` when this file lands.
--- a/tests/test_plan_check.py
+++ b/tests/test_plan_check.py
@@ -0,0 +1,198 @@
+from __future__ import annotations
+
+import json
+
+from reuse_surface.plan_check import (
+    MatchQuery,
+    load_query_from_intent,
+    load_query_from_workplan,
+    maybe_file_capability_request,
+    match_query,
+    record_outcome,
+    run_plan_check,
+    verdict_for_score,
+)
+
+SAMPLE_CAPABILITIES = [
+    {
+        "id": "capability.infotech.issue-tracking",
+        "name": "Universal Issue Tracking Coordination",
+        "summary": "Unified interface for issue tracking coordination across Gitea, GitHub, GitLab.",
+        "vector": "D4 / A2 / C2 / R1",
+        "owner": "issue-core",
+        "tags": ["issue-tracking", "coordination"],
+    },
+    {
+        "id": "capability.audit.event-retain",
+        "name": "Audit Event Retention",
+        "summary": "Collect, normalize, retain, and search audit events with integrity evidence across tenants.",
+        "vector": "D4 / A2 / C2 / R1",
+        "owner": "audit-core",
+        "tags": ["audit"],
+    },
+]
+
+
+def test_verdict_thresholds():
+    assert verdict_for_score(0.5) == "reuse"
+    assert verdict_for_score(0.3) == "extend"
+    assert verdict_for_score(0.1) == "new"
+    assert verdict_for_score(0.45) == "reuse"
+    assert verdict_for_score(0.22) == "extend"
+
+
+def test_match_query_finds_close_match():
+    query = load_query_from_intent(
+        "unified issue tracking coordination across Gitea GitHub GitLab"
+    )
+    matches = match_query(query, SAMPLE_CAPABILITIES)
+    assert matches
+    assert matches[0].id == "capability.infotech.issue-tracking"
+    assert matches[0].score > 0.3
+
+
+def test_match_query_empty_when_no_overlap():
+    query = load_query_from_intent("something entirely unrelated xyzzy plugh")
+    matches = match_query(query, SAMPLE_CAPABILITIES)
+    assert matches == []
+
+
+def test_match_query_no_capabilities():
+    query = load_query_from_intent("anything")
+    assert match_query(query, []) == []
+
+
+def test_load_query_from_workplan(tmp_path):
+    workplan = tmp_path / "TEST-WP-0001-thing.md"
+    workplan.write_text(
+        """---
+id: TEST-WP-0001
+title: "Unified issue tracking coordination"
+status: proposed
+---
+
+# Unified issue tracking coordination
+
+## Core Idea
+
+Build a single interface for issue tracking across Gitea, GitHub, and GitLab.
+"""
+    )
+    query = load_query_from_workplan(workplan)
+    assert query.source == "workplan"
+    assert query.workplan_id == "TEST-WP-0001"
+    assert "issue tracking" in query.text.lower()
+    matches = match_query(query, SAMPLE_CAPABILITIES)
+    assert matches[0].id == "capability.infotech.issue-tracking"
+
+
+def test_run_plan_check_reuse_verdict(monkeypatch):
+    monkeypatch.setattr(
+        "reuse_surface.plan_check.load_federated_capabilities",
+        lambda: (SAMPLE_CAPABILITIES, "2026-07-06"),
+    )
+    query = MatchQuery(
+        source="intent",
+        text="unified issue tracking coordination gitea github gitlab",
+        tokens={"unified", "issue", "tracking", "coordination", "gitea", "github", "gitlab"},
+    )
+    result = run_plan_check(query)
+    assert result["verdict"] == "reuse"
+    assert result["matches"][0]["id"] == "capability.infotech.issue-tracking"
+    assert result["federated_index_stale_warning"] is None
+
+
+def test_run_plan_check_stale_warning(monkeypatch):
+    monkeypatch.setattr(
+        "reuse_surface.plan_check.load_federated_capabilities",
+        lambda: (SAMPLE_CAPABILITIES, "2020-01-01"),
+    )
+    query = load_query_from_intent("nothing matches this at all zzz")
+    result = run_plan_check(query)
+    assert result["verdict"] == "new"
+    assert "days old" in result["federated_index_stale_warning"]
+
+
+def test_record_outcome_appends_jsonl(tmp_path, monkeypatch):
+    telemetry_path = tmp_path / "plan-check-events.jsonl"
+    monkeypatch.setattr("reuse_surface.plan_check.TELEMETRY_PATH", telemetry_path)
+    result = {
+        "verdict": "reuse",
+        "matches": [{"id": "capability.infotech.issue-tracking"}],
+    }
+    record_outcome(result, "reused", consumer_repo="some-repo")
+    lines = telemetry_path.read_text().splitlines()
+    assert len(lines) == 1
+    event = json.loads(lines[0])
+    assert event["consumer_repo"] == "some-repo"
+    assert event["capability_id"] == "capability.infotech.issue-tracking"
+    assert event["outcome"] == "reused"
+    assert event["source"] == "plan-check"
+
+
+def test_maybe_file_capability_request_only_on_new_verdict(monkeypatch):
+    called = []
+    monkeypatch.setattr(
+        "reuse_surface.plan_check.file_capability_request",
+        lambda **kwargs: called.append(kwargs) or {"id": "req-1"},
+    )
+    reuse_result = {"verdict": "reuse", "query": {"text": "x", "workplan_id": None}}
+    assert maybe_file_capability_request(
+        reuse_result, requesting_domain="infotech", requesting_agent="a"
+    ) is None
+    assert called == []
+
+    new_result = {"verdict": "new", "query": {"text": "some new intent", "workplan_id": None}}
+    filed = maybe_file_capability_request(
+        new_result, requesting_domain="infotech", requesting_agent="a"
+    )
+    assert filed == {"id": "req-1"}
+    assert called[0]["requesting_domain"] == "infotech"
+
+
+def test_cmd_plan_check_file_request_flag(monkeypatch):
+    from reuse_surface.cli import main
+
+    monkeypatch.setattr(
+        "reuse_surface.plan_check.load_federated_capabilities",
+        lambda: (SAMPLE_CAPABILITIES, "2026-07-06"),
+    )
+    filed_calls = []
+    monkeypatch.setattr(
+        "reuse_surface.cli.maybe_file_capability_request",
+        lambda result, **kwargs: filed_calls.append(kwargs) or {"id": "req-9"},
+    )
+    exit_code = main(
+        ["plan-check", "--intent", "totally unrelated xyzzy plugh", "--file-request"]
+    )
+    assert exit_code == 0
+    assert filed_calls
+
+
+def test_cmd_plan_check_intent_json(monkeypatch):
+    from reuse_surface.cli import main
+
+    monkeypatch.setattr(
+        "reuse_surface.plan_check.load_federated_capabilities",
+        lambda: (SAMPLE_CAPABILITIES, "2026-07-06"),
+    )
+    exit_code = main(
+        ["plan-check", "--intent", "issue tracking gitea github gitlab", "--format", "json"]
+    )
+    assert exit_code == 0
+
+
+def test_cmd_plan_check_requires_input():
+    from reuse_surface.cli import main
+
+    exit_code = main(["plan-check"])
+    assert exit_code == 1
+
+
+def test_cmd_plan_check_rejects_both_inputs(tmp_path):
+    from reuse_surface.cli import main
+
+    workplan = tmp_path / "x.md"
+    workplan.write_text("---\nid: X\n---\nbody")
+    exit_code = main(["plan-check", str(workplan), "--intent", "also this"])
+    assert exit_code == 1
--- a/tests/test_reports.py
+++ b/tests/test_reports.py
@@ -96,9 +96,38 @@ def test_collect_gap_report_from_roster():
    root = Path(__file__).resolve().parent.parent
    roster = root / "registry/federation/local-repo-roster.yaml"
    report = collect_gap_report(roster)
-    assert report["summary"]["total"] == 60
+    assert report["summary"]["total"] == 61
    assert len(report["publish_fail"]) == 0
-    assert report["empty_scaffold_count"] >= 40
+    assert report["unclassified_count"] + report["explicit_none_count"] == report["empty_scaffold_count"]
+    assert "/" in report["coverage_ratio"]
+
+
+def test_collect_gap_report_splits_unclassified_and_explicit_none(tmp_path):
+    roster_path = tmp_path / "roster.yaml"
+    roster_path.write_text(
+        """
+summary:
+  total: 3
+repos:
+- slug: has-repo
+  status: established
+  capability_count: 1
+  capability_status: has
+- slug: none-repo
+  status: established
+  capability_count: 0
+  capability_status: none
+- slug: pending-repo
+  status: established
+  capability_count: 0
+  capability_status: pending
+"""
+    )
+    report = collect_gap_report(roster_path, index={"capabilities": []})
+    assert report["unclassified"] == ["pending-repo"]
+    assert report["explicit_none"] == ["none-repo"]
+    assert report["empty_scaffold_count"] == 2
+    assert report["coverage_ratio"] == "2/3"


 def test_format_gap_markdown_lists_publish_fail():
@@ -108,6 +137,11 @@ def test_format_gap_markdown_lists_publish_fail():
        "publish_fail": [{"slug": "inter-hub", "publish_note": "missing repo"}],
        "empty_scaffold_count": 1,
        "empty_scaffolds": ["ops-bridge"],
+        "unclassified_count": 1,
+        "unclassified": ["ops-bridge"],
+        "explicit_none_count": 0,
+        "explicit_none": [],
+        "coverage_ratio": "59/60",
        "seeded_repos": [],
        "dedup_pending_local_owners": [],
        "local_capability_count": 2,
@@ -124,6 +158,29 @@ def test_cmd_report_gaps_json(monkeypatch):
    assert exit_code == 0


+def test_cmd_report_gaps_check_capability_requests_unreachable(monkeypatch):
+    from reuse_surface.cli import main
+
+    monkeypatch.setattr(
+        "reuse_surface.cli.list_open_capability_requests", lambda: None
+    )
+    exit_code = main(["report", "gaps", "--check-capability-requests"])
+    assert exit_code == 0
+
+
+def test_cmd_report_gaps_check_capability_requests_json(monkeypatch):
+    from reuse_surface.cli import main
+
+    monkeypatch.setattr(
+        "reuse_surface.cli.list_open_capability_requests",
+        lambda: [{"id": "r1", "title": "Need X", "requesting_domain_slug": "infotech"}],
+    )
+    exit_code = main(
+        ["report", "gaps", "--check-capability-requests", "--format", "json"]
+    )
+    assert exit_code == 0
+
+
 def test_cmd_report_cohorts_markdown(monkeypatch):
    from reuse_surface.cli import main

--- a/tests/test_statehub_bridge.py
+++ b/tests/test_statehub_bridge.py
@@ -0,0 +1,66 @@
+from __future__ import annotations
+
+import urllib.error
+
+from reuse_surface import statehub_bridge
+
+
+def test_state_hub_reachable_true(monkeypatch):
+    monkeypatch.setattr(statehub_bridge, "_request", lambda *a, **k: {"status": "ok"})
+    assert statehub_bridge.state_hub_reachable() is True
+
+
+def test_state_hub_reachable_false_on_error(monkeypatch):
+    def raise_error(*args, **kwargs):
+        raise urllib.error.URLError("no route")
+
+    monkeypatch.setattr(statehub_bridge, "_request", raise_error)
+    assert statehub_bridge.state_hub_reachable() is False
+
+
+def test_file_capability_request_skips_when_unreachable(monkeypatch):
+    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: False)
+    result = statehub_bridge.file_capability_request(
+        title="t", description="d", requesting_domain="infotech", requesting_agent="a"
+    )
+    assert result is None
+
+
+def test_file_capability_request_posts_body(monkeypatch):
+    captured = {}
+
+    def fake_request(method, path, base_url, *, body=None, params=None, timeout=None):
+        captured["method"] = method
+        captured["path"] = path
+        captured["body"] = body
+        return {"id": "abc-123", **body}
+
+    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: True)
+    monkeypatch.setattr(statehub_bridge, "_request", fake_request)
+    result = statehub_bridge.file_capability_request(
+        title="Need X", description="desc", requesting_domain="infotech", requesting_agent="reuse-surface"
+    )
+    assert captured["method"] == "POST"
+    assert captured["path"] == "/capability-requests/"
+    assert captured["body"]["title"] == "Need X"
+    assert result["id"] == "abc-123"
+
+
+def test_list_open_capability_requests_filters_terminal_status(monkeypatch):
+    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: True)
+    monkeypatch.setattr(
+        statehub_bridge,
+        "_request",
+        lambda *a, **k: [
+            {"id": "1", "status": "requested"},
+            {"id": "2", "status": "completed"},
+            {"id": "3", "status": "requested", "catalog_entry_id": "routed-but-open"},
+        ],
+    )
+    result = statehub_bridge.list_open_capability_requests()
+    assert {r["id"] for r in result} == {"1", "3"}
+
+
+def test_list_open_capability_requests_none_when_unreachable(monkeypatch):
+    monkeypatch.setattr(statehub_bridge, "state_hub_reachable", lambda base_url=None: False)
+    assert statehub_bridge.list_open_capability_requests() is None
--- a/tests/test_stats.py
+++ b/tests/test_stats.py
@@ -29,8 +29,8 @@ def test_collect_roster_stats_federation_ready():
    root = Path(__file__).resolve().parent.parent
    roster = root / "registry/federation/local-repo-roster.yaml"
    stats = collect_roster_stats(roster, federation_ready=True)
-    assert stats["counts"]["total"] == 60
-    assert stats["counts"]["established"] == 60
+    assert stats["counts"]["total"] == 61
+    assert stats["counts"]["established"] == 61
    assert "federation_readiness" in stats
    text = format_roster_stats_markdown(stats)
    assert "publish pass ratio" in text
--- a/tools/README.md
+++ b/tools/README.md
@@ -51,6 +51,28 @@ reuse-surface overlaps
 reuse-surface overlaps --threshold 0.35
 ```

+### plan-check
+
+Query-before-build check (REUSE-WP-0018): match a draft workplan or a free
+intent against the federated capability index before starting new work.
+Deterministic token matching against `registry/indexes/federated.yaml`;
+advisory only — never blocks workplan creation. See `specs/PlanCheck.md`.
+
+```bash
+reuse-surface plan-check workplans/XXX-WP-0042-something.md
+reuse-surface plan-check --intent "parse invoices and file evidence"
+reuse-surface plan-check --intent "..." --format json
+reuse-surface plan-check --intent "..." --record-outcome reused
+reuse-surface plan-check --intent "..." --file-request --requesting-domain infotech
+```
+
+`reuse|extend|new` verdict from `--reuse-threshold`/`--extend-threshold`
+(defaults 0.45/0.22). `--record-outcome` appends to
+`registry/telemetry/plan-check-events.jsonl` (schema shared with
+REUSE-WP-0019's reuse telemetry). `--file-request` files a State Hub
+capability request on a `new` verdict (requires the hub reachable at
+`127.0.0.1:8000`; degrades gracefully offline).
+
 ### catalog

 Generate human-readable catalog artifacts (UC-RS-018).
@@ -110,8 +132,14 @@ Run the service locally: `REUSE_SURFACE_TOKEN=dev-token reuse-surface serve`
 reuse-surface report gaps
 reuse-surface report gaps --format json
 reuse-surface report gaps --roster registry/federation/local-repo-roster.yaml
+reuse-surface report gaps --check-capability-requests
 ```

+`--check-capability-requests` (REUSE-WP-0018-T04) also lists open State Hub
+capability requests with no matching federated capability; requires the hub
+reachable at `127.0.0.1:8000` and degrades gracefully (prints "skipped") when
+it isn't. Off by default so `report gaps` stays fast and offline-safe.
+
 Workstation roster report: publish blockers, empty scaffolds, seed-ready repos,
 and local index owner stubs pending dedup.

--- a/workplans/REUSE-WP-0001-statehub-bootstrap.md
+++ b/workplans/REUSE-WP-0001-statehub-bootstrap.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0001
 type: workplan
 title: "Bootstrap State Hub integration"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0002-mvp-registry-foundation.md
+++ b/workplans/REUSE-WP-0002-mvp-registry-foundation.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0002
 type: workplan
 title: "MVP registry foundation"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0003-intent-scope-gap-closure.md
+++ b/workplans/REUSE-WP-0003-intent-scope-gap-closure.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0003
 type: workplan
 title: "Close intent-scope gaps: docs, tooling, and registry growth"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0004-registry-hardening.md
+++ b/workplans/REUSE-WP-0004-registry-hardening.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0004
 type: workplan
 title: "Registry hardening: CI, overlap detection, and catalog"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0005-registry-federation.md
+++ b/workplans/REUSE-WP-0005-registry-federation.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0005
 type: workplan
 title: "Registry federation and relation graphs"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md
+++ b/workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0006
 type: workplan
 title: "Registry hygiene and coverage expansion"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0007-interactive-catalog.md
+++ b/workplans/REUSE-WP-0007-interactive-catalog.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0007
 type: workplan
 title: "Interactive capability catalog"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0008-graph-explorer.md
+++ b/workplans/REUSE-WP-0008-graph-explorer.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0008
 type: workplan
 title: "Interactive relation graph explorer"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0009-cli-hardening.md
+++ b/workplans/REUSE-WP-0009-cli-hardening.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0009
 type: workplan
 title: "CLI hardening and test suite"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0010-network-federation.md
+++ b/workplans/REUSE-WP-0010-network-federation.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0010
 type: workplan
 title: "Network federation for remote indexes"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0016-interactive-registry-maintain.md
+++ b/workplans/REUSE-WP-0016-interactive-registry-maintain.md
@@ -2,7 +2,7 @@
 id: REUSE-WP-0016
 type: workplan
 title: "Interactive registry maintain with llm-connect automation"
-domain: helix_forge
+domain: infotech
 repo: reuse-surface
 status: finished
 owner: codex
--- a/workplans/REUSE-WP-0017-capability-coverage-campaign.md
+++ b/workplans/REUSE-WP-0017-capability-coverage-campaign.md
@@ -0,0 +1,278 @@
+---
+id: REUSE-WP-0017
+type: workplan
+title: "Capability coverage campaign: seed or explicitly close all empty scaffolds"
+domain: infotech
+repo: reuse-surface
+status: active
+owner: claude-code
+topic_slug: helix-forge
+created: "2026-07-06"
+updated: "2026-07-06"
+state_hub_workstream_id: "a2d83504-fcd0-4561-8688-b77a01cb7f06"
+---
+
+# Capability coverage campaign: seed or explicitly close all empty scaffolds
+
+The federation infrastructure is complete (61/61 repos established and
+hub-registered, WP-0014/0015), but **51 of 61 roster repos publish zero
+capabilities**. The federated index carries 24 capabilities, concentrated in a
+handful of custodian-core repos. A registry that answers most queries with
+"nothing found" trains agents to stop querying — content coverage is the
+prerequisite for the consumption loop (REUSE-WP-0018) and the automation loop
+(REUSE-WP-0019).
+
+**Goal:** every roster repo either publishes ≥1 capability entry or carries an
+explicit, machine-readable `no-reusable-capability` marker with a rationale.
+"Empty" becomes informative instead of ambiguous.
+
+**Baseline:** 10/61 repos with ≥1 capability; 51 empty scaffolds; 7 seed-ready
+(gap report 2026-07-06).
+**Target:** 0 ambiguous scaffolds; coverage ratio surfaced in `report gaps`
+and CI.
+
+## Approach
+
+1. **Classify before drafting.** Sweep the 51 empty scaffolds and bucket each:
+   `has-capability` (draft entries) vs `no-capability` (mark explicitly —
+   experiments, forks, canon/docs-only repos, probes).
+2. **Draft with existing tooling.** `reuse-surface establish --discover` +
+   llm-connect per repo produces first-pass entries at honest low maturity
+   (typically D1–D2 / A0–A1); no invented evidence.
+3. **Human review gate.** Drafts land as branches/commits flagged for review;
+   nothing publishes to the federated index without a human pass (same pattern
+   as CUST-WP-0050 repo classification).
+4. **Publish + recompose.** After review: publish-check, hub state refresh,
+   `federation compose`, catalog/graph regeneration.
+
+## Dependencies
+
+| Dependency | Owner | Notes |
+|---|---|---|
+| llm-connect | llm-connect | drafting backend for `establish --discover` |
+| local-repo-roster.yaml | reuse-surface | 61-repo roster, sweep source of truth |
+| .repo-classification.yaml | the-custodian | classification signals for the no-capability bucket |
+| config-atlas publish fix | config-atlas | 303 publish blocker (T06) |
+| Sibling repo write access | Bernd | drafts commit into sibling checkouts at `~/<slug>/` |
+
+## Design decisions
+
+- **`no-capability` marker format:** a `registry/NO_CAPABILITIES.md` file with
+  frontmatter (`reason`, `reviewed`, `revisit`) in the sibling repo, plus a
+  `capability_status: none` field in the roster row. `report gaps` treats
+  marked repos as resolved, not empty.
+- **Honest maturity floor:** first-pass entries never claim above D2/A2/C2/R1
+  without cited on-disk evidence (WP-0016 evidence gates apply).
+- **Batch execution:** repos are processed in cohorts of ~10 via
+  `/ralph-workplan`; each cohort ends with validate + gap-report delta.
+
+---
+
+## Extend Gap Report And Roster For Explicit No-Capability Status
+
+```task
+id: REUSE-WP-0017-T01
+status: done
+priority: high
+state_hub_task_id: "90fe5bf2-7c03-4af5-bc4a-e5d608c7e879"
+```
+
+- Add `capability_status: has | none | pending` to roster schema and
+  `local-repo-roster.yaml` handling (default `pending` for empty scaffolds)
+- `report gaps`: split "Empty scaffolds" into "Unclassified" and
+  "Explicitly none (n)"; add a coverage ratio headline
+  (`repos with capabilities or explicit none / total`)
+- Define `registry/NO_CAPABILITIES.md` template in `templates/`
+- Pytest coverage for both report paths
+
+## Classification Sweep Of The 51 Empty Scaffolds
+
+```task
+id: REUSE-WP-0017-T02
+status: done
+priority: high
+state_hub_task_id: "17ea8783-1344-4d04-8f7f-f93859ae4a20"
+```
+
+- For each empty-scaffold repo: read INTENT/SCOPE/README + top-level layout,
+  bucket `has-capability` vs `no-capability` with a one-line rationale
+- Output: `history/2026-07-06-coverage-classification.md` table (repo, bucket,
+  rationale, candidate capability ids for the has bucket) — done, 37
+  has-capability / 13 no-capability / 0 missing
+- Cross-check against `.repo-classification.yaml` where available
+- **Human review checkpoint:** Bernd confirms the bucket split before T03/T04
+
+## Mark No-Capability Repos
+
+```task
+id: REUSE-WP-0017-T03
+status: wait
+priority: medium
+state_hub_task_id: "3465cebf-84f9-4d67-8d8a-cca9771f2f06"
+```
+
+For each confirmed `no-capability` repo:
+
+- Write `registry/NO_CAPABILITIES.md` from template into the sibling checkout — done, 13/13
+- Set `capability_status: none` in the roster — done
+- Commit in sibling repo with a uniform message referencing this workplan — done,
+  13 commits made locally; **push held back pending explicit confirmation**
+  (auto-mode declined to push to 13 sibling repos' default branches without it)
+
+## Draft Capability Entries For Has-Capability Repos
+
+```task
+id: REUSE-WP-0017-T04
+status: done
+priority: high
+state_hub_task_id: "20d67516-331b-46bd-8a90-1170139313c2"
+```
+
+**Note:** `establish --discover` requires a running `llm-connect` backend,
+which isn't up on this workstation; spinning up a new inference service was
+out of scope for this task. Entries are instead drafted directly by the
+implementing agent, grounded in each repo's actual README/docs/tests (no
+invented evidence), which better matches the "no invented evidence" design
+principle anyway.
+
+**Cohort 1 (10/37 done):** artifact-store, can-you-assist, citation-engine,
+citation-evidence, email-connect, guide-board, hub-core, info-tech-canon,
+infospace-bench, inter-hub. All validate; no overlap with the existing 24
+federated capabilities. Committed locally in each sibling repo (push held
+for T05). Coverage 24/61 -> 34/61.
+
+**Cohort 2 (20/37 done):** issue-core (migrated its existing
+`CAPABILITY-issue-tracking.yaml` into the standard registry location rather
+than drafting fresh), kaizen-agentic, key-cape, kontextual-engine,
+llm-connect, markitect-filter, markitect-main (registered honestly as a
+superseded legacy platform pointing at its three successor repos, not a
+forward-looking target), markitect-quarkdown, markitect-tool, net-kingdom.
+All validate; no overlap with existing federated capabilities. Committed
+locally (push held for T05). Coverage 34/61 -> 44/61. Also fixed a stale
+`empty_scaffold_count >= 40` test threshold in `tests/test_reports.py` —
+no longer meaningful once the coverage campaign started shrinking that
+number by design.
+
+**Cohort 3 / final (17/17 done):** open-cmis-tck, open-reuse, ops-bridge,
+phase-memory, railiance-apps, railiance-cluster, railiance-enablement,
+railiance-fabric, railiance-forge, railiance-infra, railiance-platform,
+repo-scoping, the-custodian, user-engine, vantage-point, vergabe-teilnahme,
+whynot-design. All validate; no overlap with existing federated
+capabilities. Committed locally (push held for T05). Coverage 44/61 ->
+**61/61 — full coverage, T04 complete**.
+
+Notable calls in this cohort:
+- **the-custodian**: repo root is confidential/proprietary (NDA notice in
+  its README). Entry is deliberately scoped only to the non-confidential
+  `runtime/` agent framework and `tools/` repo-classification scripts;
+  canon/memory content is explicitly excluded from the entry's `includes`
+  and called out in `consumer_guidance.not_recommended_for`.
+- **vergabe-teilnahme**: its own `SCOPE.md` is an unfilled template, so
+  discovery is honestly D1/C0 — flagged in `known_limitations` that filling
+  in SCOPE.md is the natural next step before further promotion.
+- **markitect-main** (cohort 2) and **vantage-point**/**railiance-forge**
+  patterns repeat here: several repos (open-reuse, vantage-point) have a
+  stale repo-seed-template README; SCOPE.md/INTENT.md were used as the
+  authoritative source instead, noted per-entry.
+- **railiance-enablement**, **railiance-apps**, **the-custodian**: each
+  surfaced tooling directly relevant to REUSE-WP-0019 (Forgejo promotion
+  script, forgejo-smoke.sh, patch-forgejo-remote-urls.sh) — worth cross-
+  referencing when that workplan starts its host-migration inventory (T01).
+
+- `reuse-surface establish --discover` with llm-connect per repo
+- Manual tightening: id namespace (`capability.<domain>.<verb>`), scope
+  boundary, honest vectors, relations to existing federated capabilities
+- `reuse-surface validate` + `overlaps` check per cohort (no duplicate
+  semantics vs the existing 24)
+- Drafts committed in sibling repos, flagged for human review; roster
+  `capability_status: has`
+
+## Human Review And Publish Pass
+
+```task
+id: REUSE-WP-0017-T05
+status: wait
+priority: high
+state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9"
+```
+
+- Bernd reviews drafted entries per cohort (maturity honesty, scope, ids)
+- After approval: sibling repos push; `establish --publish-check` per repo;
+  hub registrations refreshed where raw URLs changed
+- `reuse-surface federation compose` + catalog + graph regeneration in this repo
+
+## Fix config-atlas Publish Blocker
+
+```task
+id: REUSE-WP-0017-T06
+status: done
+priority: medium
+state_hub_task_id: "1a04b60a-b982-4b5f-ae20-955bc88d4204"
+```
+
+**Diagnosis complete — two separate issues, conflated in the original note:**
+
+1. **The 303 itself was not actually a live blocker.** Gitea's raw-URL
+   scheme is `/raw/main/<path>` -> 303 redirect -> `/raw/branch/main/<path>`
+   -> 200. `establish.py`'s `_probe_raw_url` uses `urllib.request.urlopen`,
+   which already follows redirects transparently (verified: HEAD request to
+   the `/raw/main/...` URL resolves to 200 today). Re-running
+   `establish --publish-check` for config-atlas now returns **PASS**. The
+   roster's `publish_check: fail` was stale data from the 2026-06-16 sweep,
+   not a reproducible current failure — corrected in the roster (publish
+   pass now 61/61).
+2. **config-atlas was never actually registered with the production hub.**
+   Diffing `https://reuse.coulomb.social/v1/federated` (60 sources) against
+   the local roster (61 repos) shows config-atlas is the only mismatch —
+   present in `sources.yaml` and locally claimed `hub_registered: true`
+   (from the config-atlas registration commit), but genuinely absent from
+   the hub. Corrected the roster's `hub_registered` to `false` for
+   config-atlas (summary count 61 -> 60) to reflect reality.
+
+**Resolved 2026-07-07.** A routing catalog entry
+(`reuse-surface-hub-write-token`) appeared in
+`~/ops-warden/registry/routing/catalog.yaml` pointing at the token's actual
+home: a Kubernetes Secret (`reuse-surface-env` in namespace `reuse` on the
+Railiance01 cluster), not an OpenBao/Vault lane. Registration was completed
+through that channel (by a separate concurrent session, not this one — this
+session verified the *result*, not the credential itself, per the
+credential-routing rule against exploring live cluster secrets directly).
+config-atlas is now present among the 61 sources at
+`https://reuse.coulomb.social/v1/federated`. Roster corrected:
+`hub_registered: true`, publish_sweep 2026-07-07.
+
+- [x] Diagnose the 303 (resolved — not a current blocker, code already follows the redirect)
+- [x] Local publish-check target: 61/61 pass
+- [x] Complete hub registration for config-atlas — done 2026-07-07, 61/61 hub-registered
+
+## Closeout: Coverage Metrics, Docs, SCOPE Update
+
+```task
+id: REUSE-WP-0017-T07
+status: wait
+priority: low
+state_hub_task_id: "24ac37bf-2509-4077-9aa3-c09a599dd644"
+```
+
+- `report gaps` shows 0 unclassified scaffolds; record final coverage ratio
+- Update `SCOPE.md` Current State (capability count, coverage), regenerate
+  `docs/CapabilityCatalog.md`, graph, search catalog
+- `history/` milestone note; progress event + fix-consistency
+
+---
+
+## Acceptance
+
+- [ ] Every roster repo is `has` or `none` — zero `pending`
+- [ ] All `none` repos carry a reviewed `registry/NO_CAPABILITIES.md`
+- [ ] Federated index capability count reflects the seeded entries; 0 collision warnings
+- [ ] 61/61 publish pass (config-atlas unblocked)
+- [ ] Coverage ratio visible in `report gaps` and CI output
+- [ ] No entry claims maturity without on-disk evidence citations
+
+## Out of scope
+
+- Consumption/plan-check tooling (REUSE-WP-0018)
+- Forgejo webhooks/automation (REUSE-WP-0019)
+- Maturity promotions beyond honest first-pass levels
+- Multi-domain federation (all entries remain `helix_forge`)
--- a/workplans/REUSE-WP-0018-plan-check-consumption-loop.md
+++ b/workplans/REUSE-WP-0018-plan-check-consumption-loop.md
@@ -0,0 +1,229 @@
+---
+id: REUSE-WP-0018
+type: workplan
+title: "plan-check: close the consumption loop for capability reuse"
+domain: infotech
+repo: reuse-surface
+status: active
+owner: claude-code
+topic_slug: helix-forge
+created: "2026-07-06"
+updated: "2026-07-06"
+state_hub_workstream_id: "cd8683ff-6e6c-4f6c-a62f-565bd55113ea"
+---
+
+# plan-check: close the consumption loop for capability reuse
+
+The registry is write-mostly: nothing nudges an agent planning work in a
+sibling repo to query the federated index before building. The State Hub has a
+`request_capability` / `list_capability_requests` flow, but it is not bridged
+to reuse-surface data. This workplan adds the **query-before-build** step to
+the ecosystem: a `plan-check` command that matches a draft workplan or intent
+text against federated capabilities, wired into every repo's session protocol,
+with a two-way bridge to State Hub capability requests.
+
+This is the highest-leverage coherence mechanism: it is what stops 61 repos
+from independently reinventing the same thing.
+
+**Depends on REUSE-WP-0017** for meaningful match rates — plan-check against a
+mostly-empty index produces noise and erodes trust. T01–T03 (design +
+implementation) can proceed in parallel with the coverage campaign; the
+ecosystem rollout (T05) waits for coverage.
+
+## Proposed CLI surface
+
+```bash
+# Match a draft workplan against the federated index
+reuse-surface plan-check workplans/XXX-WP-0042-something.md
+
+# Free-text intent
+reuse-surface plan-check --intent "parse invoices from email and file evidence"
+
+# Agent-consumable output
+reuse-surface plan-check --format json workplans/XXX-WP-0042.md
+
+# Record the outcome (feeds R-axis evidence, WP-0019)
+reuse-surface plan-check ... --record-outcome reused|extended|new
+```
+
+**Verdict classes per match:** `reuse` (capability covers the need — link it),
+`extend` (close scope — extend instead of duplicating), `new` (no match —
+proceed, optionally file a capability request). Output includes capability id,
+maturity vector, owning repo, and consumer guidance.
+
+## Design principles
+
+1. **Deterministic core, LLM assist optional** — keyword/scope/relation
+   matching against index rows works without llm-connect; semantic matching
+   via llm-connect improves recall when available (same optional-backend
+   pattern as WP-0016).
+2. **Advisory, not blocking** — plan-check informs; it never vetoes a
+   workplan. Adoption comes from usefulness plus protocol convention, not
+   gates.
+3. **One line in the session protocol** — sibling integration is a single
+   instruction in the shared `.claude/rules/` template: run plan-check before
+   creating a workplan. No per-repo bespoke wiring.
+4. **Every check is a data point** — plan-check invocations and recorded
+   outcomes are the raw material for reuse telemetry (WP-0019-T04).
+
+## Dependencies
+
+| Dependency | Owner | Notes |
+|---|---|---|
+| REUSE-WP-0017 coverage | reuse-surface | rollout gate for T05 |
+| federated.yaml freshness | reuse-surface | improved by WP-0019 auto-recompose |
+| llm-connect | llm-connect | optional semantic matching backend |
+| State Hub capability-request API | state-hub | `request_capability`, `list_capability_requests` |
+| .claude/rules template propagation | the-custodian / repo-seed | mechanism for T05 rollout |
+
+---
+
+## Design Matching Semantics And Verdict Model
+
+```task
+id: REUSE-WP-0018-T01
+status: done
+priority: high
+state_hub_task_id: "c7b3407a-2b9d-46ba-ae9c-7ab12235f0ba"
+```
+
+Design doc `specs/PlanCheck.md`:
+
+- Input model: workplan file (frontmatter + body) vs free intent text
+- Match pipeline: token/keyword scoring over id, name, scope, guidance →
+  relation expansion → optional llm-connect semantic rerank
+- Verdict thresholds and tie-breaking (maturity vector as rank signal:
+  prefer higher D/A when scopes tie)
+- JSON output schema (`schemas/plan-check-result.schema.json`)
+- Outcome-recording format (append-only JSONL under `registry/telemetry/`,
+  schema shared with WP-0019-T04)
+
+## Implement Deterministic plan-check
+
+```task
+id: REUSE-WP-0018-T02
+status: done
+priority: high
+state_hub_task_id: "24911d0e-41bc-4c8c-a39a-7dc8ec65d8c6"
+```
+
+Implemented in `reuse_surface/plan_check.py` + `plan-check` CLI command:
+
+- Reuses `overlaps.py`'s `TOKEN_RE`/Jaccard approach rather than a second
+  scoring method (per spec §4)
+- Reads `registry/indexes/federated.yaml`, falls back to the local index,
+  warns when the composed index is >14 days stale
+- Markdown (TTY default) and `--format json` (validated against
+  `schemas/plan-check-result.schema.json`)
+- 11 pytest cases: verdict thresholds, workplan-file parsing, intent-text
+  parsing, tie-window vector ranking, staleness warning, CLI wiring
+- `--record-outcome` appends to `registry/telemetry/plan-check-events.jsonl`
+  per the shared `schemas/reuse-event.schema.json` (WP-0019-T04 will post the
+  same shape to the hub)
+
+## Add llm-connect Semantic Rerank
+
+```task
+id: REUSE-WP-0018-T03
+status: todo
+priority: medium
+state_hub_task_id: "9040505a-238e-4815-ae1a-8c5f8c12afa9"
+```
+
+**Not started** — `llm-connect` is not running on this workstation
+(same gap noted in REUSE-WP-0017-T04's drafting cohorts). Deterministic
+`plan-check` (T02) is fully usable without it; this task adds the optional
+rerank on top when a backend is available.
+
+- Optional rerank/expansion stage via `LLM_CONNECT_URL` (reuse
+  `llm_bridge.py`); schema-constrained JSON, graceful skip when unset
+- Confidence surfaced per match; deterministic matches always listed first
+- Pytest with mocked llm-connect (valid + malformed responses)
+
+## Bridge State Hub Capability Requests
+
+```task
+id: REUSE-WP-0018-T04
+status: done
+priority: medium
+state_hub_task_id: "8249dca7-18ca-4150-9671-ca87e6a5ad88"
+```
+
+Implemented in `reuse_surface/statehub_bridge.py` against the live local
+State Hub HTTP API (`http://127.0.0.1:8000`, confirmed reachable):
+
+- **new → request:** `plan-check --file-request` files a State Hub
+  capability request (`POST /capability-requests/`) on a `new` verdict
+- **request → gap:** `report gaps --check-capability-requests` lists open
+  requests (`GET /capability-requests/`, filtered on `status` — a request
+  can carry a `catalog_entry_id` while still `requested`/routed, so status
+  is the correct open/closed signal, not `catalog_entry_id` presence).
+  Opt-in flag so `report gaps` stays fast and offline-safe by default
+- Both degrade to `None`/graceful-skip when the hub is unreachable; neither
+  ever blocks the primary command
+- List endpoint observed taking ~7s in production with only 5 rows; uses a
+  20s timeout distinct from the 5s health-check timeout
+- 5 pytest cases with the hub client fully mocked (never hits the network
+  in the default test run)
+- **Not done:** marking matched requests resolved with a pointer to the
+  capability id — deferred, no current caller needs it yet
+
+## Ecosystem Rollout: Session-Protocol Integration
+
+```task
+id: REUSE-WP-0018-T05
+status: wait
+priority: high
+state_hub_task_id: "c232a669-b263-4978-a8b1-3721b8bfaa68"
+```
+
+Blocked on WP-0017 coverage reaching the *published* federated index, not
+just local drafts. WP-0017-T04 has drafted entries for all 61 roster repos
+(coverage 61/61 locally), but those commits are still local-only in each
+sibling repo pending WP-0017-T05's human review and push — `federated.yaml`
+still only carries the original 24 entries. Re-check this gate once
+WP-0017-T05 pushes and recomposes.
+
+- Draft the one-line convention for the shared session-protocol/workplan
+  rules: *"Before creating a workplan, run `reuse-surface plan-check` on the
+  draft and record the verdict in the workplan frontmatter
+  (`reuse_check: reuse|extend|new — <capability-id?>`)"*
+- Coordinate propagation with the-custodian rules template mechanism
+  (fix-consistency / repo-seed) — send State Hub message to custodian agent
+- Add `reuse_check` frontmatter to this repo's workplan convention as the
+  reference implementation
+
+## Docs, CI, SCOPE
+
+```task
+id: REUSE-WP-0018-T06
+status: done
+priority: low
+state_hub_task_id: "ff0a91eb-cc41-487b-b726-8c2f84860399"
+```
+
+- `tools/README.md` command reference for `plan-check` and
+  `report gaps --check-capability-requests`; `docs/RegistryFederation.md`
+  "Query before building" consumer section; `SCOPE.md` "What Is Possible Now"
+- CI: informational `plan-check --intent "smoke test" --format json` run
+  added to `.gitea/workflows/ci.yml`
+- `docs/IntentScopeGapAnalysis.md`: priority 29 added, marked **Partial**
+  (T02/T04 shipped; T03/T05 remain open — not flipped fully to "shipped"
+  since the ecosystem rollout hasn't happened yet)
+
+---
+
+## Acceptance
+
+- [x] `plan-check` returns reuse/extend/new verdicts for workplan files and intent text (without llm-connect — T03 rerank not built, not available on this workstation)
+- [x] JSON output validates against the published schema
+- [x] `new` verdicts can file State Hub capability requests; `report gaps` lists unmatched open requests
+- [ ] Session-protocol convention drafted and propagation agreed with the-custodian (blocked, see T05)
+- [ ] reuse-surface itself records `reuse_check` in new workplans (dogfood) — deferred to T05 rollout
+
+## Out of scope
+
+- Blocking/gating workplan creation on plan-check results
+- Reuse telemetry aggregation and R-axis evidence (WP-0019)
+- Embedding-based matching (llm-connect rerank only)
+- Editing sibling repos' rules files directly (owned by template propagation)
--- a/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md
+++ b/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md
@@ -0,0 +1,186 @@
+---
+id: REUSE-WP-0019
+type: workplan
+title: "Forgejo-native federation automation and reuse telemetry"
+domain: infotech
+repo: reuse-surface
+status: active
+owner: claude-code
+topic_slug: helix-forge
+created: "2026-07-06"
+updated: "2026-07-06"
+state_hub_workstream_id: "569be717-34f8-4039-bb26-497685f60159"
+---
+
+# Forgejo-native federation automation and reuse telemetry
+
+Federation compose is on-demand and the hub serves whatever was last composed;
+roster sweeps are manual; reliability evidence is structural (CI exists) rather
+than observed (someone reused it and it worked). This workplan makes the
+registry **live** (event-driven recompose) and **evidence-backed** (reuse
+telemetry feeding the R axis).
+
+**Platform constraint:** the forge is transitioning **Gitea → Forgejo**. All
+new automation attaches to Forgejo (webhooks, Forgejo Actions, API tokens) —
+nothing new is built against Gitea. Existing raw URLs
+(`https://gitea.coulomb.social/...`) and `.gitea/workflows/` must migrate or
+be made host-agnostic. Forgejo is Gitea-API-compatible, so migration is mostly
+host/path configuration, but every hardcoded `gitea.` reference is a liability.
+
+**Depends on:** REUSE-WP-0017 (content worth refreshing), REUSE-WP-0018-T01
+telemetry schema (shared). Closes SCOPE "not possible yet" item *automatic hub
+refresh* and moves reliability evidence beyond structural.
+
+## Design principles
+
+1. **Host-agnostic first** — a single `forge_base_url` configuration
+   (env/config + hub setting) replaces hardcoded hosts; the Forgejo cutover
+   becomes a one-line change per surface.
+2. **Webhook triggers, compose stays pull-based** — the webhook only marks the
+   hub's composed index stale and triggers recompose from published raw URLs;
+   no push-parsing of payloads into registry state.
+3. **Degrade to schedule** — if webhooks are unavailable, a scheduled Forgejo
+   Actions job recomposes on an interval; freshness is monitored either way.
+4. **Telemetry is append-only and low-ceremony** — reuse events are JSONL
+   facts (who consumed what, when, outcome); aggregation derives `reused_by`
+   relations and R-axis evidence citations, never hand-edited.
+
+## Dependencies
+
+| Dependency | Owner | Notes |
+|---|---|---|
+| Forgejo instance + admin | Bernd / infra | webhook config, org-level token, Actions runners |
+| Gitea→Forgejo cutover plan | infra | final hostname, raw URL scheme, redirect window |
+| Hub deployment (reuse.coulomb.social) | reuse-surface / railiance | new endpoint + config rollout |
+| REUSE-WP-0018-T01 | reuse-surface | shared telemetry/outcome schema |
+| plan-check adoption | ecosystem | telemetry volume comes from WP-0018-T05 rollout |
+
+---
+
+## Forge Host Abstraction And URL Migration Inventory
+
+```task
+id: REUSE-WP-0019-T01
+status: todo
+priority: high
+state_hub_task_id: "4a187b56-bff9-4097-abd0-b423e7bf9442"
+```
+
+- Inventory every hardcoded `gitea.coulomb.social` / `.gitea/` reference:
+  `sources.yaml` (60 raw URLs), hub registrations, establish/publish-check
+  defaults, docs, templates, CI workflows
+- Introduce `REUSE_SURFACE_FORGE_BASE_URL` (env + hub config); derive raw
+  index URLs from `{base}/{org}/{repo}/raw/{branch}/registry/indexes/capabilities.yaml`
+- Migration command: `reuse-surface federation migrate-host --from <old> --to <new>`
+  rewriting sources.yaml + hub registrations via the hub API
+- Check whether the config-atlas 303 (WP-0017-T06) is a symptom of the host
+  transition; coordinate findings
+- Tests: URL derivation, migrate-host dry-run
+
+## Hub Recompose Endpoint And Webhook Receiver
+
+```task
+id: REUSE-WP-0019-T02
+status: todo
+priority: high
+state_hub_task_id: "691eb32a-6f20-4a2a-b9ff-0ae427b659aa"
+```
+
+- Hub service (`reuse_surface/serve`): `POST /v1/recompose` (token-auth) —
+  marks index stale and triggers recompose from registered raw URLs
+- `POST /v1/webhooks/forgejo`: validates Forgejo webhook signature
+  (`X-Forgejo-Signature`, secret from env), accepts push events, triggers
+  recompose only when the pushed commits touch `registry/indexes/`
+- Debounce/coalesce concurrent triggers; `GET /v1/federated` gains
+  `composed_at` + `stale` fields
+- Extend `specs/FederationHubAPI.md`; pytest with signed fixture payloads
+
+## Forgejo Webhook Rollout And Scheduled Fallback
+
+```task
+id: REUSE-WP-0019-T03
+status: wait
+priority: medium
+state_hub_task_id: "aa9e9f80-b878-490c-832e-515d8cbbbb60"
+```
+
+Blocked on T02 deploy and Forgejo instance availability.
+
+- Org-level Forgejo webhook (single config, all repos) → hub
+  `/v1/webhooks/forgejo`, push events only
+- Fallback: Forgejo Actions scheduled workflow (cron) in this repo calling
+  `POST /v1/recompose`; also serves repos during any Gitea-remnant window
+- Migrate this repo's CI `.gitea/workflows/ci.yml` → `.forgejo/workflows/ci.yml`
+  (Forgejo Actions; verify runner labels); document the pattern for siblings
+- Verify end-to-end: index change in a sibling repo → hub `composed_at`
+  advances without manual compose
+
+## Reuse Telemetry Store And Recording
+
+```task
+id: REUSE-WP-0019-T04
+status: todo
+priority: medium
+state_hub_task_id: "c8e9064e-5c39-4c84-80e9-8b255f8edaec"
+```
+
+- Implement the shared schema from WP-0018-T01: reuse events
+  `{ts, consumer_repo, capability_id, verdict, outcome?, source: plan-check|manual|hub}`
+- Hub: `POST /v1/reuse-events` (token-auth) + local JSONL fallback when hub
+  unreachable; `GET /v1/reuse-events?capability_id=` for aggregation
+- `plan-check --record-outcome` (WP-0018) posts here; manual
+  `reuse-surface record-reuse` for retroactive facts
+- Privacy/scope: repo slugs and capability ids only — no code, no secrets
+
+## Telemetry Aggregation Into R-Axis Evidence
+
+```task
+id: REUSE-WP-0019-T05
+status: wait
+priority: medium
+state_hub_task_id: "f0282cfa-0a71-4b46-a558-80b51ef04fa7"
+```
+
+Blocked on T04 plus initial event volume.
+
+- `reuse-surface report reuse`: per-capability consumer counts, outcomes,
+  last-used; feeds `reused_by` relation suggestions via the WP-0016
+  maintain/patch pipeline (evidence-gated, never silent promotion)
+- Maturity standard note: what observed-reuse evidence counts toward R2/R3+
+  (`specs/CapabilityMaturityStandard.md` amendment)
+- Catalog + graph surface consumer counts
+
+## Freshness Monitoring, Docs, SCOPE
+
+```task
+id: REUSE-WP-0019-T06
+status: todo
+priority: low
+state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b"
+```
+
+- `reuse-surface stats`: hub `composed_at` age + stale flag; CI informational
+  check warns when the hub index is older than N days
+- `docs/RegistryFederation.md` + `docs/deploy/reuse-kubernetes.md`: webhook
+  setup, recompose endpoint, Forgejo token handling (route credentials per
+  credential-routing rules — no secrets in repo)
+- `SCOPE.md`: flip "automatic hub refresh" to possible; update federation
+  posture
+
+---
+
+## Acceptance
+
+- [ ] No hardcoded forge host in code or sources.yaml; `migrate-host` tested
+- [ ] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place
+- [ ] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`)
+- [ ] Reuse events recordable via hub API and CLI; `report reuse` aggregates them
+- [ ] R-axis evidence rules for observed reuse documented in the maturity standard
+- [ ] Hub freshness visible (`composed_at`, stale flag) in API and stats
+
+## Out of scope
+
+- Operating the Forgejo instance or the Gitea→Forgejo data migration itself
+- Multi-replica/Postgres hub posture (separate managed-platform track)
+- Blocking CI gates on registry freshness in sibling repos
+- ActivityPub/Forgejo-native federation features (our federation layer stays raw-URL based)
Author	SHA1	Message	Date
tegwick	9b02e54bb6	Document inter-hub retirement and maturity reassessment Some checks are pending ci / validate-registry (push) Waiting to run Details inter-hub is retired (Haskell/IHP build-chain problems), superseded by core-hub (Python/FastAPI/Postgres). Its capability entry was updated directly in ~/inter-hub (commit cffdf9e): D3/A1/C1/R0 -> D5/A1/C3/R0, status: deprecated, relations.related_to -> capability.infotech.core-hub. core-hub itself is not yet added to reuse-surface's roster/federation sources -- it postdates the WP-0017 coverage sweep; noted as a follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 01:45:00 +02:00
custodian-sync	cf3b8f93db	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-07: - update .custodian-brief.md for reuse-surface	2026-07-07 01:16:20 +02:00
tegwick	533b4f0831	REUSE-WP-0017-T06: config-atlas hub registration completed Some checks failed ci / validate-registry (push) Has been cancelled Details Resolved via the reuse-surface-hub-write-token routing catalog entry that appeared in ops-warden (points at a Kubernetes Secret on Railiance01, not OpenBao). config-atlas is now among the 61 sources at reuse.coulomb.social/v1/federated. hub_registered corrected to true; 61/61 hub-registered, 61/61 publish pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 01:14:41 +02:00
tegwick	e1ca9bbbc5	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-07: - update .custodian-brief.md for reuse-surface	2026-07-07 00:58:27 +02:00
tegwick	e72966a658	REUSE-WP-0018 T01/T02/T04/T06: plan-check deterministic matching + State Hub bridge Some checks failed ci / validate-registry (push) Has been cancelled Details T01: specs/PlanCheck.md design doc, plan-check-result.schema.json and reuse-event.schema.json (the latter shared with WP-0019's reuse telemetry). T02: reuse_surface/plan_check.py + 'reuse-surface plan-check' CLI command. Deterministic token-Jaccard matching against registry/indexes/federated.yaml (reuses overlaps.py's TOKEN_RE rather than a second scoring method), with reuse/extend/new verdicts, markdown and --format json output, staleness warning, and --record-outcome JSONL telemetry. T04: reuse_surface/statehub_bridge.py bridges plan-check 'new' verdicts to State Hub capability requests (--file-request) and surfaces open requests with no matching capability (report gaps --check-capability-requests, opt-in to stay offline-safe). Verified against the live local State Hub API; status field (not catalog_entry_id presence) is the correct open/closed signal, and the list endpoint needs a longer timeout than the health check (~7s observed with 5 rows). T06: docs (tools/README.md, RegistryFederation.md, SCOPE.md, IntentScopeGapAnalysis.md priority 29) and an informational CI smoke step. T03 (LLM rerank) not started -- llm-connect isn't running on this workstation. T05 (ecosystem rollout) remains blocked: WP-0017 has drafted entries for all 61 repos but they're still local-only pending its own T05 push/publish pass, so the federated index isn't yet worth rolling out plan-check as ecosystem convention. 16 new tests, all mocked -- no network calls in the default test run. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-07 00:57:18 +02:00
tegwick	2a6818d4fe	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 20:18:12 +02:00
tegwick	e046562b56	REUSE-WP-0017-T06: diagnose config-atlas publish blocker Some checks failed ci / validate-registry (push) Has been cancelled Details Two conflated issues: (1) the raw-URL 303 redirect is already followed correctly by establish.py's urllib-based probe -- re-running publish-check now passes; the stale roster fail was from the 2026-06-16 sweep, not a live issue. (2) config-atlas was never actually registered with the production hub (absent from the 60 sources at reuse.coulomb.social/v1/federated despite hub_registered: true in the roster) -- corrected to false. Local publish pass is now 61/61; hub registration itself is blocked on REUSE_SURFACE_TOKEN, which has no routing catalog entry -- needs Bernd to provide or route it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 20:16:59 +02:00
tegwick	8fc975717f	REUSE-WP-0017: T05 review summary + fix stale seed_capability_ids Some checks failed ci / validate-registry (push) Has been cancelled Details Prepared history/2026-07-06-t04-review-summary.md for the T05 human review pass: full table of all 48 capability entries and 13 no-capability markers generated from the actual committed files, plus flagged items (the-custodian confidentiality scoping, vergabe-teilnahme low D1/C0, markitect-main superseded framing, Forgejo-relevant tooling found along the way). Also fixed two pre-existing roster rows with stale empty seed_capability_ids despite having real published entries: activity-core and ops-warden. Not new drafts -- a bookkeeping gap predating this workplan. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 20:02:06 +02:00
tegwick	8726cb8c86	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 19:53:27 +02:00
tegwick	89b8b34471	REUSE-WP-0017-T04 cohort 3 (final): draft entries for remaining 17 repos Some checks failed ci / validate-registry (push) Has been cancelled Details open-cmis-tck, open-reuse, ops-bridge, phase-memory, railiance-apps, railiance-cluster, railiance-enablement, railiance-fabric, railiance-forge, railiance-infra, railiance-platform, repo-scoping, the-custodian, user-engine, vantage-point, vergabe-teilnahme, whynot-design. the-custodian entry deliberately scoped to its non-confidential runtime/tools/ surface only, given the repo's NDA notice. vergabe-teilnahme honestly registered at D1/C0 given its own unfilled SCOPE.md. T04 complete: coverage 44/61 -> 61/61 (48 has-capability, 13 explicit no-capability, 0 unclassified). All 50 sibling-repo commits across three cohorts remain local only, pending T05 human review and push. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:52:19 +02:00
tegwick	651b84a16b	REUSE-WP-0017-T04 cohort 2: draft entries for 10 more has-capability repos Some checks failed ci / validate-registry (push) Has been cancelled Details issue-core (migrated existing CAPABILITY-issue-tracking.yaml), kaizen-agentic, key-cape, kontextual-engine, llm-connect, markitect-filter, markitect-main (registered as superseded legacy platform), markitect-quarkdown, markitect-tool, net-kingdom. All validate, no overlap with existing federated capabilities. Committed locally in each sibling repo; push held for T05 human review. Coverage 34/61 -> 44/61. Also fixed a stale empty_scaffold_count >= 40 test threshold -- no longer meaningful as the coverage campaign shrinks that number by design. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:44:02 +02:00
tegwick	b48a4edf81	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 19:06:59 +02:00
tegwick	8429eea576	chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-06: - REUSE-WP-0017-T04: progress → wait	2026-07-06 19:06:55 +02:00
tegwick	6688830bf8	chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-07-06: - REUSE-WP-0017-T03: progress → wait	2026-07-06 19:06:55 +02:00
tegwick	d3ae49fdf3	REUSE-WP-0017-T04 cohort 1: draft entries for 10 has-capability repos Some checks failed ci / validate-registry (push) Has been cancelled Details artifact-store, can-you-assist, citation-engine, citation-evidence, email-connect, guide-board, hub-core, info-tech-canon, infospace-bench, inter-hub. Drafted directly (llm-connect not running locally; this matches the workplan's no-invented-evidence principle better anyway). All validate, no overlap with existing 24 federated capabilities. Committed locally in each sibling repo; push held for T05 human review. Coverage 24/61 -> 34/61. 27 has-capability repos remain for later cohorts. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 19:06:11 +02:00
tegwick	be1dd56d76	REUSE-WP-0017-T03: mark 13 confirmed no-capability repos, fix repo-seed stale count Some checks failed ci / validate-registry (push) Has been cancelled Details Roster capability_status now has:11 / none:13 / pending:37. Coverage 24/61. NO_CAPABILITIES.md committed locally in all 13 sibling repos (push held pending confirmation — touches 13 external default branches). repo-seed's capability_count was stale (0, should be 1); corrected. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:51:54 +02:00
tegwick	f4a5cefa4b	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 18:42:03 +02:00
tegwick	e87a07014c	chore(consistency): renormalize lifecycle state [auto] Updated by fix-consistency on 2026-07-06: - workplan status: ready → active	2026-07-06 18:41:53 +02:00
tegwick	a6ed45bb22	chore(consistency): renormalize lifecycle state [auto] Updated by fix-consistency on 2026-07-06: - workplan status: ready → active	2026-07-06 18:41:52 +02:00
tegwick	f383f01dac	REUSE-WP-0017-T02: classification sweep of 51 empty scaffolds Some checks failed ci / validate-registry (push) Has been cancelled Details 37 has-capability / 13 no-capability / 0 missing. Awaiting review before T03 (no-capability markers) and T04 (draft entries) proceed. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:40:58 +02:00
tegwick	8219a5d253	REUSE-WP-0017-T01: explicit capability_status on roster + coverage split in report gaps Some checks failed ci / validate-registry (push) Has been cancelled Details Adds capability_status: has\|none\|pending to every roster row (10 has / 51 pending currently), a coverage_ratio headline, and splits the gap report's empty-scaffold section into unclassified vs explicitly-none. Adds templates/NO_CAPABILITIES.template.md for the no-capability marker. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:36:05 +02:00
tegwick	493f23123c	Move WP-0017, WP-0018, WP-0019 to ready Some checks failed ci / validate-registry (push) Has been cancelled Details Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-06 18:31:39 +02:00
tegwick	64b57e69f0	Write back State Hub workstream/task IDs for WP-0017..0019 Some checks failed ci / validate-registry (push) Has been cancelled Details Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 18:18:46 +02:00
tegwick	365db676cf	chore(consistency): sync task status from DB [auto] Some checks failed ci / validate-registry (push) Has been cancelled Details Updated by fix-consistency on 2026-07-06: - update .custodian-brief.md for reuse-surface	2026-07-06 18:18:26 +02:00
tegwick	e37fc60ecf	Add workplans WP-0017..0019: coverage campaign, plan-check loop, Forgejo automation + telemetry Some checks failed ci / validate-registry (push) Has been cancelled Details Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-06 18:17:32 +02:00
tegwick	08f3bb5110	feat(federation): register config-atlas and reserve surface.* namespace Some checks failed ci / validate-registry (push) Has been cancelled Details Add config-atlas as a federation source (capability index) and to the local repo roster. Document surface.* as a distinct id namespace owned by config-atlas (typed sibling of capability.*, not federated here) under a new "Id namespace ownership" section. Raw URL currently 303 (required:false), same publish block as state-hub/feature-control. Recompose federated.yaml. Supports config-atlas ATLAS-WP-0002-T05. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-26 23:48:20 +02:00
tegwick	368fb156d4	Normalize agent instructions and workplan frontmatter (STATE-WP-0067) Some checks failed ci / validate-registry (push) Has been cancelled Details - Align agent files with on-disk workplan prefixes (infer from workplan ids) - Set workplan domain to registered domain_slug; add topic_slug where applicable - Repair frontmatter delimiter formatting; migrate legacy task status literals - Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates	2026-06-22 23:16:28 +02:00