From 8949e34e752e22332ea789c731c0cab404cbe251 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 20 Mar 2026 23:48:13 +0100
Subject: [PATCH] feat: add FOS/credential standards, big-picture guidance, and
 CUST-WP-0025 workplan

- canon/standards/credential-management_v0.1.md: single root-of-trust credential hierarchy standard
- canon/standards/federated-organization-standard_v1.0.md: FOS reference architecture (VSM-based)
- wiki/BigPictureGuidance.md: integration guidance for OAS + FOS orthogonal layers
- workplans/CUST-WP-0025-fos-hub-bootstrap.md: 4-phase plan (identity, hub-core extraction, ops-hub, fin-hub)
- state-hub/Makefile: treat exit 2 (warnings-only) as success in check-consistency targets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 Makefile | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 1bd7a55..e30b07c 100644
--- a/Makefile
+++ b/Makefile
@@ -235,26 +235,32 @@ validate-adr:
 	uv run python scripts/validate_repo_adr.py "$(REPO)" $(if $(DOMAIN),--domain "$(DOMAIN)",)
 
 ## Check a single repo for ADR-001 consistency: make check-consistency REPO=the-custodian [REPO_PATH=/override]
+## Exit 0 = clean, exit 2 = warnings only (treated as success), exit 1 = failures
 check-consistency:
 	@test -n "$(REPO)" || (echo "ERROR: REPO is required. Usage: make check-consistency REPO=<slug>"; exit 1)
 	uv run python scripts/consistency_check.py --repo "$(REPO)" \
 	  $(if $(API_BASE),--api-base "$(API_BASE)",) \
-	  $(if $(REPO_PATH),--repo-path "$(REPO_PATH)",)
+	  $(if $(REPO_PATH),--repo-path "$(REPO_PATH)",); \
+	  e=$$?; [ $$e -eq 2 ] && exit 0 || exit $$e
 
 ## Check and auto-fix a single repo: make fix-consistency REPO=the-custodian [REPO_PATH=/override]
+## Exit 0 = clean, exit 2 = warnings only (treated as success), exit 1 = failures
 fix-consistency:
 	@test -n "$(REPO)" || (echo "ERROR: REPO is required. Usage: make fix-consistency REPO=<slug>"; exit 1)
 	uv run python scripts/consistency_check.py --repo "$(REPO)" --fix \
 	  $(if $(API_BASE),--api-base "$(API_BASE)",) \
-	  $(if $(REPO_PATH),--repo-path "$(REPO_PATH)",)
+	  $(if $(REPO_PATH),--repo-path "$(REPO_PATH)",); \
+	  e=$$?; [ $$e -eq 2 ] && exit 0 || exit $$e
 
 ## Check all registered repos for ADR-001 consistency
 check-consistency-all:
-	uv run python scripts/consistency_check.py --all $(if $(API_BASE),--api-base "$(API_BASE)",)
+	uv run python scripts/consistency_check.py --all $(if $(API_BASE),--api-base "$(API_BASE)",); \
+	  e=$$?; [ $$e -eq 2 ] && exit 0 || exit $$e
 
 ## Check and auto-fix all registered repos
 fix-consistency-all:
-	uv run python scripts/consistency_check.py --all --fix $(if $(API_BASE),--api-base "$(API_BASE)",)
+	uv run python scripts/consistency_check.py --all --fix $(if $(API_BASE),--api-base "$(API_BASE)",); \
+	  e=$$?; [ $$e -eq 2 ] && exit 0 || exit $$e
 
 ## Cancel open tasks belonging to completed/archived workstreams.
 ## Safe to run at any time; also suitable for a daily cron job.