Add STATE-WP-0067 attached-repo agent and workplan normalization

Infer workplan prefixes from on-disk filenames instead of first-token
derivation, add a frontmatter normalization script, and wire Make targets
for dirty-repo sweeps.

workplans/STATE-WP-0067-attached-repo-agent-normalization.md

@@ -0,0 +1,141 @@
+---
+id: STATE-WP-0067
+type: workplan
+title: "Attached Repo Agent Instruction And Workplan Frontmatter Normalization"
+domain: custodian
+repo: state-hub
+status: active
+owner: codex
+topic_slug: custodian
+created: "2026-06-22"
+updated: "2026-06-22"
+---
+
+# STATE-WP-0067 — Attached Repo Agent Instruction And Workplan Frontmatter Normalization
+
+## Goal
+
+Close drift introduced by the State Hub agent-instruction template sync across
+attached repos. Agent files were regenerated with a first-token workplan prefix
+(`artifact-store` → `ARTIFACT-WP`) and `domain: infotech`, while existing
+workplan files retain repo-specific prefixes (`ARTIFACT-STORE-WP`, `IRP-WP`, …)
+and legacy frontmatter (`domain: stack` where `stack` is the topic slug).
+
+Per ADR-001, **workplan files are the source of truth**. Agent instructions must
+match on-disk workplan prefixes and frontmatter conventions; workplans are
+renamed only when a repo has no established prefix yet.
+
+## Context
+
+- `scripts/update_agent_instruction_files.py` derives `{WP_PREFIX}` from the
+  first hyphen segment of the repo slug. That is wrong for most registered repos
+  (35+ use intentional abbreviations).
+- Template sync left ~49 repos with local changes (discover via
+  `cd ~ && gitea ll`, or scan `git status --porcelain` under `~/`).
+- Task status canon (`STATE-WP-0052`) is already reflected in regenerated
+  agent files; workplan task blocks may still use legacy literals.
+- `domain` in workplan frontmatter should be the hub **domain slug**
+  (`infotech`), not the topic slug (`stack`). Topic linkage belongs in
+  `topic_slug`.
+
+## Policy
+
+| Layer | Rule |
+|-------|------|
+| Workplan prefix | Infer from existing `workplans/*-WP-NNNN-*.md` filenames; fall back to first-token only when no workplans exist |
+| `domain` frontmatter | Set to repo `domain_slug` from State Hub registration |
+| `topic_slug` frontmatter | Set from registered `topic_id` when present |
+| Task status in workplan blocks | `in_progress→progress`, `blocked→wait`, `cancelled/canceled→cancel` |
+| Agent files | Regenerated from templates using inferred prefix — never overwrite `<!-- REPO-AGENTS-EXTENSIONS -->` tail |
+| Grandfathered prefixes | Short prefixes (`IRP-WP`, `CYA-WP`, …) are canonical for their repo — not migrated to first-token |
+
+## T01 — Inventory repos with local changes
+
+```task
+id: STATE-WP-0067-T01
+status: progress
+priority: high
+```
+
+Enumerate repos with uncommitted changes under `/home/worsch/*/`.
+
+Done when the dirty-repo list is recorded in the T04 run log.
+
+## T02 — Infer workplan prefix from on-disk files
+
+```task
+id: STATE-WP-0067-T02
+status: progress
+priority: high
+```
+
+Update `scripts/update_agent_instruction_files.py` to infer `{WP_PREFIX}` from
+existing workplan filenames before falling back to first-token derivation.
+
+Done when `artifact-store` agent files reference `ARTIFACT-STORE-WP`, not
+`ARTIFACT-WP`.
+
+## T03 — Workplan frontmatter normalization script
+
+```task
+id: STATE-WP-0067-T03
+status: progress
+priority: high
+```
+
+Add `scripts/normalize_attached_repo_workplans.py` to:
+
+- set `domain:` to registered `domain_slug`;
+- set `topic_slug:` from registered topic when missing or wrong;
+- migrate legacy task status literals inside ` ```task ` blocks.
+
+Support `--repo SLUG` and `--dirty` (scan `~/` for porcelain).
+
+## T04 — Apply normalization to dirty repos
+
+```task
+id: STATE-WP-0067-T04
+status: todo
+priority: high
+```
+
+For each dirty repo:
+
+1. `normalize_attached_repo_workplans.py --repo <slug>`
+2. `update_agent_instruction_files.py --repo <slug>` (after T02 filter added)
+3. `make fix-consistency REPO=<slug>` from `~/state-hub`
+
+Done when all dirty repos have clean or warnings-only consistency checks.
+
+## T05 — Commit and push
+
+```task
+id: STATE-WP-0067-T05
+status: todo
+priority: high
+```
+
+Commit agent-instruction and workplan changes per repo with a shared message.
+Push to `origin` where a remote exists.
+
+Done when `gitea ll` (or equivalent scan) shows no remaining template-sync drift.
+
+## T06 — Close workplan
+
+```task
+id: STATE-WP-0067-T06
+status: todo
+priority: medium
+```
+
+Mark tasks done, set workplan `status: finished`, run
+`make fix-consistency REPO=state-hub`.
+
+## Acceptance Criteria
+
+- Agent instructions and workplan files agree on prefix and domain/topic fields
+  for every dirty repo.
+- `artifact-store` keeps `ARTIFACT-STORE-WP-*` filenames and IDs.
+- No `domain: stack` remains where `domain_slug` is `infotech` and `stack` is the
+  topic slug.
+- Dirty repos are committed; hub read model refreshed via fix-consistency.