feat(tasks): add needs_human intervention flag (CUST-WP-0009)

- Migration b4c5d6e7f8a9: adds needs_human (bool) + intervention_note (text) to tasks
- API: needs_human filter on GET /tasks/; 422 if flagged without note
- 3 MCP tools: flag_for_human, clear_human_flag, list_human_interventions
- Dashboard: interventions.md with amber cards and "Mark done" button
- Policy router + workstream DoD policy (workstream-dod.md)
- Workstream lifecycle docs page + workplan CUST-WP-0010
- CLAUDE.md: add step 4 (run fix-consistency after workplan writes)
- consistency_check.py: promote C-11 unlinked tasks from INFO to WARN

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

workplans/CUST-WP-0009-human-interventions.md

@@ -0,0 +1,77 @@
+---
+id: CUST-WP-0009
+type: workplan
+title: Human Interventions Flag
+domain: custodian
+status: completed
+owner: custodian
+topic_slug: the-custodian
+state_hub_workstream_id: "dd7db29a-fece-488a-a501-cadc860b2f50"
+created: 2026-03-03
+updated: 2026-03-03
+---
+
+# CUST-WP-0009 — Human Interventions Flag
+
+## Purpose
+
+Tasks in the state-hub can represent work for agents (custodian) or for humans (Bernd).
+Currently there is no way to distinguish these at query time. Adding a `needs_human` flag
+lets agents tag tasks they cannot complete themselves, surfaces them in a dedicated dashboard
+page, and lets Bernd work through all his action items in one place.
+
+## Scope
+
+- `needs_human` boolean + `intervention_note` text on the `tasks` table
+- API filter `GET /tasks/?needs_human=true`
+- 3 MCP tools: `flag_for_human`, `clear_human_flag`, `list_human_interventions`
+- Dashboard: new "Interventions" top-level page with amber-bordered cards and "Mark done" button
+
+## Files Changed
+
+| File | Change |
+|------|--------|
+| `state-hub/migrations/versions/b4c5d6e7f8a9_add_needs_human.py` | New migration |
+| `state-hub/api/models/task.py` | Added `needs_human`, `intervention_note` fields |
+| `state-hub/api/schemas/task.py` | Added fields + validators to Create/Update/Read |
+| `state-hub/api/routers/tasks.py` | Added `needs_human` filter param |
+| `state-hub/mcp_server/server.py` | Added 3 new tools |
+| `state-hub/mcp_server/TOOLS.md` | Documented 3 new tools |
+| `state-hub/dashboard/src/interventions.md` | New dashboard page |
+| `state-hub/dashboard/observablehq.config.js` | Added nav entry |
+
+## Tasks
+
+### Step 1: Run migration
+```task
+id: CUST-WP-0009-T1
+title: Run Alembic migration b4c5d6e7f8a9
+status: done
+priority: high
+state_hub_task_id: "a2d5561f-9c1e-40c2-9259-c3d3cc9761b0"
+```
+
+### Step 2: Verify API
+```task
+id: CUST-WP-0009-T2
+title: Verify API validator and filter work
+status: done
+priority: medium
+state_hub_task_id: "6b739018-c3bc-4e7c-aa28-9ca1a64406f1"
+```
+
+### Step 3: Verify dashboard
+```task
+id: CUST-WP-0009-T3
+title: Verify Interventions dashboard page loads
+status: done
+priority: medium
+state_hub_task_id: "e474259d-c5ff-4c60-86c7-9585c0d0797f"
+```
+
+## Design Notes
+
+- `intervention_note` required when `needs_human=True` (API validator raises 422)
+- Mirrors the `blocking_reason` pattern for blocked tasks
+- Dashboard "Mark done" button PATCHes `{status: "done", needs_human: false}`
+- MCP `clear_human_flag` is the agent-side equivalent (used after human completes the action)

workplans/CUST-WP-0010-workstream-lifecycle-docs.md

@@ -0,0 +1,74 @@
+---
+id: CUST-WP-0010
+type: workplan
+title: Workstream Lifecycle Documentation
+domain: custodian
+status: completed
+owner: custodian
+topic_slug: the-custodian
+state_hub_workstream_id: "e73c41f1-45b7-4c92-8b45-3105a1936fff"
+created: 2026-03-03
+updated: 2026-03-03
+---
+
+# CUST-WP-0010 — Workstream Lifecycle Documentation
+
+## Purpose
+
+The dashboard "Workstreams by Domain" chart exposes seven computed states
+(active, accepted, finished, blocked, stalled, oldies + time-based modes).
+These need to be documented so that Bernd and the custodian share a common
+vocabulary, and so the "accepted" quality-gate pattern is clearly understood
+as the anchor for custodian review.
+
+## Scope
+
+- New dashboard reference page: `docs/workstream-lifecycle.md`
+- Update `docs/workstreams.md` status table to reflect new state names
+- Nav entry in `observablehq.config.js`
+
+## Files Changed
+
+| File | Change |
+|------|--------|
+| `state-hub/dashboard/src/docs/workstream-lifecycle.md` | New reference page |
+| `state-hub/dashboard/src/docs/workstreams.md` | Update status table |
+| `state-hub/dashboard/observablehq.config.js` | Add nav entry |
+
+## Tasks
+
+### Step 1: Write lifecycle docs page
+```task
+id: CUST-WP-0010-T1
+title: Create docs/workstream-lifecycle.md
+status: done
+priority: high
+state_hub_task_id: "95e5810d-947a-4039-b017-9bee85cf4f48"
+```
+
+### Step 2: Update workstreams reference
+```task
+id: CUST-WP-0010-T2
+title: Update docs/workstreams.md status table
+status: done
+priority: medium
+state_hub_task_id: "30d61368-8ede-4d84-9f98-44fe6ff57dda"
+```
+
+### Step 3: Add nav entry
+```task
+id: CUST-WP-0010-T3
+title: Add nav entry to observablehq.config.js
+status: done
+priority: medium
+state_hub_task_id: "4cef0841-5324-4fbc-a44b-ad8520f77c9f"
+```
+
+## Design Notes
+
+- "accepted" maps to DB `status = "completed"` — the name change reflects intent
+- The lifecycle is linear: active → finished (task-derived) → accepted (human+custodian gate)
+- Attention signals (blocked, stalled, oldies) are orthogonal — a workstream can be
+  active AND stalled at the same time
+- The custodian uses the "finished but not accepted" gap as the trigger to run
+  quality checks and create follow-up tasks before signing off