Close Core Hub ops evidence contract gate

docs/core-hub-replacement-evidence.md

@@ -77,6 +77,13 @@ rewritten around this recommendation. The rewrite is enough to stop the obsolete
 standalone ops-hub scaffold sequence, but not enough to declare Core Hub
 production cutover complete.
 
+2026-06-27 T14 closeout: Core Hub now has
+`docs/specs/ops-evidence-contract.md`, which defines the ops evidence API
+resources, event vocabulary, non-secret access metadata rules, service inventory
+mapping, readiness-summary inputs, and read-model gaps. This closes the T14
+definition gate while leaving deployed evidence, cutover coupling, and UI work
+for T16/T17/T18.
+
 ## Remaining Gates
 
 - Run `make deployed-smoke` or `make operator-cli CLI_ARGS="deployed-smoke ..."`

docs/infrastructure-stabilization-pickup-checkpoint.md

@@ -100,7 +100,7 @@ Resume from `docs/daily-triage-stabilization-status.md` and
 | --- | --- | --- |
 | State Hub | Pragmatic railiance01 path has image, manifests, empty deploy, migrations, restored WSL2 data, row-count comparison, and healthy API through `CUST-WP-0011-T06`. | `CUST-WP-0011-T07` cutover approval, then stabilization; HA path stays deferred. |
 | Inter-Hub / Core Hub | Public `https://hub.coulomb.social/api/v2/hubs` exposes `ops-hub`; `CORE-WP-0008` finished the Core Hub API smoke harness, activity-core sink, staging profile, CLI wrappers, UI backlog, and Custodian handoff. | Run deployed Core Hub smoke, staging import, activity-core sink smoke, and readiness summary; keep Haskell Inter-Hub only for migration/rollback proof. |
-| ops-hub evidence | `CUST-WP-0025-T13` through `T19` now use Core Hub API/CLI/UI gates; `CUST-WP-0047` and `CUST-WP-0049` remain legacy/fallback records. | Execute `CUST-WP-0025-T14`, `T16`, `T17`, and `T18`; close legacy Inter-Hub waits only through deployed Core Hub evidence or explicit supersede decision. |
+| ops-hub evidence | `CUST-WP-0025-T14` is done with the Core Hub ops evidence contract spec. `CUST-WP-0025-T13` through `T19` now use Core Hub API/CLI/UI gates; `CUST-WP-0047` and `CUST-WP-0049` remain legacy/fallback records. | Execute `CUST-WP-0025-T16`, `T17`, and `T18`; close legacy Inter-Hub waits only through deployed Core Hub evidence or explicit supersede decision. |
 | issue-core | ArgoCD service is healthy on port `8765`; image `0.2.1`; ExternalSecret Ready; authenticated smoke created Gitea issue `175`. | activity-core still needs `ISSUE_CORE_API_KEY`, URL port `8765`, `ISSUE_SINK_TYPE=rest`, and a safe emission smoke. |
 | Forgejo | Migration inventory/design lane is active but pre-cutover. | Production design decisions, SMTP/email recovery, package registry, Actions, backup/restore, migration drill, cutover approval. |
 | artifact-store | D7.1 is done; D7.2 has an opt-in live MinIO compatibility harness and manual smoke docs. No live secret handoff is recorded. | Run D7.2 against an approved MinIO-compatible endpoint, then route D7.3 STS vending through identity/platform custody before changing credential behavior. |
@@ -108,10 +108,10 @@ Resume from `docs/daily-triage-stabilization-status.md` and
 
 ## Next-Pick List
 
-1. Execute the rewritten `CUST-WP-0025` Core Hub gates: identity integration
+1. Execute the remaining rewritten `CUST-WP-0025` Core Hub gates: identity
-   (`T03`), ops evidence/read-model contract (`T14`), deployed smoke and
+   integration (`T03`), deployed smoke and activity-core proof (`T16`), cutover
-   activity-core proof (`T16`), cutover decision coupling (`T17`), and first UI
+   decision coupling (`T17`), and first UI screens (`T18`). T14 is complete as
-   screens (`T18`).
+   the ops evidence/read-model contract definition gate.
 2. Keep `CUST-WP-0047` and `CUST-WP-0049` as legacy evidence/fallback until
    Core Hub deployed smoke evidence or an explicit supersede decision closes
    them.

workplans/CUST-WP-0025-fos-hub-bootstrap.md

@@ -401,7 +401,7 @@ reframe/open-lane task; it does not claim production cutover is complete.
 
 ```task
 id: CUST-WP-0025-T14
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "0e811e9b-23a5-49f9-979e-cd1c5dcd937f"
 ```
@@ -427,6 +427,17 @@ Done when Core Hub has a workplan or spec that names the API resources, record
 shape, evidence event vocabulary, and migration path from the existing
 Custodian inventory artifacts.
 
+Completed 2026-06-27: Core Hub now owns the replacement ops evidence contract in
+`/home/worsch/core-hub/docs/specs/ops-evidence-contract.md`. The spec names the
+implemented API resources (`hubs`, manifests, API consumers/keys, widgets,
+interaction events, hub registry, migration runs), required read-model gaps
+(`migration-runs`, deployment records, outcome signals, service inventory
+mapping, event filters, registry containment summary), event vocabulary,
+non-secret access metadata rules, and the migration path from `CUST-WP-0047`
+service inventory into Core Hub widgets/events. T14 is complete as a definition
+gate; implementation remains in T16/T17/T18 and follow-up Core Hub read-model
+work.
+
 ### T15 — Core Hub operator CLI parity
 
 ```task

workplans/CUST-WP-0051-infrastructure-stabilization-metaplan.md

@@ -493,6 +493,17 @@ Progress 2026-06-27 Core Hub reset:
   dual-run smokes, cutover evidence, and Haskell retirement approval remain
   open.
 
+Progress 2026-06-27 Core Hub ops evidence contract:
+
+- Completed `CUST-WP-0025-T14` by adding Core Hub spec
+  `/home/worsch/core-hub/docs/specs/ops-evidence-contract.md` and linking it
+  from the Core Hub specs index.
+- The spec defines API resources, non-secret evidence fields, event vocabulary,
+  service-inventory-to-widget/event mapping, readiness-summary inputs, and
+  read-model gaps to close before UI expansion or cutover claims.
+- T07 sequencing now keeps `T03`, `T16`, `T17`, and `T18` open; T14 no longer
+  blocks the Core Hub replacement lane.
+
 Progress 2026-06-27 CUST-WP-0052 closeout:
 
 - `CUST-WP-0052` is finished. It closed the Core Hub reframe, rewrote
@@ -500,9 +511,9 @@ Progress 2026-06-27 CUST-WP-0052 closeout:
   HelixForge/Railiance Forge practice, and posted non-secret State Hub
   requirements to `railiance-apps` and `railiance-forge`.
 - The remaining T07 gates are execution gates, not sequencing ambiguity:
-  `CUST-WP-0025-T03` identity integration, `T14` Core Hub ops evidence contract
+  `CUST-WP-0025-T03` identity integration, `T16/T17` deployed
-  gaps, `T16/T17` deployed evidence/cutover waits, and `T18` Core Hub operator
+  evidence/cutover waits, and `T18` Core Hub operator UI first screens. `T14`
-  UI first screens.
+  is complete as the ops evidence contract definition gate.
 
 ## Task: Create The Stable Pickup Checkpoint