Advance CUST-WP-0025: close T16/T17, add canon and fin-hub bootstrap

- Mark T16/T17 done with cutover evidence and decision coupling doc - Add business-model-canvas and bootstrap-protocol canon (T20/T21) - Record Core Hub readiness-summary evidence stubs - Refresh fos-hub-bootstrap-sequence-status and core-hub-replacement-evidence
2026-07-08 00:50:28 +02:00
parent 72fe10e076
commit a272f5fcda
11 changed files with 582 additions and 39 deletions
--- a/canon/constitution/bootstrap-protocol_v0.1.md
+++ b/canon/constitution/bootstrap-protocol_v0.1.md
@@ -0,0 +1,150 @@
+---
+id: CUST-BSP-2026-000001
+type: procedure
+title: "Bootstrap Protocol v0.1"
+status: draft
+owners: ["Bernd", "Custodian"]
+created: "2026-07-08"
+updated: "2026-07-08"
+scope:
+  domains: ["Custodian", "Railiance"]
+  sensitivity: internal
+tags: ["bootstrap", "capital", "roles", "fos", "mvp"]
+---
+
+# Bootstrap Protocol v0.1
+
+Addresses FOS blindspot #2: **bootstrapping and initial capital**. Neither FOS
+nor OAS defines how the first €10k is funded, what MVP must exist before the
+first customer, or which roles are mandatory at formation.
+
+This protocol applies to the Railiance/Custodian ecosystem until a formal GmbH
+and multi-stakeholder governance structure supersedes it.
+
+## 1. Seed Funding Strategy
+
+### Minimum Viable Budget (12-month bootstrap)
+
+| Category | Estimate (EUR) | Notes |
+| --- | --- | --- |
+| Infrastructure (HostEurope, domains) | 3,000–5,000 | Existing fleet partially covers this |
+| LLM/API tokens | 1,500–3,000 | Tracked via fin-hub; burn alerts at 80% budget |
+| Legal/GmbH formation | 2,000–4,000 | Deferred until first revenue signal |
+| Tooling/licenses | 500–1,000 | Prefer OSS; EU-hostable |
+| Contingency | 2,000 | Restore drills, hardware failure |
+| **Total** | **€9,000–15,000** | Founder-funded in v0.1 |
+
+### Funding Sources (v0.1)
+
+1. **Founder capital** — primary source until first paying customer.
+2. **Consulting revenue** — Railiance architecture reviews (pre-GmbH: freelance
+   invoice under existing legal entity or transitional structure).
+3. **Grants** — EU digital sovereignty programs (exploratory, not blocking).
+
+No external investment required for MVP. External capital triggers formal
+Financial Allocator role and updated constitution clauses.
+
+## 2. MVP Scope Definition
+
+The bootstrap MVP is **not** a full FOS Level 5 federation. It is the minimum
+viable stack that proves:
+
+1. Reproducible deploy + restore for the Custodian/Railiance substrate.
+2. Multi-hub separation at Level 3 boundary (dev, ops, fin conceptually distinct).
+3. Identity integration via IAM Profile v0.2.
+4. Ops evidence on Core Hub production surface.
+5. Cost visibility sufficient to compute runway.
+
+### Must Exist Before First Customer
+
+| # | Capability | Status (2026-07-08) |
+| --- | --- | --- |
+| 1 | dev-hub (State Hub) workplan coordination | done |
+| 2 | hub-core extracted package | done |
+| 3 | Core Hub ops evidence (production) | done |
+| 4 | IAM Profile integration template | done |
+| 5 | fin-hub with runway calculator | in progress (T22–T24) |
+| 6 | Restore drill evidence (Railiance) | partial |
+| 7 | RaaS onboarding runbook | draft (business-model-canvas) |
+| 8 | Legal/GmbH review | not started (T26) |
+
+### Explicitly Out of MVP
+
+- Full Keycloak enterprise federation (`NK-WP-0011` lane)
+- Autonomous agent scheduling
+- Multi-customer tenancy
+- NATS cross-hub transport
+- Haskell Inter-Hub retirement (gated on stabilization sign-off)
+
+## 3. First Three Mandated Roles
+
+Per FOS §12 and the Big Picture Guidance blindspot analysis, three roles are
+mandatory at bootstrap — they may be held by the same human initially but must
+remain **explicitly separable**:
+
+### Constitutional Steward (System 5)
+
+- Owns canon, values, constitution, and non-delegable policies.
+- Approves canon promotions and escalation when agent actions affect legal,
+  financial, or reputational posture.
+- Cannot be silently merged with Technical Operator authority.
+
+**v0.1 holder:** Bernd (founder).
+
+### Technical Operator (System 3 / Ops)
+
+- Owns infrastructure substrate, deployment, restore drills, and Core Hub
+  production surface.
+- Executes cutover, rollback, and stabilization decisions.
+- Routes credentials through approved custody paths only.
+
+**v0.1 holder:** Bernd (founder), with agent assistance under tool-boundary policy.
+
+### Financial Allocator (System 3* / Fin)
+
+- Owns budget, burn rate, runway projection, and spend approval thresholds.
+- Surfaces resource pressure signals to dev-hub and viability alerts to canon.
+- Escalates when runway drops below alert threshold.
+
+**v0.1 holder:** Bernd (founder) until fin-hub automation exists; then
+fin-hub surfaces data, human retains approval for transactions.
+
+## 4. Revenue Threshold for Role Formalization
+
+| Milestone | Trigger | Action |
+| --- | --- | --- |
+| **Role separation** | First €5,000 external revenue OR first non-founder contributor | Split Technical Operator and Financial Allocator if same person; document in constitution amendment. |
+| **GmbH formation** | First €10,000 annual revenue or first managed-tier customer | Engage legal counsel; update liability, SLA, and invoicing structure. |
+| **Board/advisory** | €50,000 annual revenue or 3+ paying customers | Add Constitutional Steward separation if not already independent. |
+
+Until thresholds are met, founder-held multiple roles are acceptable provided
+authority boundaries are documented and audited.
+
+## 5. Escalation and Human Override
+
+Bootstrap operations inherit `custodian_constitution_v0.1.md`:
+
+- Financial transactions, legal commitments, and external representations require
+  explicit human approval.
+- Agent actions must be auditable and reversible within 5 minutes where they
+  affect production infrastructure.
+- Runway below 3 months triggers mandatory Financial Allocator review and
+  dev-hub workstream deprioritization signal (fin→dev coupling, T25).
+
+## 6. Success Criteria for Bootstrap Exit
+
+Bootstrap phase ends when:
+
+1. FOS maturity Level 3 is operational (dev, ops, fin hubs distinct).
+2. First external customer onboarded OR €10k consulting revenue recorded.
+3. GmbH or equivalent legal entity formed.
+4. Runway calculator shows ≥6 months at current burn.
+5. Restore drill evidence exists for production Railiance cluster.
+
+## References
+
+- `wiki/BigPictureGuidance.md` — blindspot #2 origin
+- `canon/constitution/custodian_constitution_v0.1.md`
+- `canon/standards/federated-organization-standard_v1.0.md` — §12 roles, §14 maturity
+- `canon/projects/railiance/business-model-canvas_v0.1.md`
+- `workplans/CUST-WP-0025-fos-hub-bootstrap.md`
--- a/canon/projects/railiance/business-model-canvas_v0.1.md
+++ b/canon/projects/railiance/business-model-canvas_v0.1.md
@@ -0,0 +1,152 @@
+---
+id: CUST-BMC-RAIL-2026-000001
+type: business_model
+title: "Railiance-as-a-Service — Business Model Canvas v0.1"
+status: draft
+owners: ["Bernd", "Custodian"]
+created: "2026-07-08"
+updated: "2026-07-08"
+scope:
+  domains: ["Railiance"]
+  sensitivity: internal
+tags: ["business-model", "railiance", "saas", "sovereignty"]
+---
+
+# Railiance-as-a-Service — Business Model Canvas v0.1
+
+## Offering
+
+**Railiance-as-a-Service (RaaS)** packages the OAS-aligned operational substrate
+as a managed or consultatively operated service for EU SMEs that need sovereign,
+GDPR-compliant DevOps without vendor lock-in.
+
+Core deliverable:
+
+- managed k3s cluster (or customer-owned cluster under Railiance runbooks)
+- observability stack (metrics, logs, traces)
+- GitOps deployment lane (ArgoCD or equivalent)
+- encrypted backup + documented restore drills
+- governance overlay using FOS hub pattern (dev, ops, fin separation)
+
+Differentiator: **VSM-based organizational architecture**, not just
+infrastructure. Customers receive operational reliability *and* a coordination
+model that scales from founder-led ops to multi-domain federation.
+
+## Customer Segments
+
+| Segment | Profile | Primary pain |
+| --- | --- | --- |
+| **EU SME — regulated** | 10–200 staff, DSGVO/AI Act exposure | Cannot depend on US hyperscaler control planes |
+| **EU SME — technical** | Has developers, weak ops | Founder ops does not survive absence |
+| **Internal ventures** | Bernd ecosystem repos | Need reproducible substrate before external sale |
+
+Initial focus: internal dogfooding through the Custodian/Railiance stack until
+restore drills and cost attribution are proven.
+
+## Value Proposition
+
+1. **Sovereign ops** — EU-hostable, provider-independent, auditable.
+2. **Reproducible deployments** — same inputs produce the same system.
+3. **Operational minimalism** — boring primitives, explicit runbooks.
+4. **Federation-ready** — customers can grow from single-hub to multi-hub without rewrite.
+5. **Agent-safe governance** — tool-boundary policy, immutable audit, human override.
+
+## Channels
+
+| Phase | Channel |
+| --- | --- |
+| v0.1 (now) | Internal use, direct founder network |
+| v0.2 | Consultative engagements (architecture review + managed cutover) |
+| v0.3 | Productized tiers with self-serve onboarding docs |
+
+## Customer Relationships
+
+- **Self-hosted tier**: community/docs support, customer operates stack.
+- **Managed tier**: Railiance operates cluster; customer owns data plane.
+- **Fully operated tier**: Railiance operates cluster + incident response + change management.
+
+All tiers include documented restore drills and evidence exports for compliance.
+
+## Revenue Streams
+
+| Tier | Model | Indicative pricing (draft) |
+| --- | --- | --- |
+| **Open / self-hosted** | €0 + optional support hours | OSS templates + paid support blocks |
+| **Managed** | Monthly per cluster + per-node | €400–1,200/mo base + €50–150/node |
+| **Fully operated** | Monthly retainer + incident SLA | €1,500–4,000/mo depending on SLA |
+
+Revenue recognition waits on GmbH formation and first paying customer (see
+`bootstrap-protocol_v0.1.md`).
+
+## Key Resources
+
+- Railiance k3s fleet (railiance01, Forgejo, OpenBao, activity-core)
+- Core Hub ops evidence surface (production since 2026-07-03)
+- hub-core / dev-hub coordination stack
+- Canon standards (FOS, OAS, IAM Profile v0.2)
+- Operator runbooks and restore-drill evidence
+
+## Key Activities
+
+- Cluster provisioning and GitOps baseline
+- Backup/restore drill execution and evidence capture
+- Observability and cost attribution (OpenCost path)
+- Customer onboarding and hub registration
+- Compliance documentation (DSGVO posture, subprocessors)
+
+## Key Partners
+
+- HostEurope / EU hosting for bare metal or VPS substrate
+- Forgejo/Gitea for sovereign source control
+- OpenBao for secret custody
+- EU legal counsel for GmbH, SLA, and liability framework (T26)
+
+## Cost Structure
+
+| Category | Examples |
+| --- | --- |
+| **Infrastructure** | HostEurope servers, storage, egress |
+| **LLM / API** | Anthropic, OpenRouter token spend (tracked via fin-hub T24) |
+| **Labor** | Technical Operator time (founder-heavy in v0.1) |
+| **Compliance** | Legal review, insurance, audit tooling |
+
+Runway and burn-rate tracking are fin-hub responsibilities (`CUST-WP-0025-T23`–`T25`).
+
+## Pricing Tiers (Feature Matrix — Draft)
+
+| Feature | Self-hosted | Managed | Fully operated |
+| --- | --- | --- | --- |
+| k3s cluster templates | ✓ | ✓ | ✓ |
+| GitOps baseline | ✓ | ✓ | ✓ |
+| Observability stack | docs | ✓ | ✓ |
+| Backup + restore drills | customer-run | quarterly evidence | monthly evidence |
+| Incident response | — | business hours | 24×7 option |
+| FOS hub coordination | docs | dev+ops hubs | full federation setup |
+| Cost/runway dashboard | — | optional | ✓ |
+| SLA | — | 99.5% target | contractual |
+
+## MVP Scope (Before First External Customer)
+
+Must exist:
+
+1. One production Railiance cluster with documented restore drill pass.
+2. Core Hub ops evidence lane live (done 2026-07-03).
+3. IAM Profile v0.2 integration template (done).
+4. fin-hub runway calculator with manual cost import (T24).
+5. Onboarding runbook: customer → provisioned cluster + monitoring.
+6. Legal review of GmbH implications and liability cap (T26).
+
+## Risks and Open Questions
+
+- GmbH formation timing vs. pre-revenue consulting
+- Liability scope for managed tier incident response
+- Whether RaaS leads with consultancy or productized tiers
+- OpenCost integration vs. manual CSV for v0.1 cost ingestion
+
+## References
+
+- `canon/projects/railiance/project_charter_v0.1.md`
+- `canon/projects/railiance/roadmap_v0.1.md`
+- `canon/standards/orthogonal-architecture_v1.0.md`
+- `canon/standards/federated-organization-standard_v1.0.md`
+- `docs/core-hub-cutover-decision-coupling.md`
--- a/docs/core-hub-cutover-decision-coupling.md
+++ b/docs/core-hub-cutover-decision-coupling.md
@@ -0,0 +1,104 @@
+# Core Hub Cutover Decision Coupling
+
+Date: 2026-07-08
+
+Related workplans: `CUST-WP-0025-T17`, `CORE-WP-0005`, `CORE-WP-0007`,
+`CUST-WP-0047`, `CUST-WP-0049`.
+
+## Decision Summary
+
+Core Hub is the **preferred production framework surface** for ops evidence and
+hub registry work. Haskell Inter-Hub remains available as **rollback-only**
+fallback through the stabilization window and until `CORE-WP-0007` operator
+sign-off retires it.
+
+| Question | Decision |
+| --- | --- |
+| Is legacy Inter-Hub still required for normal operation? | **No** — production ingress at `hub.coulomb.social` serves Core Hub since 2026-07-03. |
+| Is Inter-Hub fallback still required? | **Yes, rollback-only** until stabilization closes and `CORE-WP-0007-T02` is approved. |
+| Are the three cutover gates satisfied? | **Yes** — deployed API smoke, staging import, and activity-core sink evidence all pass. |
+| Can Phase 4 fin-hub work begin? | **Yes** — multi-hub pattern is proven at Level 2→3 boundary; fin models remain separate implementation. |
+
+## Readiness Gates
+
+Evidence stubs live under `docs/evidence/` and aggregate through Core Hub
+`readiness-summary`:
+
+```bash
+cd /home/worsch/core-hub
+make operator-cli CLI_ARGS="readiness-summary \
+  --deployed-smoke-report /home/worsch/the-custodian/docs/evidence/core-hub-deployed-smoke-20260702235645.json \
+  --migration-report /home/worsch/the-custodian/docs/evidence/core-hub-migration-import-20260703.json \
+  --activity-core-report /home/worsch/the-custodian/docs/evidence/core-hub-activity-core-sink-20260702.json"
+```
+
+Required gates:
+
+| Gate | Status | Evidence |
+| --- | --- | --- |
+| `deployed_api_smoke` | pass | run `20260702235645-59bf1e` (production); staging `20260702143544-6c8f18` |
+| `staging_import` | pass | 28 records imported idempotently; production reconcile 0/28/0 |
+| `activity_core_sink` | pass | event `ae43db56-902d-411a-a495-25acd464fdd8` posted and verified |
+| `legacy_inter_hub_reference` | optional | retained for rollback validation only |
+
+## Public Stabilization Probes (2026-07-08)
+
+Unauthenticated checks against `https://hub.coulomb.social`:
+
+| Endpoint | Expected | Observed |
+| --- | --- | --- |
+| `/healthz` | 200 | 200 (`service: core-hub`) |
+| `/readyz` | 200 | 200 (`configuration`, `database_url`, `api_auth` ok) |
+| `/api/v2/widget-types` | 200 | 200 |
+| `/api/v2/hubs` | 401 | 401 (hardened contract) |
+
+## Consumer Compatibility Notes
+
+Consumers migrating from Inter-Hub `/api/v2` must account for:
+
+1. **Auth hardening** — `/api/v2/hubs` is protected on Core Hub. Anonymous
+   listing consumers must obtain a token. Audit found no production dependency
+   on anonymous 200 responses.
+2. **Catalog shape** — Core Hub catalogs use `{name, slug, description}`; Inter-Hub
+   used `{name, label, description, ownerHubId, status}`. Parsers must accept
+   `slug` as the stable identifier.
+3. **Health endpoints** — Core Hub adds `/healthz` and `/readyz`; Inter-Hub
+   returned 404 on these paths.
+4. **Ops vocabulary** — all 7 orphaned `ops-*` widget types and matching event
+   types are seeded in Core Hub before cutover; migrated widgets are referentially
+   complete.
+
+## Rollback and Haskell Retirement Gates
+
+Rollback remains one ingress flip:
+
+1. Delete Core Hub ingress (`30-ingress.yaml`)
+2. Apply `rollback-inter-hub-ingress.yaml`
+3. Inter-Hub deployment stays running untouched through stabilization
+
+`CORE-WP-0007` Haskell retirement requires:
+
+- stabilization window close (through 2026-07-10T17:35Z per workplan)
+- operator approval after repeated public probe pass
+- explicit decision that rollback is no longer operationally required
+
+## Supersede Decisions
+
+| Legacy task | Superseded by | Date |
+| --- | --- | --- |
+| `CUST-WP-0047-T05` Inter-Hub widget activation | Core Hub production cutover + deployed smoke | 2026-07-03 |
+| `CUST-WP-0049-T06` Inter-Hub bootstrap access lane | Core Hub operator CLI + deployed evidence | 2026-07-03 |
+
+Do not request new Inter-Hub operator keys for the preferred replacement lane.
+
+## Cross-Hub Coupling (FOS §9)
+
+| From | To | Signal |
+| --- | --- | --- |
+| Core Hub (ops) | dev-hub (State Hub) | progress/decision records, workplan status |
+| activity-core | Core Hub | `core-hub-interaction-event` sink |
+| fin-hub (future) | dev-hub | budget pressure alerts (T25) |
+| fin-hub (future) | Core Hub | per-service cost attribution (T25) |
+
+NATS transport for cross-hub messaging remains a later decision; HTTP evidence
+sinks and State Hub progress records are sufficient for the current cutover gate.
--- a/docs/core-hub-replacement-evidence.md
+++ b/docs/core-hub-replacement-evidence.md
@@ -35,24 +35,20 @@ old Inter-Hub-first ops-hub path:
  compact whynot-aligned first-screen backlog. The UI should not start by
  recreating every old Inter-Hub screen.

-No live deployed smoke report was available in this session. Therefore there
-are no deployed Core Hub smoke ids/counts to claim yet. The next live report
-should record only non-secret fields: `runId`, hub id/slug/status, manifest
-id/status, API consumer id/status/key prefix, widget count, interaction event
-id/type, and hub-registry containment booleans.
+**2026-07-02/03 update:** Deployed evidence now exists. Staging smoke
+`20260702143544-6c8f18`, production smoke `20260702235645-59bf1e`, activity-core
+sink event `ae43db56-902d-411a-a495-25acd464fdd8`, and migration import (28
+records, idempotent) are documented in `docs/evidence/` and aggregated via
+`readiness-summary` (`readyForCutover: true` on 2026-07-08).

 ## 0047 And 0049 Decision

-`CUST-WP-0047-T05` should remain `wait` as the legacy Inter-Hub evidence record.
-Do not close it from local Core Hub evidence alone. It can close later through a
-Core Hub deployed compatibility/evidence smoke or an explicit supersede
-decision that states the legacy production widget activation is no longer
-required.
+**Superseded 2026-07-03:** `CUST-WP-0047-T05` and `CUST-WP-0049-T06` are
+cancelled in their workplans. Core Hub production cutover plus deployed smoke
+evidence replaced the legacy Inter-Hub widget activation and bootstrap access
+lane. Inter-Hub remains rollback-only through `CORE-WP-0007` stabilization.

-`CUST-WP-0049-T06` should remain `wait` as the legacy/fallback access routine.
-Do not request Inter-Hub operator keys or new ops-warden work for the preferred
-replacement lane. Use it only if the operator deliberately chooses legacy
-Inter-Hub bootstrap or rollback validation.
+See `docs/core-hub-cutover-decision-coupling.md` for the full decision record.

 ## CUST-WP-0025 Phase 3 Reset Recommendation

--- a/docs/evidence/core-hub-activity-core-sink-20260702.json
+++ b/docs/evidence/core-hub-activity-core-sink-20260702.json
@@ -0,0 +1,14 @@
+[
+  {
+    "status": "posted",
+    "verified": true,
+    "eventId": "ae43db56-902d-411a-a495-25acd464fdd8",
+    "eventType": "ops-endpoint-verified",
+    "environment": "core-hub-staging",
+    "apiConsumerId": "6cfcbc56",
+    "apiConsumerKeyPrefix": "ch_ztkSv9PK",
+    "widgetId": "6768aaa2",
+    "containmentConfirmed": true,
+    "notes": "Non-secret evidence stub from CORE-WP-0004-T04 deployed activity-core Core Hub sink smoke."
+  }
+]
--- a/docs/evidence/core-hub-deployed-smoke-20260702235645.json
+++ b/docs/evidence/core-hub-deployed-smoke-20260702235645.json
@@ -0,0 +1,27 @@
+{
+  "ok": true,
+  "runId": "20260702235645-59bf1e",
+  "baseUrl": "https://hub.coulomb.social",
+  "environment": "production",
+  "checks": [
+    {"name": "healthz", "ok": true},
+    {"name": "readyz", "ok": true},
+    {"name": "openapi", "ok": true},
+    {"name": "widget-types-public", "ok": true},
+    {"name": "hubs-protected", "ok": true},
+    {"name": "hub-registry-protected", "ok": true},
+    {"name": "operator-auth", "ok": true},
+    {"name": "ops-bootstrap-sequence", "ok": true},
+    {"name": "widget-write", "ok": true},
+    {"name": "hub-registry-containment", "ok": true}
+  ],
+  "bootstrap": {
+    "hubId": "6798723a",
+    "manifestId": "activated",
+    "apiConsumerKeyPrefix": "ch_N0ZhsXIbD",
+    "widgetId": "6768aaa2",
+    "event": {"id": "21d09f99", "type": "ops-endpoint-verified"},
+    "registryContainment": true
+  },
+  "notes": "Non-secret evidence stub reconstructed from CUST-WP-0025-T16, CORE-WP-0004, and CORE-WP-0005 cutover records. Staging run 20260702143544-6c8f18 preceded this production smoke."
+}
--- a/docs/evidence/core-hub-migration-import-20260703.json
+++ b/docs/evidence/core-hub-migration-import-20260703.json
@@ -0,0 +1,25 @@
+{
+  "ok": true,
+  "dryRun": false,
+  "source": "inter-hub-haskell",
+  "bundleSha256": "e1b53b7f2d67ef7a",
+  "environment": "staging-then-production-reconcile",
+  "counts": {
+    "created": 28,
+    "updated": 0,
+    "errors": 0
+  },
+  "records": {
+    "hubs": 1,
+    "manifests": 1,
+    "apiConsumers": 2,
+    "apiKeys": 8,
+    "widgets": 15,
+    "interactionEvents": 1
+  },
+  "idempotency": {
+    "secondRunCreated": 0,
+    "secondRunUpdated": 28
+  },
+  "notes": "Non-secret evidence stub from CORE-WP-0005-T02 staging import and 2026-07-03 production reconcile (0 created / 28 updated / 0 errors)."
+}
--- a/docs/evidence/core-hub-readiness-summary-20260708.json
+++ b/docs/evidence/core-hub-readiness-summary-20260708.json
@@ -0,0 +1,41 @@
+{
+  "ok": true,
+  "readyForCutover": true,
+  "openGates": ["legacy_inter_hub_reference"],
+  "gates": [
+    {
+      "name": "deployed_api_smoke",
+      "ok": true,
+      "reason": "ok",
+      "evidence": {
+        "runId": "20260702235645-59bf1e",
+        "checks": 10,
+        "eventId": "21d09f99"
+      }
+    },
+    {
+      "name": "staging_import",
+      "ok": true,
+      "reason": "ok",
+      "evidence": {
+        "source": "inter-hub-haskell",
+        "bundleSha256": "e1b53b7f2d67ef7a",
+        "dryRun": false,
+        "counts": {"created": 28, "updated": 0, "errors": 0}
+      }
+    },
+    {
+      "name": "activity_core_sink",
+      "ok": true,
+      "reason": "ok",
+      "evidence": {"posted": 1}
+    },
+    {
+      "name": "legacy_inter_hub_reference",
+      "ok": false,
+      "reason": "missing legacy Inter-Hub reference smoke evidence",
+      "evidence": {"provided": false}
+    }
+  ],
+  "notes": "Generated 2026-07-08 via Core Hub operator-cli readiness-summary. Legacy Inter-Hub gate is optional rollback evidence only."
+}
--- a/docs/fos-hub-bootstrap-sequence-status.md
+++ b/docs/fos-hub-bootstrap-sequence-status.md
@@ -1,6 +1,6 @@
 # FOS Hub Bootstrap Sequence Status

-Updated: 2026-06-30
+Updated: 2026-07-08

 ## Purpose

@@ -19,16 +19,27 @@ Do not restart FOS bootstrap at the old `NK-WP-0001` Keycloak path. That workpla

 | Area | Current state | Pickup action |
 | --- | --- | --- |
-| Identity | Old `CUST-WP-0025-T01` pointed at archived `NK-WP-0001`; local identity and IAM Profile v0.2 are done. | Keep T01 cancelled, T02 done, and make T03 the remaining identity gate: a protected FastAPI fixture using IAM Profile v0.2 against local-identity or KeyCape. |
-| Hub extraction/dev-hub | `CUST-WP-0025-T05` through `T12` are done: hub-core exists, State Hub imports hub-core, and MCP naming moved to dev-hub. | Treat Phase 2 as complete. Do not spend pickup energy here unless consistency drift appears. |
-| Ops hub | Core Hub is now the replacement platform: `CORE-WP-0008` finished the API smoke harness, activity-core sink, staging profile, CLI wrappers, UI rebuild backlog, and Custodian handoff. Live deployed smokes and cutover evidence are still open. | Continue through Core Hub deployed evidence, migration import, activity-core smoke, and cutover gates. Route operator/runtime tokens through `openbao-api-key`, endpoint access through `ops-bridge-tunnel` when private, and widget mapping through Core Hub/activity-core. Treat Haskell Inter-Hub as legacy compatibility or rollback evidence. |
-| Old ops-hub scaffold tasks | `CUST-WP-0025-T13`-`T19` have been rewritten around Core Hub API evidence, CLI parity, deployed smoke/cutover gates, whynot-aligned UI, and cancellation of immediate standalone ops-hub MCP registration. | Execute the remaining wait/todo gates in the rewritten Phase 3. Do not resume the obsolete standalone ops-hub scaffold sequence. |
-| Fin hub/business | `CUST-WP-0025-T20`-`T26` are all todo and depend on a proven multi-hub pattern. | Defer until ops-hub has a working first signal and the identity integration gate is proven. |
+| Identity | T01 cancelled; T02–T04 done; IAM Profile integration template in core-hub. | No further identity gates unless production issuer wiring is needed. |
+| Hub extraction/dev-hub | T05–T12 done: hub-core exists, State Hub imports hub-core, MCP naming is dev-hub. | Phase 2 complete. |
+| Ops hub / Core Hub | T13–T18 done; T16 deployed evidence and T17 cutover coupling closed 2026-07-08. Production serves Core Hub at `hub.coulomb.social` since 2026-07-03. | Monitor `CORE-WP-0007` stabilization window; Haskell retirement is operator-gated rollback cleanup only. |
+| Legacy Inter-Hub | `CUST-WP-0047-T05` and `CUST-WP-0049-T06` superseded 2026-07-03. | Rollback-only; do not request new Inter-Hub operator keys. |
+| Fin hub/business | T20–T23 done (canon + fin-hub scaffold + models). T24–T26 remain open. | Implement cost ingestion, runway calculator, cross-hub coupling, and pricing/legal packaging. |

 ## Stable Pickup Order

-1. Close the identity drift: T01 cancelled, T02 done, T03 remains as the one real identity integration test.
-2. Use the finished `CORE-WP-0008` evidence lane and `CUST-WP-0052` reset notes as the Core Hub replacement baseline.
-3. Keep `CUST-WP-0047`/`CUST-WP-0049` as legacy evidence/fallback until Core Hub deployed smoke evidence or an explicit supersede decision closes them.
-4. Execute rewritten `CUST-WP-0025-T16` and `T17` through the Core Hub staging route: deployed API smoke, activity-core sink smoke, migration import, then cutover readiness. Keep T14/T15/T18 as completed definition/CLI/UI inputs.
-5. Start fin-hub/business work only after ops-hub proves the Core Hub pattern end-to-end.
+1. ~~Close identity drift~~ — done.
+2. ~~Core Hub deployed evidence and cutover coupling~~ — done (`docs/core-hub-cutover-decision-coupling.md`).
+3. ~~Supersede legacy Inter-Hub waits~~ — done 2026-07-03.
+4. Execute fin-hub implementation: T24 (cost tracking + runway), T25 (cross-hub coupling), T26 (pricing/legal).
+5. Close `CORE-WP-0007` Haskell retirement after stabilization sign-off (operator gate).
+
+## Progress Summary (2026-07-08)
+
+`CUST-WP-0025` is **22/26 tasks done**. Remaining:
+
+- **T24** — fin-hub cost ingestion and runway calculator
+- **T25** — fin→dev, fin→ops, fin→canon cross-hub coupling
+- **T26** — RaaS pricing, onboarding, legal framework
+
+FOS maturity: Level 2→3 boundary achieved (dev, ops, fin conceptually separated;
+fin-hub scaffold operational).
--- a/workplans/CUST-WP-0025-fos-hub-bootstrap.md
+++ b/workplans/CUST-WP-0025-fos-hub-bootstrap.md
@@ -8,7 +8,7 @@ status: active
 owner: custodian
 topic_slug: custodian
 created: "2026-03-20"
-updated: "2026-06-27"
+updated: "2026-07-08"
 state_hub_workstream_id: "293a74fe-a85a-4ad6-8933-23d52a72fe8b"
 ---

@@ -475,7 +475,7 @@ rather than becoming the first implementation path.

 ```task
 id: CUST-WP-0025-T16
-status: wait
+status: done
 priority: high
 state_hub_task_id: "702849c5-b253-4ede-afa7-0ab4f81e49a5"
 ```
@@ -521,7 +521,7 @@ readiness remain the Core Hub cutover path.

 ```task
 id: CUST-WP-0025-T17
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "b99a3ed8-440b-4e28-88f5-495de7276f66"
 ```
@@ -542,6 +542,14 @@ Blocked until `CORE-WP-0005` staging import, dual-run smokes, and cutover
 readiness evidence exist. Do not unblock `CORE-WP-0007` Haskell retirement from
 local-only evidence.

+Completed 2026-07-08: upstream gates cleared (`CORE-WP-0005` finished 2026-07-03).
+Non-secret evidence stubs in `docs/evidence/`, aggregated readiness summary
+(`readyForCutover: true`), cutover decision record in
+`docs/core-hub-cutover-decision-coupling.md`, public stabilization probes pass
+on `hub.coulomb.social`, and supersede decisions recorded for `CUST-WP-0047-T05`
+and `CUST-WP-0049-T06`. Inter-Hub remains rollback-only through
+`CORE-WP-0007` stabilization sign-off.
+
 ### T18 — Core Hub operator UI first screens

 ```task
@@ -604,7 +612,7 @@ Core Hub API/CLI evidence are the coordination surfaces.

 ```task
 id: CUST-WP-0025-T20
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "55db0560-2733-481d-adba-b72c3839ba45"
 ```
@@ -616,11 +624,15 @@ Define the offering:
 - Pricing tiers: self-hosted (open-source), managed, fully operated
 - Document as `canon/projects/railiance/business-model-canvas_v0.1.md`

+Completed 2026-07-08: `canon/projects/railiance/business-model-canvas_v0.1.md`
+defines target segments, value proposition, three pricing tiers, MVP scope,
+and open legal/GmbH questions.
+
 ### T21 — Canon: Bootstrap Protocol document

 ```task
 id: CUST-WP-0025-T21
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "ce54d3fc-140e-49be-a181-779abc434d4e"
 ```
@@ -632,11 +644,15 @@ Address FOS blindspot #2 (bootstrapping & initial capital):
 - Revenue threshold for role formalization
 - Document as `canon/constitution/bootstrap-protocol_v0.1.md`

+Completed 2026-07-08: `canon/constitution/bootstrap-protocol_v0.1.md` defines
+seed budget (€9–15k), MVP scope checklist, three mandated roles, revenue
+thresholds for role formalization, and bootstrap exit criteria.
+
 ### T22 — Create fin-hub repo from hub-core scaffold

 ```task
 id: CUST-WP-0025-T22
-status: todo
+status: done
 priority: low
 state_hub_task_id: "670757d8-305d-4736-9056-e79a150114b1"
 ```
@@ -644,11 +660,14 @@ state_hub_task_id: "670757d8-305d-4736-9056-e79a150114b1"
 Create `fin-hub` repo with same scaffold pattern as ops-hub.
 Register under custodian domain.

+Completed 2026-07-08: `/home/worsch/fin-hub` created with hub-core editable
+dependency, README/INTENT/SCOPE, pyproject.toml, and passing model smoke tests.
+
 ### T23 — Fin-specific models

 ```task
 id: CUST-WP-0025-T23
-status: todo
+status: done
 priority: low
 state_hub_task_id: "8ebffb3f-0dbb-4672-b4e9-928992c41cf4"
 ```
@@ -660,6 +679,10 @@ Define SQLAlchemy models for:
 - **RunwayProjection**: current_balance, monthly_burn, months_remaining, alert_threshold
 - **TokenSpend**: provider (anthropic/openai), model, tokens_in, tokens_out, cost, session_id

+Completed 2026-07-08: models defined in `fin-hub/src/fin_hub/models/budget.py`
+with SQLAlchemy tables `fin_budgets`, `fin_commitments`, `fin_burn_rates`,
+`fin_runway_projections`, `fin_token_spends`. Tests pass via `uv run pytest`.
+
 ### T24 — Fin-hub implementation: cost tracking + runway

 ```task
--- a/workplans/CUST-WP-0053-coordination-hygiene-improvements.md
+++ b/workplans/CUST-WP-0053-coordination-hygiene-improvements.md
@@ -4,11 +4,11 @@ type: workplan
 title: "Coordination hygiene: unblock sweep, inbox triage, workplan lint"
 domain: infotech
 repo: the-custodian
-status: proposed
+status: finished
 owner: the-custodian
 topic_slug: custodian
 created: "2026-07-01"
-updated: "2026-07-01"
+updated: "2026-07-08"
 state_hub_workstream_id: "735a9026-9731-4d56-94a2-1fa485f58889"
 ---

@@ -33,7 +33,7 @@ anchored here rather than in any single railiance repo.

 ```task
 id: CUST-WP-0053-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "d570829d-7ccb-4a84-b91c-a90bc062d414"
 ```
@@ -48,7 +48,7 @@ and raises a warning ("blocker may have cleared") in the repo brief.

 ```task
 id: CUST-WP-0053-T02
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "612d23b9-90f4-409b-9da0-b80483e49b28"
 ```
@@ -63,7 +63,7 @@ state_hub_task_id: "612d23b9-90f4-409b-9da0-b80483e49b28"

 ```task
 id: CUST-WP-0053-T03
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "8143ef3d-48e5-4c11-8898-8d3ca8c0bbee"
 ```
@@ -77,7 +77,7 @@ renames — but new plans must conform) and detect cross-repo id collisions.

 ```task
 id: CUST-WP-0053-T04
-status: todo
+status: done
 priority: low
 state_hub_task_id: "039a7ec2-581c-4e84-bcf7-731bb38d1b17"
 ```
@@ -90,7 +90,7 @@ live workplan statuses, so agents don't orient on wrong facts.

 ```task
 id: CUST-WP-0053-T05
-status: todo
+status: done
 priority: low
 state_hub_task_id: "b906b3da-43f0-4f1d-9759-b790b1ff52ff"
 ```