docs: complete hub-core MCP and risk tools

docs/hub-core-extraction-boundary.md

@@ -79,6 +79,9 @@ Current implementation status:
   utilities needed before T06/T08.
 - 2026-06-07: `HubCoreMCPServer` was added as the first T06 slice. It wraps the
   generic REST endpoints with FastMCP tools and keeps the MCP layer stateless.
+- 2026-06-07: T06/T07 completed in hub-core with orientation and DoI MCP tools,
+  canonical FOS §10 risk/alert event types, `/progress/risks` and
+  `/progress/alerts` REST views, and matching MCP read tools.
 
 ## Extract Now
 
@@ -151,7 +154,7 @@ implementation is coupled to dev-hub concepts:
 | `ManagedRepo` | Contains `topic_id`, SBOM fields, and state-sync timestamps. Keep minimal repo identity in core, then add dev-hub extensions. |
 | `CapabilityRequest` | Adapter seam implemented with generic `request_context` and `fulfillment_context`; State Hub still needs a later refactor to map workstream/task references into those fields or a dev-hub extension table. |
 | `ProgressEvent` | Adapter seam implemented with generic `subject_refs`; State Hub still needs a later refactor to map topic/workstream/task/decision foreign keys into that field or a dev-hub extension table. |
-| MCP tools in `mcp_server/server.py` | Generic tools are mixed into a single dev-hub server module. T06 should create a base registration class that receives API client/config dependencies and lets dev-hub add its own tools. |
+| MCP tools in `mcp_server/server.py` | Generic tools are still mixed into the State Hub server module. T08 should begin replacing those registrations with `HubCoreMCPServer` inheritance or composition while dev-hub keeps its own tools. |
 
 The first two adapter seams are now implemented in hub-core:
 
@@ -186,6 +189,7 @@ to import it:
 
 ## Next Step
 
-Continue T06 by adding DoI and FOS §10 risk/alert surfaces, then return to
-`/home/worsch/state-hub` for the first import-based refactor. Do not rename
-State Hub to dev-hub until T05-T08 prove the shared package boundary.
+Start T08 by introducing `/home/worsch/hub-core` as an editable dependency of
+`/home/worsch/state-hub`, then replace the lowest-risk generic imports first.
+Do not rename State Hub to dev-hub until T05-T08 prove the shared package
+boundary.

workplans/CUST-WP-0025-fos-hub-bootstrap.md

@@ -195,7 +195,7 @@ and T08 State Hub import refactoring to begin.
 
 ```task
 id: CUST-WP-0025-T06
-status: in_progress
+status: done
 priority: high
 state_hub_task_id: "6b49d94a-b1ea-4507-a8a3-e27c1a918491"
 ```
@@ -213,15 +213,19 @@ Domain-specific hubs inherit and add their own tools.
 Implementation start (2026-06-07): added `HubCoreMCPServer` in
 `/home/worsch/hub-core` as a thin FastMCP wrapper over hub-core REST endpoints.
 The base class registers generic tools for domains, messages, capability
-catalog/requests, repos, TPSC, and progress. DoI tools remain a follow-up
-because the DoI cache/evaluator still lives in State Hub and has not yet moved
-into hub-core.
+catalog/requests, repos, TPSC, and progress.
+
+Completed MCP slice (2026-06-07): added the remaining orientation tools
+(`get_state_summary`, `get_domain_summary`), DoI passthrough tools
+(`check_repo_doi`, `get_doi_summary`), and FOS §10 risk/alert read tools to
+`HubCoreMCPServer`. The DoI evaluator still remains host-hub-owned, but the
+generic MCP contract now exposes the required DoI tools.
 
 ### T07 — FOS §10 risk and alert tools
 
 ```task
 id: CUST-WP-0025-T07
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "5a54af24-f7cb-451f-874f-66bd6979ab07"
 ```
@@ -233,6 +237,11 @@ ProgressEvent patterns. Define canonical event_type values:
 
 This completes the FOS §10 cross-hub contract.
 
+Completed (2026-06-07): added canonical FOS §10 event constants to
+`hub_core.events`, exposed `/progress/risks` and `/progress/alerts` filtered
+views, and registered matching `get_risks` / `get_alerts` MCP tools. Hub-core
+tests cover the event contract, router views, and MCP tool registration.
+
 ### T08 — Refactor state-hub to import from hub-core
 
 ```task