Harden SBOM retries and align hub evidence

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f

docs/runbook.md

@@ -595,9 +595,15 @@ export FORGEJO_TOKEN=$(bao kv get -field=API_TOKEN platform/workloads/forgejo/fo
 fleet-wide `for_each: context.repos.repos` emitted 75 tasks on 2026-08-17 and
 must not be re-enabled. The bounded replacement is `daily-sbom-catchup`, active
 weekdays at 09:15 Europe/Berlin. It makes one ranked sbom-nexus request,
-processes at most three terminal ingest/skip outcomes, and emits no tasks. Two
-production proof fires on 2026-08-22 processed six distinct repositories as
-documented `no-checkout` skips with zero task spawns; see
+records that read-only selection in workflow history, and processes at most
+three terminal ingest/skip outcomes in a dedicated heartbeat-enabled activity.
+Retries retain the same fixed targets and resume acknowledged outcomes. Each
+write carries a stable per-run/per-repository `Idempotency-Key`; an ambiguous
+response fails the activity and is not converted into a synthetic skip. Until
+sbom-nexus enforces that key, a worker crash after a committed POST but before
+the next heartbeat remains a possible duplicate-write window. The automation
+emits no tasks. Two production proof fires on 2026-08-22 processed six distinct
+repositories as documented `no-checkout` skips with zero task spawns; see
 `docs/evidence/ACTIVITY-WP-0030-daily-sbom-catchup-2026-08-22.md`.
 
 `weekly-coding-retro` follows the same cron -> context resolver -> per-repo task
@@ -617,8 +623,18 @@ when the workflow completes cleanly twice in a row.
 
 ## Ops inventory evidence posture
 
-The current accepted live backend for activity-core ops inventory probes is
-State Hub progress with `event_type=ops_inventory_probe`.
+Hub-core has been the production runtime authority since 2026-08-21. The
+Railiance projection of the (still disabled) ops-inventory probe now writes
+sanitized evidence through canonical `port.events.interaction` using sink type
+`hub-core-interaction-event`. `HUB_CORE_BASE_URL` targets the in-cluster
+hub-core runtime. No widget mapping or Core Hub runtime token is required.
+
+The sink wraps the observation as catalog event `hub.interaction.recorded`,
+keeps the logical observation name in `payload.reported_event_type`, and reads
+the `interaction_events` projection after append to verify persistence. The old
+`core-hub-interaction-event` `/api/v2` sink remains implemented for rollback
+compatibility during CORE-WP-0010 stabilization, but is no longer the Railiance
+probe configuration.
 
 Inter-Hub / ops-hub per-entity submission remains intentionally deferred until
 all of these are true:

docs/state-hub-caller-map.md

@@ -13,7 +13,9 @@ activity-core stays the scheduler even when it is not the engine.
 
 Hub-core port names are from `helixforge.hub-extension` 0.1
 (`prj-state-hub-retirement/architecture/hub-extension-contract_v0.1.yaml`).
-HUB-WP-0004 has not shipped those ports yet.
+HUB-WP-0004 shipped the named ports on 2026-08-21; hub-core became production
+authority the same day. Core Hub remains a no-writer rollback only through the
+stabilization window ending no earlier than 2026-08-28.
 
 | Caller | Current URL | SHR-INV | Target owner | Port (when named) |
 | --- | --- | --- | --- | --- |
@@ -51,11 +53,25 @@ HUB-WP-0004 has not shipped those ports yet.
   (dual-run when `RM_RECONCILE` is on). Override with `CONSISTENCY_SWEEP_URL`
   or `REPO_MANAGER_URL` + optional `CONSISTENCY_SWEEP_PATH`.
 
-## Evidence sink (T03 — wait)
+## Evidence sink (T03 — aligned 2026-08-22)
 
-All `POST /progress/` callers stay on the State Hub beachhead until
-**HUB-WP-0004** publishes `port.events.progress` / `port.events.interaction`.
-Do not add a second permanent progress host.
+Ops-inventory evidence now has a canonical `hub-core-interaction-event` sink:
+
+- `POST /ports/events/interaction` with catalog event
+  `hub.interaction.recorded`;
+- the sanitized domain observation remains in
+  `payload.reported_event_type` (for example `ops_inventory_probe`);
+- append verification reads
+  `GET /ports/projections/interaction_events`; and
+- `HUB_CORE_BASE_URL` points at the surviving hub-core runtime. The Railiance
+  Service retains the compatibility name `core-hub-api` during stabilization,
+  but the process and authority behind it are hub-core.
+
+The legacy `core-hub-interaction-event` `/api/v2` sink remains available only
+for rollback compatibility. It is not the configured Railiance probe sink.
+Unmigrated general progress callers can continue through the State Hub
+beachhead during the retirement strangler; this task does not create a second
+permanent progress authority.
 
 ## Execution (T04)