docs: accept workload projection interface

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0230c-b06c-7641-808a-e191b6d1da49

workplans/HUB-WP-0007-workload-projection-transport.md

@@ -0,0 +1,105 @@
+---
+id: HUB-WP-0007
+type: workplan
+title: "Authoritative workload projection transport"
+domain: infotech
+repo: hub-core
+status: active
+owner: codex
+topic_slug: custodian
+created: "2026-08-23"
+updated: "2026-08-23"
+parent_workplan: RMGR-WP-0010
+related:
+  - HUB-WP-0006
+  - RMGR-WP-0010-T04
+  - RMGR-CONTRACT-WORKLOAD-REFERENCE-0001
+---
+
+# Authoritative workload projection transport
+
+## Goal
+
+Transport Repo Manager's authoritative workload index through hub-core's
+rebuildable cross-repository projection port without transferring workload
+semantics, exposing Repo Manager persistence, or inferring identities.
+
+## Approve and pin the owner interface
+
+```task
+id: HUB-WP-0007-T01
+status: done
+priority: medium
+```
+
+Disposition: **approved** on 2026-08-23 by operator instruction to implement.
+The accepted owner interface is
+`helixforge.workloads.projection-transport.v1` at Repo Manager revision
+`890f3b05b596047a31605c544c56ed8a4f011868`; its authoritative workload
+contract implementation is revision
+`b36b68bc5747aaeea412079c737f9f7e9d4b7dfb`. Validation passed with one
+owner-ready interface and no errors. Hub-core accepts the objective,
+deliverables, constraints, acceptance criteria, and verification without
+reconstructing Repo Manager work.
+
+## Freeze the normalized transport contract
+
+```task
+id: HUB-WP-0007-T02
+status: progress
+priority: medium
+```
+
+Package a strict versioned input/output contract for records keyed by exact
+`rapp_id` plus `workload_identity.name`, optional deployable membership,
+source repository, declaration path, source Git revision, and canonical UTC
+observation time. Preserve Repo Manager diagnostics and reject unsupported
+versions or inferred identity.
+
+## Implement durable rebuildable ingestion
+
+```task
+id: HUB-WP-0007-T03
+status: todo
+priority: medium
+```
+
+Extend the injected `port.repo` boundary with workload pages. Deterministically
+replace the active generation in PostgreSQL, retain source/rebuild provenance
+and a canonical content hash, and keep the previous generation on invalid or
+unavailable input.
+
+## Expose exact read-only HTTP and MCP resolution
+
+```task
+id: HUB-WP-0007-T04
+status: todo
+priority: medium
+```
+
+Expose list and exact-reference queries through `port.projection.query` and
+matching MCP tools. Exact resolution returns `resolved` or `unknown` without
+repository-name, owner, alias, or path inference. No workload mutation route is
+permitted.
+
+## Prove conformance and hand off
+
+```task
+id: HUB-WP-0007-T05
+status: todo
+priority: medium
+```
+
+Ingest a nine-declaration Repo Manager fixture; prove deletion plus full rebuild
+equivalence, unknown-reference behavior, canonical UTC timestamps, durable
+reopen, provenance, deterministic hashes/order, read-only OpenAPI, and absence
+of Repo Manager private-model or foreign-database coupling. Run `make test` and
+`make conformance`, then reply with owner identifiers and evidence.
+
+## Acceptance
+
+- [x] Owner interface disposition and source revisions recorded
+- [ ] Normalized transport contract is versioned and packaged
+- [ ] Durable projection rebuild preserves authority and provenance
+- [ ] HTTP/MCP exact reference queries never infer identity
+- [ ] Nine-declaration and rebuild conformance evidence passes