add extension conformance residual

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

WORK-RECORDS.md

@@ -16,6 +16,7 @@
 | workplan | HUB-WP-0006 | active | — | workplans/HUB-WP-0006-repository-classification-navigation.md |
 | workplan | HUB-WP-0007 | finished | — | workplans/HUB-WP-0007-workload-projection-transport.md |
 | workplan | HUB-WP-0008 | finished | — | workplans/HUB-WP-0008-legacy-message-identity-reconciliation.md |
+| workplan | HUB-WP-0009 | proposed | — | workplans/HUB-WP-0009-extension-conformance-gaps.md |
 | task | HUB-WP-0001-T01 | done | — | workplans/HUB-WP-0001-statehub-bootstrap.md |
 | task | HUB-WP-0001-T02 | done | — | workplans/HUB-WP-0001-statehub-bootstrap.md |
 | task | HUB-WP-0001-T03 | done | — | workplans/HUB-WP-0001-statehub-bootstrap.md |
@@ -56,3 +57,7 @@
 | task | HUB-WP-0008-T03 | done | — | workplans/HUB-WP-0008-legacy-message-identity-reconciliation.md |
 | task | HUB-WP-0008-T04 | done | — | workplans/HUB-WP-0008-legacy-message-identity-reconciliation.md |
 | task | HUB-WP-0008-T05 | done | — | workplans/HUB-WP-0008-legacy-message-identity-reconciliation.md |
+| task | HUB-WP-0009-T01 | todo | — | workplans/HUB-WP-0009-extension-conformance-gaps.md |
+| task | HUB-WP-0009-T02 | todo | — | workplans/HUB-WP-0009-extension-conformance-gaps.md |
+| task | HUB-WP-0009-T03 | todo | — | workplans/HUB-WP-0009-extension-conformance-gaps.md |
+| task | HUB-WP-0009-T04 | todo | — | workplans/HUB-WP-0009-extension-conformance-gaps.md |

workplans/HUB-WP-0009-extension-conformance-gaps.md

@@ -0,0 +1,83 @@
+---
+id: HUB-WP-0009
+type: workplan
+title: "Complete the hub-extension conformance profile"
+domain: infotech
+repo: hub-core
+status: proposed
+owner: codex
+topic_slug: custodian
+created: "2026-08-31"
+updated: "2026-08-31"
+origin: residual
+origin_ref: OPS-WP-0003
+related:
+  - HUB-WP-0004
+  - HUB-WP-0005
+  - OPS-WP-0003
+---
+
+# Complete the hub-extension conformance profile
+
+## Goal
+
+Turn the deliberately open Tier-2 checks in
+`helixforge.hub-extension/0.1.0` into executable framework evidence without
+making an extension repository implement hub-core policy. OPS-WP-0003 passed
+the current C1/C3/C4/C5/C6/C8 profile; this residual owns C2, C7, C9, and C10.
+
+## Add registry resolution evidence
+
+```task
+id: HUB-WP-0009-T01
+status: todo
+priority: medium
+```
+
+Implement C2 against the public registry/discovery contract, including missing,
+ambiguous, and stale registrations. Keep repository and capability authority in
+their owner systems and make registry audit history queryable.
+
+## Enforce raw-port configuration policy
+
+```task
+id: HUB-WP-0009-T02
+status: todo
+priority: medium
+```
+
+Implement C7 so production configuration cannot bypass named ports or silently
+enable overlapping authorities. Cover policy allow, deny, and unavailable
+behavior without embedding credentials in fixtures.
+
+## Prove dependency-aware readiness
+
+```task
+id: HUB-WP-0009-T03
+status: todo
+priority: high
+```
+
+Implement C9 for every enabled port and compatibility group. Readiness must
+fail when its required database, policy, registry, or owner projection is
+unavailable while unrelated disabled groups remain non-blocking.
+
+## Add contract-version negotiation
+
+```task
+id: HUB-WP-0009-T04
+status: todo
+priority: medium
+```
+
+Implement C10 using descriptor min/max versions and explicit incompatibility
+responses. Include the 0.1 compatibility adapter and ensure future versions do
+not silently accept a contract they cannot interpret. Record tenant-isolation
+coverage separately if it still exceeds this profile.
+
+## Acceptance
+
+- [ ] C2, C7, C9, and C10 are automated and fail closed
+- [ ] The conformance report distinguishes unsupported from pass/fail
+- [ ] Ops Hub's canonical owner package passes the expanded profile
+- [ ] Any tenant-isolation residual has its own live owner record