implement ops hub extension contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

docs/bootstrap-runbook.md

@@ -1,18 +1,20 @@
 # Ops Hub Bootstrap Runbook
 
-Date: 2026-06-17
+Date: 2026-08-31
 
 ## Purpose
 
 This runbook is the operator-ready path for activating `ops-hub` in production
-Inter-Hub. It covers the preferred API bootstrap, key custody expectations, the
-ops-warden remote execution lane, and the explicit SQL fallback.
+Hub Core's `/api/v2` compatibility surface. It covers the preferred API
+bootstrap, key custody expectations, the ops-warden remote execution lane, and
+the explicit SQL fallback.
 
 Use this when finishing `CUST-WP-0047-T05` or any later ops-hub Inter-Hub
 activation task.
 
 ## Inputs
 
+- Hub-extension package: `registry/hub-extension/v0.1.0/ops-hub.extension.json`
 - Manifest draft: `seeds/ops-hub-manifest.draft.json`
 - Widget seed: `seeds/ops-hub-widgets.seed.json`
 - API helper: `scripts/ops-hub-bootstrap-api.py`
@@ -167,14 +169,21 @@ curl -s https://hub.coulomb.social/api/v2/hub-registry
 Expected: `ops-hub` is visible, and the operator can see the seeded widgets in
 the authenticated UI.
 
-## Current Live-Execution Blocker
+## Authenticated rerun boundary
 
-The repo-side helper, dry-run path, and runbook are ready. The remaining step is
-an operator-attended production run with:
+Ops Hub bootstrap and consumer gates passed during the hub-core candidate
+cutover (`RAPPCOREHUB-WP-0002-T04`), and the 2026-08-31 post-cutover public
+gate passes against `https://hub.coulomb.social`. There is no pending bootstrap
+mutation merely to finish `OPS-WP-0003`.
 
-- an operator-provided `IHUB_OPERATOR_KEY_FILE`,
-- an OpenBao-materialized key on a trusted host, or
-- an explicitly approved deployment-side migration/bootstrap path.
+An authenticated rerun remains a high-risk attended operation because it may
+create a consumer key or production records. Use it only for a real registration
+change, start with `warden route show inter-hub-bootstrap-ssh --json`, and
+record non-secret evidence. For routine validation use:
 
-Until one of those is available, run `make interhub-gate`, `make test`, and
-`make interhub-bootstrap-dry-run` for local validation.
+```bash
+make test
+make hub-extension-check
+make hub-core-conformance
+make interhub-gate
+```

docs/hub-extension.md

@@ -0,0 +1,78 @@
+# Ops Hub extension package
+
+Ops Hub implements the owner side of `helixforge.hub-extension` 0.1.0. Hub
+Core owns and runs the framework ports; this repository owns the operations
+descriptor, capability declarations, event boundary, compatibility bootstrap,
+and evidence used to move service-catalog responsibility out of State Hub.
+
+The canonical package is
+`registry/hub-extension/v0.1.0/ops-hub.extension.json`. Its stable identity is
+`capability.operations.ops-hub`; it also declares
+`capability.operations.service-catalog` as an owner capability.
+
+## Ownership boundary
+
+| Surface | Owner |
+| --- | --- |
+| Descriptor, manifest, operational vocabulary, service-catalog records | `ops-hub` |
+| `port.*` schemas, event catalog, registry and projection runtime | `hub-core` |
+| Runtime and operator credentials | OpenBao/platform custody; never this package |
+| State Hub compatibility routes during retirement | `state-hub` until their evidenced cutover |
+
+Ops Hub is an aspect hub, not a second hub-core deployment. The API endpoint in
+the manifest is a discovery reference to the hub-core-hosted compatibility
+surface at `https://hub.coulomb.social/api/v2`.
+
+## Events and legacy compatibility
+
+The 0.1.0 port contract emits `ops.endpoint.verified` and consumes
+`hub.progress.recorded`. The older `/api/v2` bootstrap seed uses
+`ops-endpoint-verified`; hub-core's compatibility adapter retains that legacy
+spelling. New port-native evidence uses the dotted catalog event and must not
+silently rewrite historical events.
+
+## Validation
+
+```bash
+make test
+make hub-extension-check
+make hub-core-conformance
+make interhub-gate
+```
+
+`hub-extension-check` validates the owner package against hub-core's packaged
+Draft 2020-12 descriptor and manifest schemas, checks every declared event
+against hub-core's catalog, and emits a non-secret checksum receipt.
+
+`hub-core-conformance` injects this repository's package into a disposable
+hub-core reference runtime. Contract version 0.1.0 automates C1, C3, C4, C5,
+C6, and C8 plus Tier-3 F2 and F3. C2 registry resolution, C7 raw-port policy,
+C9 dependency-aware readiness, and C10 version negotiation are not automated
+by the current hub-core harness and are not represented as passing.
+
+`interhub-gate` is the safe post-cutover production check. It proves that the
+hub-core-hosted `/api/v2` surface exposes the bootstrap resources without
+requiring a credential or mutating production.
+
+## Authenticated bootstrap
+
+The existing `scripts/ops-hub-bootstrap-api.py` remains the idempotent
+compatibility bootstrap client. It creates or reuses the hub, manifest, API
+consumer, widgets, and verification event. Follow `docs/bootstrap-runbook.md`.
+
+Operator and runtime keys are never arguments, logs, Git content, or extension
+fields. Credential routing starts with:
+
+```bash
+warden route show inter-hub-bootstrap-ssh --json
+```
+
+The current route is high-risk and attended. A source change or public gate
+does not authorize another live bootstrap mutation.
+
+## State Hub retirement handoff
+
+This package satisfies the receiving-side contract for `STATE-WP-0079` Wave
+D1. Removing State Hub's service-catalog routes still requires a separate
+caller inventory, projection/count comparison, rollback receipt, and explicit
+production writer-cutover authorization. Owner readiness is not cutover proof.