implement ops hub extension contract

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

docs/bootstrap-runbook.md

@@ -1,18 +1,20 @@
 # Ops Hub Bootstrap Runbook
 
-Date: 2026-06-17
+Date: 2026-08-31
 
 ## Purpose
 
 This runbook is the operator-ready path for activating `ops-hub` in production
-Inter-Hub. It covers the preferred API bootstrap, key custody expectations, the
-ops-warden remote execution lane, and the explicit SQL fallback.
+Hub Core's `/api/v2` compatibility surface. It covers the preferred API
+bootstrap, key custody expectations, the ops-warden remote execution lane, and
+the explicit SQL fallback.
 
 Use this when finishing `CUST-WP-0047-T05` or any later ops-hub Inter-Hub
 activation task.
 
 ## Inputs
 
+- Hub-extension package: `registry/hub-extension/v0.1.0/ops-hub.extension.json`
 - Manifest draft: `seeds/ops-hub-manifest.draft.json`
 - Widget seed: `seeds/ops-hub-widgets.seed.json`
 - API helper: `scripts/ops-hub-bootstrap-api.py`
@@ -167,14 +169,21 @@ curl -s https://hub.coulomb.social/api/v2/hub-registry
 Expected: `ops-hub` is visible, and the operator can see the seeded widgets in
 the authenticated UI.
 
-## Current Live-Execution Blocker
+## Authenticated rerun boundary
 
-The repo-side helper, dry-run path, and runbook are ready. The remaining step is
-an operator-attended production run with:
+Ops Hub bootstrap and consumer gates passed during the hub-core candidate
+cutover (`RAPPCOREHUB-WP-0002-T04`), and the 2026-08-31 post-cutover public
+gate passes against `https://hub.coulomb.social`. There is no pending bootstrap
+mutation merely to finish `OPS-WP-0003`.
 
-- an operator-provided `IHUB_OPERATOR_KEY_FILE`,
-- an OpenBao-materialized key on a trusted host, or
-- an explicitly approved deployment-side migration/bootstrap path.
+An authenticated rerun remains a high-risk attended operation because it may
+create a consumer key or production records. Use it only for a real registration
+change, start with `warden route show inter-hub-bootstrap-ssh --json`, and
+record non-secret evidence. For routine validation use:
 
-Until one of those is available, run `make interhub-gate`, `make test`, and
-`make interhub-bootstrap-dry-run` for local validation.
+```bash
+make test
+make hub-extension-check
+make hub-core-conformance
+make interhub-gate
+```