Normalize agent instructions and workplan frontmatter (STATE-WP-0067)

- Align agent files with on-disk workplan prefixes (infer from workplan ids)
- Set workplan domain to registered domain_slug; add topic_slug where applicable
- Repair frontmatter delimiter formatting; migrate legacy task status literals
- Regenerate AGENTS.md, CLAUDE.md, and .claude/rules from State Hub templates

.claude/rules/first-session.md

@@ -1,11 +1,11 @@
 ## First Session Protocol
 
-Triggered when `get_domain_summary("railiance")` shows **no workstreams**.
+Triggered when `get_domain_summary("financials")` shows **no workstreams**.
 The project is registered but work has not yet been structured.
 
 **Step 1 — Read, don't write**
-- `~/the-custodian/canon/projects/railiance/project_charter_v0.1.md` — purpose, scope
+- `~/the-custodian/canon/projects/financials/project_charter_v0.1.md` — purpose, scope
-- `~/the-custodian/canon/projects/railiance/roadmap_v0.1.md` — planned phases
+- `~/the-custodian/canon/projects/financials/roadmap_v0.1.md` — planned phases
 - Scan repo root: README, directory structure, existing code or docs
 
 **Step 2 — Survey in-progress work**
@@ -17,7 +17,7 @@ roadmap phase. **Wait for approval before creating.**
 
 **Step 4 — Create workplan file first, then DB record (ADR-001)**
 ```
-workplans/railiance-hosts-WP-NNNN-<slug>.md   ← write this first
+workplans/RAIL-HO-WP-NNNN-<slug>.md   ← write this first
 ```
 Then register in the hub:
 ```
@@ -28,7 +28,7 @@ create_task(workstream_id="<id>", title="...", priority="high|medium|low")
 **Step 5 — Record the setup**
 ```
 add_progress_event(
-    summary="First session: structured railiance into N workstreams, M tasks",
+    summary="First session: structured financials into N workstreams, M tasks",
     event_type="milestone",
     topic_id="ca369340-a64e-442e-98f1-a4fa7dc74a38",
     detail={"workstreams": [...], "tasks_created": M}

.claude/rules/repo-boundary.md

@@ -1,6 +1,6 @@
 ## Repo boundary
 
-This repo owns **railiance-hosts** only. It does not own:
+This repo owns **railiance-infra** only. It does not own:
 
 <!-- TODO: List what belongs in adjacent repos, e.g.:
 - SSH key management → railiance-infra/

.claude/rules/repo-identity.md

@@ -1,5 +1,5 @@
-**Purpose:** Host inventory and node-level configuration for railiance infrastructure. Tracks server specs, network topology, and per-host service assignments.
+**Purpose:** OAS S1 Infrastructure Substrate — OS provisioning, Ansible roles, Goss spec, Terraform, inventory
 
-**Domain:** railiance
+**Domain:** financials
-**Repo slug:** railiance-hosts
+**Repo slug:** railiance-infra
 **Topic ID:** ca369340-a64e-442e-98f1-a4fa7dc74a38

.claude/rules/session-protocol.md

@@ -1,6 +1,7 @@
 ## Session Protocol
 
-State Hub: http://127.0.0.1:8000
+Dev Hub (State Hub API): http://127.0.0.1:8000
+MCP server name in `~/.claude.json`: `dev-hub`
 
 **Step 1 — Orient**
 
@@ -10,7 +11,7 @@ cat .custodian-brief.md
 ```
 Then call the MCP tool for richer cross-domain context when MCP tools are exposed:
 ```
-get_domain_summary("railiance")
+get_domain_summary("financials")
 ```
 If MCP tools are unavailable in the current agent session, use the REST API:
 ```bash
@@ -21,14 +22,14 @@ If the hub is offline: `cd ~/state-hub && make api`
 **Step 2 — Check inbox**
 With MCP tools:
 ```
-get_messages(to_agent="railiance-hosts", unread_only=True)
+get_messages(to_agent="railiance-infra", unread_only=True)
 ```
 Mark read with `mark_message_read(message_id)`. Reply or act on coordination
 requests before proceeding.
 
 Without MCP tools:
 ```bash
-curl -s "http://127.0.0.1:8000/messages/?to_agent=railiance-hosts&unread_only=true" \
+curl -s "http://127.0.0.1:8000/messages/?to_agent=railiance-infra&unread_only=true" \
   | python3 -m json.tool
 curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
   -H "Content-Type: application/json" -d '{}'
@@ -39,12 +40,12 @@ curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
 ls workplans/
 ```
 For each file with `status: ready`, `active`, or `blocked`, note pending
-`todo`/`in_progress` tasks.
+`wait`/`todo`/`progress` tasks.
 
 **Step 4 — Present brief**
 
-1. **Active workstreams** for `railiance` — title, task counts, blocking decisions
+1. **Active workstreams** for `financials` — title, task counts, blocking decisions
-2. **Pending tasks** from `workplans/` + any `[repo:railiance-hosts]` hub tasks
+2. **Pending tasks** from `workplans/` + any `[repo:railiance-infra]` hub tasks
 3. **Goal guidance** — if `goal_guidance` in summary:
    - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
    - `alignment_warnings`: flag if active work is not aligned with current goal
@@ -72,12 +73,12 @@ curl -s -X POST http://127.0.0.1:8000/progress/ \
 If workplan files were modified, ensure the local copy is up to date first:
 ```bash
 git -C <repo_path> pull --ff-only
-cd ~/state-hub && make fix-consistency REPO=railiance-hosts
+cd ~/state-hub && make fix-consistency REPO=railiance-infra
 ```
 For repos where implementation runs on a remote machine (e.g. CoulombCore),
 use the combined target which pulls before fixing:
 ```bash
-cd ~/state-hub && make fix-consistency-remote REPO=railiance-hosts
+cd ~/state-hub && make fix-consistency-remote REPO=railiance-infra
 ```
 **C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
 will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes

.claude/rules/workplan-convention.md

@@ -1,7 +1,7 @@
 ## Workplan Convention (ADR-001)
 
-File location: `workplans/railiance-hosts-WP-NNNN-<slug>.md`
+File location: `workplans/RAIL-HO-WP-NNNN-<slug>.md`
-ID prefix: `RAILIANCE-WP`
+ID prefix: `RAIL-HO-WP-`
 
 Work items originate as files in this repo **before** being registered in the hub.
 
@@ -12,7 +12,7 @@ repo state, and `finished` when implementation is complete. `stalled` and
 `needs_review` are derived health labels, not stored statuses.
 
 Closed workplans may be moved to `workplans/archived/` with a completion-date
-prefix: `YYMMDD-railiance-hosts-WP-NNNN-<slug>.md`. The frontmatter id remains
+prefix: `YYMMDD-RAIL-HO-WP-NNNN-<slug>.md`. The frontmatter id remains
 unchanged; the prefix is only for quick visual reference.
 
 Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**:
@@ -21,8 +21,20 @@ Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**
 directly. Promote anything requiring analysis, design, approval, dependencies, or
 multiple planned phases into a normal workplan.
 
-Ecosystem todos from other agents arrive as `[repo:railiance-hosts]` hub tasks —
+Ecosystem todos from other agents arrive as `[repo:railiance-infra]` hub tasks —
 visible at session start. Pick one up by creating the workplan file, then registering
 the workstream.
 
+Task blocks use this shape:
+
+```task
+id: RAIL-HO-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+```
+
+Status progression is `todo` → `progress` → `done`; use `wait` for waiting or
+blocked work and `cancel` for stopped work.
+
 <!-- Ralph Loop rules and HEUREKA sequence: ~/.claude/CLAUDE.md — do not duplicate here -->

AGENTS.md

@@ -1,13 +1,13 @@
-# railiance-hosts — Agent Instructions
+# railiance-infra — Agent Instructions
 
 ## Repo Identity
 
-**Purpose:** Host inventory and node-level configuration for railiance infrastructure. Tracks server specs, network topology, and per-host service assignments.
+**Purpose:** OAS S1 Infrastructure Substrate — OS provisioning, Ansible roles, Goss spec, Terraform, inventory
 
-**Domain:** railiance
+**Domain:** financials
-**Repo slug:** railiance-hosts
+**Repo slug:** railiance-infra
 **Topic ID:** `ca369340-a64e-442e-98f1-a4fa7dc74a38`
-**Workplan prefix:** `RAILIANCE-WP-`
+**Workplan prefix:** `RAIL-HO-WP-`
 
 ---
 
@@ -32,7 +32,7 @@ curl -s "http://127.0.0.1:8000/workstreams/?topic_id=ca369340-a64e-442e-98f1-a4f
   | python3 -m json.tool
 
 # Check inbox
-curl -s "http://127.0.0.1:8000/messages/?to_agent=railiance-hosts&unread_only=true" \
+curl -s "http://127.0.0.1:8000/messages/?to_agent=railiance-infra&unread_only=true" \
   | python3 -m json.tool
 ```
 
@@ -63,8 +63,8 @@ Omit `workstream_id` / `task_id` when not applicable.
 ```bash
 curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
   -H "Content-Type: application/json" \
-  -d '{"status": "in_progress"}'
+  -d '{"status": "progress"}'
-# values: todo | in_progress | done | blocked
+# values: wait | todo | progress | done | cancel
 ```
 
 ### Flag a task for human review
@@ -81,9 +81,9 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
 
 **Start:**
 1. `cat .custodian-brief.md` — domain goal and open workstreams (offline-safe)
-2. Check inbox: `GET /messages/?to_agent=railiance-hosts&unread_only=true`; mark read
+2. Check inbox: `GET /messages/?to_agent=railiance-infra&unread_only=true`; mark read
 3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
-4. Check blocked tasks: `GET /tasks/?needs_human=true`
+4. Check human-needed tasks: `GET /tasks/?needs_human=true`
 
 **During work:**
 - Update task statuses in workplan files as tasks progress
@@ -95,7 +95,7 @@ curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
 3. Note for the custodian operator: after workplan file changes, run from
    `~/state-hub`:
    ```bash
-   make fix-consistency REPO=railiance-hosts
+   make fix-consistency REPO=railiance-infra
    ```
    This syncs task status from files into the hub DB.
 
@@ -151,6 +151,11 @@ every repo's agent instructions because it is high-frequency, high-risk, and eas
 get wrong.
 
 **Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
+
+<!-- REPO-AGENTS-EXTENSIONS -->
+<!-- Append repo-specific agent instructions below this marker.
+     The state-hub template sync preserves content after this line. -->
+
 ---
 
 ## Workplan Convention (ADR-001)
@@ -176,8 +181,8 @@ anything needing analysis, design, approval, dependencies, or multiple phases.
 id: RAILIANCE-WP-NNNN
 type: workplan
 title: "..."
-domain: railiance
+domain: financials
-repo: railiance-hosts
+repo: railiance-infra
 status: proposed | ready | active | blocked | backlog | finished | archived
 owner: codex
 topic_slug: ...
@@ -198,7 +203,7 @@ derived health labels, not frontmatter statuses.
 
 ` ` `task
 id: RAILIANCE-WP-NNNN-T01
-status: todo | in_progress | done | blocked
+status: wait | todo | progress | done | cancel
 priority: high | medium | low
 state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
 ` ` `
@@ -206,9 +211,9 @@ state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
 Task description text.
 ```
 
-Status progression: `todo` → `in_progress` → `done` (or `blocked`)
+Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.
 
 To create a new workplan:
 1. Write the file following the format above
-2. Notify the custodian operator to run `make fix-consistency REPO=railiance-hosts`
+2. Notify the custodian operator to run `make fix-consistency REPO=railiance-infra`
    (or send a message to the hub agent via `POST /messages/`)

CLAUDE.md

@@ -1,4 +1,4 @@
-# railiance-hosts — Claude Code Instructions
+# railiance-infra — Claude Code Instructions
 
 @SCOPE.md
 @.claude/rules/repo-identity.md

workplans/RAIL-HO-WP-0001-hosteurope-bootstrap.md

@@ -2,7 +2,7 @@
 id: RAIL-HO-WP-0001
 type: workplan
 title: "Secure Single-Server Bootstrap at HostEurope"
-domain: railiance
+domain: financials
 repo: railiance-infra
 status: completed
 owner: railiance
@@ -18,8 +18,7 @@ handoff_note: >
   done in railiance-bootstrap (harden.yml, bootstrap.yml) is superseded by
   the roles/base and roles/sops_agent structure in this repo. The HostEurope
   server IP is 92.205.62.239 (hosts.ini is gitignored — recreate from
-  inventory/servers.yaml when working on the host).
+  inventory/servers.yaml when working on the host).---
----
 
 # Secure Single-Server Bootstrap at HostEurope
 
@@ -56,7 +55,6 @@ ssh -R 8000:127.0.0.1:8000 <user>@92.205.62.239
 
 Then Claude on the remote host can reach `http://127.0.0.1:8000` as normal.
 See also: the tunnel setup note in `CLAUDE.md`.
-
 ---
 
 ## Tasks

workplans/RAIL-HO-WP-0002-server-spec-and-test-suite.md

@@ -2,7 +2,7 @@
 id: RAIL-HO-WP-0002
 type: workplan
 title: "Server Specification and Automated Test Suite"
-domain: railiance
+domain: financials
 repo: railiance-infra
 status: completed
 owner: railiance

workplans/RAIL-HO-WP-0003-5repo-stack-restructure.md

@@ -2,7 +2,7 @@
 id: RAIL-HO-WP-0003
 type: workplan
 title: "Railiance 5-Repo Stack Restructure"
-domain: railiance
+domain: financials
 repo: railiance-infra
 status: completed
 owner: railiance

workplans/RAIL-HO-WP-0004-production-readiness.md

@@ -2,7 +2,7 @@
 id: RAIL-HO-WP-0004
 type: workplan
 title: "Railiance Production Readiness — Automated, Reproducible Stack"
-domain: railiance
+domain: financials
 repo: railiance-infra
 status: finished
 owner: worsch
@@ -437,7 +437,7 @@ context.
 
 ```task
 id: RAIL-HO-WP-0004-T09
-status: cancelled
+status: cancel
 priority: medium
 state_hub_task_id: "d2afe78a-eb51-4ce9-b332-f181323d2370"
 needs_human: false

workplans/RAIL-HO-WP-0005-forgejo-production-migration.md

@@ -2,7 +2,7 @@
 id: RAIL-HO-WP-0005
 type: workplan
 title: "Forgejo Production Migration on railiance01"
-domain: railiance
+domain: financials
 repo: railiance-infra
 status: active
 owner: railiance
@@ -115,7 +115,7 @@ operator / agents / developers
 
 ```task
 id: RAIL-HO-WP-0005-T01
-status: in_progress
+status: progress
 priority: high
 state_hub_task_id: "cf59d171-5629-45c9-9d44-8d6499827ffc"
 ```