docs: refresh core hub publication evidence

workplans/RPF-WP-0021-core-hub-platform-onboarding.md

@@ -11,7 +11,7 @@ created: "2026-08-20"
 updated: "2026-08-20"
 related:
   - CORE-WP-0011
-  - RAPP-CORE-HUB-WP-0001
+  - RAPPCOREHUB-WP-0001
   - RAPP-POSTGRES-WP-0003
 origin: request
 origin_ref: CORE-WP-0011
@@ -31,12 +31,14 @@ retirement of the old runtime. Those remain explicit operator gates in
 
 ## Current evidence
 
-- `/home/worsch/rapp-core-hub` is clean at commit `4403c9b`; its recorded
+- `/home/worsch/rapp-core-hub` is clean at commit `18e4e70`; its full package
-  package checks and railiance01 server-side dry-run passed.
+  check, family validation, and railiance01 server-side dry-run passed.
-- `coulomb/rapp-core-hub` does not exist in Forgejo (HTTP 404 on 2026-08-20).
+- `coulomb/rapp-core-hub` is private and authoritative in Forgejo. Its history
-- The routed `forgejo-admin-api-token` lane is active, but the present caller
+  preserves validated package commit `4403c9b`, and unauthenticated API access
-  receives HTTP 403 on the OpenBao mount lookup before `warden --exec` can
+  returns 404.
-  start the Forgejo request.
+- State Hub registered the repository and canonical workplan prefix
+  `RAPPCOREHUB-WP-`. The production registrar still needs to assign the
+  workplan UUID.
 - `agent-high-risk-boundary` deliberately denies agent data-read to the
   Forgejo site-admin PAT. That control is not removed to make publication
   convenient; an attended operator identity must authorize the child-process
@@ -94,9 +96,10 @@ validated commit.
 
 Completed 2026-08-20 after operator authorization. Unauthenticated Forgejo API
 access now returns 404 while the configured Git remote is accessible. Remote
-`main` is `cd43c9f`: its history preserves validated package commit `4403c9b`,
+`main` is `18e4e70`: its history preserves validated package commit `4403c9b`,
-the Forgejo README stub through merge `7dd057e`, the State Hub consistency
+the Forgejo README stub through merge `7dd057e`, publication evidence, the
-commit, and the publication evidence update. Local and remote `main` match.
+project goal, and the registered-prefix alignment. Local and remote `main`
+match.
 `make check`, the railiance01 server-side dry-run, and family validation
 (`4 declaration(s) ok`) passed after publication. The repo is registered in
 State Hub; workplan UUID assignment remains with the production registrar.
@@ -212,8 +215,8 @@ This task ends with repeatable shadow evidence. It does not flip
 
 ## Acceptance
 
-- [ ] Private Forgejo repo exists, commit `4403c9b` is pushed, and State Hub
+- [x] Private Forgejo repo exists, validated commit `4403c9b` is preserved,
-      registration is consistent.
+      and the registered workplan prefix is consistent.
 - [ ] Core Hub is an accepted, capacity-reviewed `rapp-postgres` consumer.
 - [ ] Static API-token and dynamic database credentials have distinct,
       least-privilege delivery paths.