---
id: REUSE-WP-0022
type: workplan
title: "Use current hosted capability discovery in factory planning"
domain: infotech
repo: reuse-surface
status: finished
owner: the-custodian
topic_slug: helix-forge
created: "2026-09-08"
updated: "2026-09-08"
related: [HFACT-WP-0001, VERGABE-WP-0018]
state_hub_workstream_id: "9f90448a-b149-5d04-91b5-0bfc163a9ea2"
---

# Hosted query-before-build

## Core Idea

The hosted index contains capabilities absent from the checked-in federation.
Provide an explicit hosted plan-check that fetches current discovery, preserves
its provenance and refuses incomplete or stale source evidence before producing
a recommendation. Vergabe-teilnahme is the first delivery-workflow consumer.

## Implement and verify hosted planning

```task
id: REUSE-WP-0022-T01
status: done
priority: high
assignee: the-custodian
state_hub_task_id: "004ba579-64d0-5b56-9847-b4b02fbf0f7a"
```

Use the existing public GET /v1/federated. Preserve local mode compatibility.
Accept only bounded, structurally usable, recently composed, unwarned responses;
report endpoint, counts, composition/retrieval times and response digest. Never
convert source failure into a NEW verdict, gap request or local fallback. Test
hosted-only matches, malformed/stale/partial sources and transport failures.
No additional service, model call or mutation credential is necessary.

## Publish and return the consumer receipt

```task
id: REUSE-WP-0022-T02
status: done
priority: high
assignee: the-custodian
depends_on: [REUSE-WP-0022-T01]
state_hub_task_id: "a97e7347-70b1-5ce6-93fa-ff9fb1df2133"
```

Publish the tested implementation through the existing Forgejo review path.
Capture a real hosted check invoked from vergabe-teilnahme with pinned source
revision. Return source and consumer evidence to HFACT-WP-0001-T06; it is source
preparation, not proof that the governed Railiance worker performed the change.

## Verification — 2026-09-08

Implementation at `2621cf2`: full suite **208 passed** (one upstream Starlette
warning). Vergabe-teilnahme invoked the CLI against the real hosted federation:
65 capabilities, no warning, `stale: false`, snapshot digest
`bfb6b79970867ac981fc48286dea24b2ff766cf732d3675f73ccbddb8971e498`.
Consumer receipt: `vergabe-teilnahme/docs/evidence/2026-09-08-hosted-plan-check.json`.
This attended implementation does not count as a governed factory run.

## Completion and handoff

Integrated on published `main` at `998a5ef3efd42af728fb276594f634f516855daa`
after PR 1 and live CI run 331 passed. Main CI 333 and image publication 334
passed. Image `main-998a5ef` has digest
`sha256:b510acc6bb1aee0e70709f65e53c61a96336ca837eba6dd75ceaa1f5cbf3d441`.
Vergabe-teilnahme's consumer and build gate are integrated and its image is
published under VERGABE-WP-0018. No production deployment is claimed here.

Residual integration/operating acceptance remains live in HFACT-WP-0001-T06/T07.
HFACT-WP-0001-T02 also owns disposition of three archived REUSE-WP-0017/0018/0019
null-ID consistency findings; these are historical projection issues, not failed
checks for REUSE-WP-0022. Forgejo PR 1 metadata still needs the authenticated
`manually-merged` receipt after OpenBao caller login; source is already on main.