reuse-surface/workplans/REUSE-WP-0022-hosted-plan-check.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
REUSE-WP-0022	workplan	Use current hosted capability discovery in factory planning	infotech	reuse-surface	finished	the-custodian	helix-forge	2026-09-08	2026-09-08	HFACT-WP-0001 VERGABE-WP-0018	9f90448a-b149-5d04-91b5-0bfc163a9ea2

Hosted query-before-build

Core Idea

The hosted index contains capabilities absent from the checked-in federation. Provide an explicit hosted plan-check that fetches current discovery, preserves its provenance and refuses incomplete or stale source evidence before producing a recommendation. Vergabe-teilnahme is the first delivery-workflow consumer.

Implement and verify hosted planning

id: REUSE-WP-0022-T01
status: done
priority: high
assignee: the-custodian
state_hub_task_id: "004ba579-64d0-5b56-9847-b4b02fbf0f7a"

Use the existing public GET /v1/federated. Preserve local mode compatibility. Accept only bounded, structurally usable, recently composed, unwarned responses; report endpoint, counts, composition/retrieval times and response digest. Never convert source failure into a NEW verdict, gap request or local fallback. Test hosted-only matches, malformed/stale/partial sources and transport failures. No additional service, model call or mutation credential is necessary.

Publish and return the consumer receipt

id: REUSE-WP-0022-T02
status: done
priority: high
assignee: the-custodian
depends_on: [REUSE-WP-0022-T01]
state_hub_task_id: "a97e7347-70b1-5ce6-93fa-ff9fb1df2133"

Publish the tested implementation through the existing Forgejo review path. Capture a real hosted check invoked from vergabe-teilnahme with pinned source revision. Return source and consumer evidence to HFACT-WP-0001-T06; it is source preparation, not proof that the governed Railiance worker performed the change.

Verification — 2026-09-08

Implementation at 2621cf2: full suite 208 passed (one upstream Starlette warning). Vergabe-teilnahme invoked the CLI against the real hosted federation: 65 capabilities, no warning, stale: false, snapshot digest bfb6b79970867ac981fc48286dea24b2ff766cf732d3675f73ccbddb8971e498. Consumer receipt: vergabe-teilnahme/docs/evidence/2026-09-08-hosted-plan-check.json. This attended implementation does not count as a governed factory run.

Completion and handoff

Integrated on published main at 998a5ef3efd42af728fb276594f634f516855daa after PR 1 and live CI run 331 passed. Main CI 333 and image publication 334 passed. Image main-998a5ef has digest sha256:b510acc6bb1aee0e70709f65e53c61a96336ca837eba6dd75ceaa1f5cbf3d441. Vergabe-teilnahme's consumer and build gate are integrated and its image is published under VERGABE-WP-0018. No production deployment is claimed here.

Residual integration/operating acceptance remains live in HFACT-WP-0001-T06/T07. HFACT-WP-0001-T02 also owns disposition of three archived REUSE-WP-0017/0018/0019 null-ID consistency findings; these are historical projection issues, not failed checks for REUSE-WP-0022. Forgejo PR 1 metadata still needs the authenticated manually-merged receipt after OpenBao caller login; source is already on main.