feat: complete cluster self-sufficiency hardening

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06d83-1cbc-71f2-b0dc-e0f48cedae43

workplans/STATE-WP-0081-cluster-self-sufficiency-and-registrar.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Cluster self-sufficiency: remove workstation coupling and fix the registrar"
 domain: infotech
 repo: state-hub
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 created: "2026-08-21"
@@ -18,6 +18,8 @@ related:
   - STATE-WP-0083
   - STATE-WP-0084
   - STATE-WP-0086
+  - 01a06e07-658e-73fa-9164-0b522504c0ee
+  - 01a06e0c-3feb-7920-a6f2-961b03dc170d
   - ADR-007
   - ADR-010
 state_hub_workstream_id: "bb2798fd-0680-5027-8479-3af3a5b048de"
@@ -162,7 +164,7 @@ a personal private key is mounted into the pod.
 
 ```task
 id: STATE-WP-0081-T04
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "57ab0ced-ef3f-5260-b7d6-e2a78ff4e023"
 ```
@@ -175,11 +177,17 @@ superseded by ephemeral Forge clones.
 Closes the recurrence: today's ownership fix will be undone by the next sweep
 while the pod still runs as root.
 
+**Completed 2026-09-04.** Helm release revision 58 runs the API and MCP pods as
+UID/GID 10001 with `runAsNonRoot`, `RuntimeDefault` seccomp, all capabilities
+dropped, privilege escalation disabled, and a read-only root filesystem. A
+writable `emptyDir` is mounted only at `/tmp`; the migration hook uses the same
+security context. Both rollouts and `/state/health` passed with zero restarts.
+
 ## Correct the hub repo registry
 
 ```task
 id: STATE-WP-0081-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "530fbd27-e463-51d2-b09c-ba9827d057de"
 ```
@@ -203,11 +211,19 @@ reconciliation consumes Forge commits rather than workstation paths. Complete a
 fleet-wide audit before closing this task, including confirmation that no
 cluster consumer still interprets `local_path` as an authoritative checkout.
 
+**Completed 2026-09-04.** The primary database audit recorded 131 repositories,
+126 active, no active repository without a remote, and no stale Gitea remote.
+The one active missing value (`maturity-engine`) was repaired from its verified
+Forgejo origin. Four remote-less records are archived history. Evidence:
+`docs/evidence/repository-registry-audit-20260904.json`. The unbounded collection
+endpoint performance finding is routed as intake
+`01a06e0c-3feb-7920-a6f2-961b03dc170d`.
+
 ## Serve the dashboard from the cluster
 
 ```task
 id: STATE-WP-0081-T06
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "1d74e5e2-fb0f-5342-afbb-6ce2986823f4"
 ```
@@ -222,11 +238,16 @@ dispositioned `replace` → `hub-core` (14 items, slice B5 in
 `docs/retirement-cutover-slice-plan.md`). If B5 lands first this task is a
 redirect, not a build. Confirm with `HUB-WP-0004` before writing any chart.
 
+**Completed by handoff 2026-09-04.** Building a new permanent State Hub
+deployment surface would conflict with the retirement direction. The existing
+dashboard remains an operator/development surface while its replacement is
+routed to Hub Core as intake `01a06e07-658e-73fa-9164-0b522504c0ee`.
+
 ## State and enforce the boundary
 
 ```task
 id: STATE-WP-0081-T07
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "12a2ce9f-7cdf-501b-9018-4c960d45e855"
 ```
@@ -244,6 +265,10 @@ found still pointed at the retired gitea host, six weeks stale, and the
 the copy the cluster could see. A shared-disk assumption made a stale reader look
 like a queue.
 
+**Completed 2026-09-04.** `STATE-ADR-002`, the cluster operating model, this
+repository's agent instructions, and the generated Codex template now carry the
+Forge-commit boundary and explain the failure it prevents.
+
 ## Close out the registrar
 
 ```task
@@ -276,8 +301,8 @@ single-writer registrar guard was retired by the Forge-derived projection path.
 - [x] Shared-checkout writeback superseded; `EBIND-WP-0002` registered
 - [x] Pod uses ephemeral Forge clones; no hostPath into any home directory
 - [x] Pod authenticates with a dedicated service identity
-- [ ] Pod runs as non-root with an explicit restrictive security context
-- [ ] No `/home/worsch` path in any cluster-consumed record; `remote_url` values current
-- [ ] Dashboard reachable without the workstation, or formally handed to `hub-core`
-- [ ] Boundary rule written and discoverable by agents
+- [x] Pod runs as non-root with an explicit restrictive security context
+- [x] No `/home/worsch` path in any cluster-consumed record; `remote_url` values current
+- [x] Dashboard reachable without the workstation, or formally handed to `hub-core`
+- [x] Boundary rule written and discoverable by agents
 - [x] Registrar queue drained; interim single-writer rule retired