docs: advance remaining state hub workplans

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a053ff-1d6f-7fe2-ac1c-a6eb40a42a0c

workplans/STATE-WP-0079-retirement-strangler.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: infotech
 created: "2026-08-09"
-updated: "2026-08-23"
+updated: "2026-08-31"
 parent_project: prj-state-hub-retirement
 parent_workplan: SHR-WP-0001
 related:
@@ -448,6 +448,19 @@ workplans restored from `launching/immediate` to `manual/manual`.
 Focused execution coverage passes (`4 passed`); the combined full regression
 and dashboard build remains green (`650 passed`).
 
+**Central meter review 2026-08-31.** The corrected seven-day review found six
+replacement-verified interfaces past their volume-scaled quiet period. They
+were marked retired on the sole `railliance01` primary: the old workstream
+completion event subject, `DELETE /workstreams/{id}`, two low-volume SBOM
+compatibility reads, `GET /workstreams/workplan-index`, and
+`POST /workstreams/{id}/dependencies/`. The recapture now reports 6 retired,
+9 legacy, and zero currently eligible candidates. The remaining nine include
+live SBOM callers, live `GET /tasks/?workstream_id`, the three high-volume
+workstream reads still inside their 60-day quiet window, and two workstream
+mutations still inside 30 days. Evidence:
+`docs/evidence/legacy-meter-weekly-review-20260831.json`. T05 remains
+`progress`; T06 must not start.
+
 ## Stabilization window and archive prep
 
 ```task

workplans/STATE-WP-0084-forge-read-for-private-repositories.md

@@ -4,11 +4,17 @@ type: workplan
 title: "Derive private repositories, and report unreadable as unreadable"
 domain: infotech
 repo: state-hub
-status: active
+status: finished
 owner: codex
 topic_slug: infotech
 created: "2026-08-26"
-updated: "2026-08-26"
+updated: "2026-08-31"
+quality_dod: DoD-Ok
+quality_dod_at: "2026-08-31"
+quality_dod_by: codex
+quality_dod_note: >-
+  Credential delivery, safe consumer behavior, nine-repository reviewed apply,
+  and nine-noop repeat verification are evidenced without storing a secret.
 related:
   - CUST-ADR-012
   - STATE-WP-0083
@@ -112,7 +118,7 @@ covered by tests that fail if the retirement path is reachable from either.
 
 ```task
 id: STATE-WP-0084-T02
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "d8d41a89-1ebc-5118-bb73-cf8d8c114e16"
 ```
@@ -155,11 +161,18 @@ path (`paste_once_provision`, outside both repositories), and a deploy with
 `forgeRead.enabled=true` plus the real address and path in
 `deploy/railiance/apps/helm/state-hub-values.yaml`.
 
+**Done 2026-08-31.** The live `railliance01` release has
+`forgeRead.enabled: true`; the API pod runs as ServiceAccount `state-hub` with
+the projected OpenBao token and coordinate-only configuration. A non-secret
+in-pod resolution check returned `available`. The Forge token remains outside
+Git and is re-read through the five-minute cache, so rotation needs no chart
+change or pod redeploy.
+
 ## Teach the derivation to use it
 
 ```task
 id: STATE-WP-0084-T03
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "b22b24d9-7ed3-533c-bda7-3130693cf4d2"
 ```
@@ -215,11 +228,16 @@ are silent when wrong: token-in-argv and token-in-exception. 43 pass in
 Remains `progress` because the acceptance clause "private repositories derive"
 cannot be observed until T02 supplies a credential; T04 confirms it.
 
+**Done 2026-08-31.** A transaction-rolled-back review successfully derived all
+nine private `rapp-*` repositories at exact Forge commits. No repository was
+unreadable or errored, and no retirement was proposed. The anonymous/public
+path remains covered by the existing absent-credential tests.
+
 ## Confirm the nine
 
 ```task
 id: STATE-WP-0084-T04
-status: wait
+status: done
 priority: medium
 state_hub_task_id: "33c09a78-5974-57c6-bb7f-ad73082046bb"
 ```
@@ -235,3 +253,9 @@ repository examined this way for the first time has produced findings.
 
 Acceptance: fleet errors fall from nine to zero; each newly readable repository
 has its first diff reviewed before anything is applied.
+
+**Done 2026-08-31.** The first review returned seven bounded source/status
+updates and two no-ops, with zero creations, retirements, refusals, or errors.
+Those exact commits were applied through the guarded per-repository API with
+retirement disabled. The repeated review returned nine no-ops and zero errors.
+Evidence: `docs/evidence/STATE-WP-0084-private-forge-cutover-2026-08-31.md`.

workplans/STATE-WP-0085-repository-lineage-preserving-rename.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: infotech
 created: "2026-08-28"
-updated: "2026-08-29"
+updated: "2026-08-31"
 reviewed_at: "2026-08-28"
 reviewed_by: codex
 reviewed_against_commit: "41d80429a77ffeb640f4b34091ebee5c91585373"
@@ -565,7 +565,7 @@ one existing async cancellation warning remain outside T08.
 
 ```task
 id: STATE-WP-0085-T09
-status: progress
+status: wait
 priority: high
 state_hub_task_id: "df34f6ec-d137-52d0-93c4-3756a821097f"
 ```
@@ -611,6 +611,13 @@ reports `preflight_signing_unavailable`; provisioning was handed to
 Forgejo rename, State Hub rebind, clone removal, consumer edit, or runtime
 deployment was performed.
 
+**Gate rechecked 2026-08-31.** `FLEX-WP-0020` remains clean, pushed,
+registered, `proposed`, and DoR-Ok. The deployed State Hub still has no
+repository-rename preflight signing configuration, and platform handoff
+`cd52ba10-de41-46ce-aa8b-9b44050da8f7` remains unread. This is an external
+provisioning gate, so the task is `wait`, not active implementation. No rename
+or consumer mutation was performed.
+
 ## Workplan completion
 
 `STATE-WP-0085` can finish only when T01-T08 are complete, T09 has produced the