From 19450d76184a4fa0cf31cbc098d2d6c8bcde4903 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Tue, 22 Sep 2026 07:58:55 +0200
Subject: [PATCH] ADHOC-2026-09-22-T01: statehub register renders
 {CREDENTIAL_ROUTING} into AGENTS.md

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 7184@bnt-lap001
Assistant-Session: 4b436ae2-b17c-4b40-8754-200b161b26e4
---
 statehub_register.py                |  7 ++++-
 tests/test_statehub_register_cli.py |  5 ++++
 workplans/ADHOC-2026-09-22.md       | 43 +++++++++++++++++++++++++++++
 3 files changed, 54 insertions(+), 1 deletion(-)
 create mode 100644 workplans/ADHOC-2026-09-22.md

diff --git a/statehub_register.py b/statehub_register.py
index ecc3e79..5612a80 100644
--- a/statehub_register.py
+++ b/statehub_register.py
@@ -451,7 +451,12 @@ def write_registration_files(
     agents_path = project_path / "AGENTS.md"
     if force or not agents_path.exists():
         agents_template = (RULES_TEMPLATES_DIR / "agents-codex.template").read_text()
-        agents = _replace_many(agents_template, values)
+        credential_routing = _replace_many(
+            (RULES_TEMPLATES_DIR / "credential-routing.template").read_text(), values
+        )
+        agents = _replace_many(
+            agents_template, {**values, "{CREDENTIAL_ROUTING}": credential_routing}
+        )
         agents_path.write_text(_ensure_trailing_newline(agents))
         written.append(agents_path)
 
diff --git a/tests/test_statehub_register_cli.py b/tests/test_statehub_register_cli.py
index 9863342..4cbe157 100644
--- a/tests/test_statehub_register_cli.py
+++ b/tests/test_statehub_register_cli.py
@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 import sys
 import tomllib
 from pathlib import Path
@@ -100,6 +101,10 @@ def test_write_registration_files_primes_codex_repo(tmp_path: Path):
     assert "!.claude/rules/" in (tmp_path / ".gitignore").read_text()
     assert (tmp_path / "INTENT.md").read_text() == "# INTENT\n\nDemo service intent.\n"
     assert "**Repo slug:** demo-service" in (tmp_path / "AGENTS.md").read_text()
+    agents_md = (tmp_path / "AGENTS.md").read_text()
+    assert "{CREDENTIAL_ROUTING}" not in agents_md
+    assert "warden route find" in agents_md
+    assert not re.search(r"\{[A-Z_]+\}", agents_md)
     assert "Run the demo service." in (tmp_path / "SCOPE.md").read_text()
     workplan = (tmp_path / "workplans" / "DEMO-WP-0001-statehub-bootstrap.md").read_text()
     assert "id: DEMO-WP-0001" in workplan
diff --git a/workplans/ADHOC-2026-09-22.md b/workplans/ADHOC-2026-09-22.md
new file mode 100644
index 0000000..0d61573
--- /dev/null
+++ b/workplans/ADHOC-2026-09-22.md
@@ -0,0 +1,43 @@
+---
+id: STATE-WP-ADHOC-2026-09-22
+type: workplan
+title: "Ad hoc fixes — 2026-09-22"
+domain: infotech
+repo: state-hub
+status: finished
+owner: claude-code
+topic_slug: state-hub
+created: "2026-09-22"
+updated: "2026-09-22"
+---
+
+## Fill the {CREDENTIAL_ROUTING} placeholder in statehub register
+
+```task
+id: STATE-WP-ADHOC-2026-09-22-T01
+status: done
+priority: low
+```
+
+Reported by canned-prompts (State Hub message
+`7b7daa15-78db-4530-aaed-914108245d4c`): `statehub register` wrote
+`agents-codex.template` into AGENTS.md without substituting
+`{CREDENTIAL_ROUTING}`, leaving the literal token in every repo registered
+through that path. `scripts/update_agent_instruction_files.py` and
+`scripts/propagate_credential_routing.py` already rendered it; only
+`write_registration_files` in `statehub_register.py` did not.
+
+Completed 2026-09-22. `write_registration_files` now renders
+`credential-routing.template` with the same values and substitutes it.
+`test_write_registration_files_primes_codex_repo` asserts no unresolved
+`{UPPER_CASE}` token remains and that the credential section is present
+(`26 passed`).
+
+Residual (not state-hub's files): 18 sibling repos still carry the literal
+token in AGENTS.md (binky-control, coulomb-social, facetted-interfaces,
+fluid-telegram, glas-harness, ground-game, hall-of-helix, kings-guard,
+pr-hall-of-helix, ops-mason, qonto-assistant, prj-canon-federation,
+rapp-postgres, resource-control, rein-openweights, rein-aharness,
+tenant-engine, test-driver). Regenerating with
+`scripts/update_agent_instruction_files.py` fixes them in each repo's own
+session.