Bootstrap repo: State Hub registration, agent docs, TEN-WP-0001/0002

statehub register + repo-seed template scaffold (CLAUDE.md, .claude/rules/,
registry/). INTENT.md and SCOPE.md rewritten from the generated stub to
match net-kingdom's ratified tenant-engine-boundary-contract_v0.1.md
(Purpose, Responsibility Boundary, Non-Goals). topic_slug corrected from
the auto-assigned custodian default to netkingdom, matching key-cape and
user-engine.

TEN-WP-0001 (bootstrap) complete: files reviewed/refined, stack decided
(Python 3.12 + FastAPI, matching qonto-assistant's convention), first real
workplan seeded.

TEN-WP-0002 drafted: service skeleton, domain model (tenant/grouping/
capability-role/plan-grant), storage layer, and the three boundary-contract
API surfaces (cache-read for key-cape, live-lookup for flex-auth with an
explicit fail-closed requirement, write API behind a WriteAuthorizer seam
since real flex-auth integration is a declared non-goal for this pass).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/rules/agents.md

@@ -0,0 +1,20 @@
+## Kaizen Agents
+
+Specialized agent personas available on demand via the state-hub MCP.
+
+**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category
+**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them
+
+Common agents:
+
+| Agent | Category | When to use |
+|-------|----------|-------------|
+| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature |
+| `code-refactoring` | quality | Code quality analysis and safe refactoring |
+| `test-maintenance` | testing | Diagnose and fix failing tests |
+| `requirements-engineering` | process | Prevent interface/mock mismatches upfront |
+| `keepaTodofile` | process | Maintain TODO.md during work |
+| `project-management` | process | Track status, determine next steps |
+| `datamodel-optimization` | quality | Optimize dataclasses and data structures |
+
+All 17 agents: call `list_kaizen_agents()` for the full list.

.claude/rules/architecture.md

@@ -0,0 +1,25 @@
+## Architecture
+
+Small headless service, modeled on `qonto-assistant`'s layout (same fleet
+convention). Layers:
+
+- `domain/` — tenant, grouping, capability-role, and plan-grant models; pure,
+  no framework dependency.
+- `store/` — persistence for tenant records and the role/plan grant audit
+  trail. Starts in-memory/SQLite for early workplans; production backend TBD.
+- `api/` — three surfaces per the boundary contract: a cache-read API
+  (`key-cape` calls at token issuance), a live-lookup API (`flex-auth` calls
+  synchronously for high-stakes decisions — must fail closed, never open),
+  and a write API (grant/revoke/plan mutations, authorization-gated by
+  `flex-auth`, not self-authorized).
+- `guardrail/` — reserved namespace, not implemented yet (spend limits,
+  entity/action counts).
+
+Full ownership boundary and API contract:
+`net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`.
+Claim/carrying mechanism this service implements:
+`net-kingdom/canon/standards/iam-profile_v0.3.md` ("Tenant Roles" section).
+
+## Quick Reference
+
+`~/state-hub/mcp_server/TOOLS.md` — MCP tool reference

.claude/rules/credential-routing.md

@@ -0,0 +1,50 @@
+# Credential and access routing
+
+**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
+for inference. Run this check **before** requesting secrets, API keys, SSH access,
+login tokens, or database passwords — in any repo, not only `ops-warden`.
+
+ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
+other credential need belongs to another subsystem. **Do not** message
+`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.
+
+### Lookup (do this first)
+
+```bash
+warden route find "<describe your need>" --json
+warden route show <catalog-id> --json
+```
+
+Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
+
+| Agent runtime | How to orient |
+| --- | --- |
+| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=repo-seed` is for coordination, not secret vending |
+| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership |
+| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
+
+### Quick routing table
+
+| I need… | Owner | ops-warden executes? |
+| --- | --- | --- |
+| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
+| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
+| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
+| Authorization decision | flex-auth | No — route only |
+| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
+| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |
+
+### Anti-patterns (do not do these)
+
+- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
+- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
+- Pasting secrets into Git, State Hub, workplans, logs, or chat
+
+### Other capabilities (reuse-surface)
+
+Non-credential capabilities are usually discovered through **reuse-surface** federation
+(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
+every repo's agent instructions because it is high-frequency, high-risk, and easy to
+get wrong.
+
+**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`

.claude/rules/first-session.md

@@ -0,0 +1,42 @@
+## First Session Protocol
+
+Triggered when `get_domain_summary("infotech")` shows **no workplans**.
+The project is registered but work has not yet been structured.
+
+**Step 1 — Read, don't write**
+- `~/the-custodian/canon/projects/infotech/project_charter_v0.1.md` — purpose, scope
+- `~/the-custodian/canon/projects/infotech/roadmap_v0.1.md` — planned phases
+- Scan repo root: README, directory structure, existing code or docs
+
+**Step 2 — Survey in-progress work**
+Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete.
+
+**Step 3 — Propose workplans to Bernd**
+Propose 1–3 workplans — each a coherent strand, weeks to months, anchored to a
+roadmap phase. **Wait for approval before creating.**
+
+**Step 4 — Write the workplan file; fix-consistency registers it (ADR-001)**
+```
+workplans/REPO-WP-NNNN-<slug>.md   ← write this, commit it
+```
+Then register by running the consistency check — do **not** call
+`create_workplan`/`create_task` yourself; manual registration duplicates what
+C-06 creates from the file:
+```bash
+statehub fix-consistency --repo repo-seed
+```
+C-06 creates the hub workplan + tasks and writes `state_hub_workstream_id`
+(legacy frontmatter name — holds the workplan UUID) and `state_hub_task_id`
+back into the file.
+
+**Step 5 — Record the setup**
+```
+add_progress_event(
+    summary="First session: structured infotech into N workplans, M tasks",
+    event_type="milestone",
+    topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a",
+    detail={"workplans": [...], "tasks_created": M}
+)
+```
+
+<!-- Delete or archive this file once past first session -->

.claude/rules/repo-boundary.md

@@ -0,0 +1,18 @@
+## Repo boundary
+
+This repo owns **tenant-as-an-entity facts** only: tenant existence,
+onboarding grouping, capability roles, plan/subscription assignment, and
+(reserved) guardrail/quota policy. It does not own:
+
+- Identity, authentication, MFA, token issuance → `key-cape` / Keycloak
+- Tenant identifier format and role vocabulary → NetKingdom canon
+  (`iam-profile_v0.3.md`, ADR-0013, ADR-0014) — this repo consumes it,
+  never redefines it
+- Users, profiles, memberships → `user-engine` (shared key: `tenant_id` only)
+- Authorization decisions → `flex-auth` (this repo is a data source it
+  queries, never the decision maker)
+- Pricing-model / plan term definitions → `adaptive-pricing`
+- Payment processing → not yet identified as owned by any repo
+- Runtime secret custody → OpenBao / `secrets-engine`
+
+Full contract: `net-kingdom/canon/standards/tenant-engine-boundary-contract_v0.1.md`.

.claude/rules/repo-identity.md

@@ -0,0 +1,6 @@
+**Purpose:** Canonical owner of tenant-as-an-entity facts for NetKingdom: existence, onboarding grouping, capability roles, and plan/subscription assignment.
+
+**Domain:** infotech
+**Repo slug:** tenant-engine
+**Workplan prefix:** `TEN-WP-`
+**Topic:** netkingdom

.claude/rules/session-protocol.md

@@ -0,0 +1,92 @@
+## Session Protocol
+
+Dev Hub (State Hub API): http://127.0.0.1:8000
+MCP server name in `~/.claude.json`: `dev-hub`
+
+**Step 1 — Orient**
+
+Read the offline-safe brief first — it works without a live hub connection:
+```bash
+cat .custodian-brief.md
+```
+Then call the MCP tool for richer cross-domain context when MCP tools are exposed:
+```
+get_domain_summary("infotech")
+```
+If MCP tools are unavailable in the current agent session, use the REST API:
+```bash
+curl -s "http://127.0.0.1:8000/state/summary" | python3 -m json.tool
+```
+If the hub is offline: `cd ~/state-hub && make api`
+
+**Step 2 — Check inbox**
+With MCP tools:
+```
+get_messages(to_agent="repo-seed", unread_only=True)
+```
+Mark read with `mark_message_read(message_id)`. Reply or act on coordination
+requests before proceeding.
+
+Without MCP tools:
+```bash
+curl -s "http://127.0.0.1:8000/messages/?to_agent=repo-seed&unread_only=true" \
+  | python3 -m json.tool
+curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
+  -H "Content-Type: application/json" -d '{}'
+```
+
+**Step 3 — Scan workplans**
+```bash
+ls workplans/
+```
+For each file with `status: ready`, `active`, or `blocked`, note pending
+`wait`/`todo`/`progress` tasks.
+
+**Step 4 — Present brief**
+
+1. **Active workplans** for `infotech` — title, task counts, blocking decisions
+2. **Pending tasks** from `workplans/` + any `[repo:repo-seed]` hub tasks
+3. **Goal guidance** — if `goal_guidance` in summary:
+   - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
+   - `alignment_warnings`: flag if active work is not aligned with current goal
+4. **Suggested next action** — highest-priority open item
+5. **SBOM status** — flag if `last_sbom_at` is unset for this repo
+
+If no workplans: follow First Session Protocol (`first-session.md`).
+
+**During work:** `record_decision()` · `add_progress_event()` · `resolve_decision()`
+
+> State Hub is a *read model*. **Never register workplans or tasks by hand**
+> (`create_workplan`, `create_task`) — write the workplan file in `workplans/`
+> and run `fix-consistency`; C-06 registers the workplan and tasks and writes
+> IDs back into the file. Manual registration creates duplicates when
+> fix-consistency runs. Work structure belongs in repo files (ADR-001).
+>
+> Legacy: `create_workstream` and `/workstreams/` remain as metered aliases —
+> see `workplan-convention.md` (compatibility footnote).
+
+**Session close:**
+With MCP tools:
+```
+add_progress_event(summary="...", topic_id="cee7bedf-2b48-46ef-8601-006474f2ad7a", workplan_id="<uuid>")
+```
+Without MCP tools:
+```bash
+curl -s -X POST http://127.0.0.1:8000/progress/ \
+  -H "Content-Type: application/json" \
+  -d '{"topic_id":"cee7bedf-2b48-46ef-8601-006474f2ad7a","workplan_id":"<uuid>","event_type":"note","summary":"what changed","author":"codex"}'
+```
+If workplan files were modified, ensure the local copy is up to date first,
+then sync from the repo checkout:
+```bash
+git pull --ff-only
+statehub fix-consistency
+```
+For repos where implementation runs on a remote machine (e.g. CoulombCore),
+use the pull-before-fix mode from any shell with the State Hub CLI:
+```bash
+statehub fix-consistency --repo repo-seed --remote
+```
+**C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
+will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes
+until you pull — intentional to prevent clobbering remote progress.

.claude/rules/stack-and-commands.md

@@ -0,0 +1,29 @@
+## Stack
+
+- **Language:** Python 3.12 (matches `qonto-assistant`'s fleet convention for
+  small headless services)
+- **Framework:** FastAPI, `pyproject.toml` + `Makefile` layout
+- **Key deps:** State Hub ADR-001 workplans, `net-kingdom` canon (IAM Profile
+  v0.3, ADR-0013, ADR-0014, tenant-engine boundary contract)
+
+## Dev Commands
+
+```bash
+# Orient (offline-safe)
+cat .custodian-brief.md
+cat INTENT.md
+cat SCOPE.md
+ls workplans/
+
+# Once scaffolded (TEN-WP-0002)
+make install-dev
+make test
+make lint
+make run
+
+# After workplan or registry edits — from this repo checkout
+statehub fix-consistency
+
+# Sanity-check markdown / registry edits
+git diff --check
+```

.claude/rules/workplan-convention.md

@@ -0,0 +1,55 @@
+## Workplan Convention (ADR-001)
+
+File location: `workplans/REPO-WP-NNNN-<slug>.md`
+ID prefix: `REPO-WP-`
+
+Work items originate as files in this repo **before** being registered in the hub.
+
+Canonical workplan frontmatter statuses are:
+`proposed`, `ready`, `active`, `blocked`, `backlog`, `finished`, `archived`.
+Use `proposed` for a newly drafted plan, `ready` after review against current
+repo state, and `finished` when implementation is complete. `stalled` and
+`needs_review` are derived health labels, not stored statuses.
+
+Closed workplans may be moved to `workplans/archived/` with a completion-date
+prefix: `YYMMDD-REPO-WP-NNNN-<slug>.md`. The frontmatter id remains
+unchanged; the prefix is only for quick visual reference.
+
+Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**:
+`workplans/ADHOC-YYYY-MM-DD.md`, workplan slug `adhoc-YYYY-MM-DD`, and task ids
+`ADHOC-YYYY-MM-DD-T01`, `T02`, etc. Use adhocs only for low-risk work completed
+directly. Promote anything requiring analysis, design, approval, dependencies, or
+multiple planned phases into a normal workplan.
+
+Ecosystem todos from other agents arrive as `[repo:repo-seed]` hub tasks —
+visible at session start. Pick one up by creating the workplan file, committing,
+and running `statehub fix-consistency` — C-06 registers the workplan in the hub.
+Never register by hand with `create_workplan` (legacy MCP alias: `create_workstream`).
+
+Task blocks use this shape:
+
+```task
+id: REPO-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+```
+
+Status progression is `todo` → `progress` → `done`; use `wait` for waiting or
+blocked work and `cancel` for stopped work.
+
+Workplan frontmatter carries `state_hub_workstream_id` — a legacy field name
+kept for compatibility; it holds the hub workplan UUID and is written by
+fix-consistency. Do not edit or rename it.
+
+### Legacy terminology (compatibility footnote)
+
+**Workplan** is the fleet term — see
+`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.
+**Workplan** is legacy only: some API routes (`/workstreams/`), params
+(`workstream_id`), MCP aliases (`create_workstream`), and the frontmatter field
+above remain until `STATE-WP-0069` retires them via legacy-meter. Treat those
+identifiers as workplan IDs. Prefer `GET /workplans/` and `workplan_id` in new
+examples and scripts.
+
+<!-- Ralph Loop rules and HEUREKA sequence: ~/.claude/CLAUDE.md — do not duplicate here -->