Add Forgejo CI smoke workflow (enablement template)

Update status to stable maintenance now that all root CUST-WP workplans are
closed, including archived CUST-WP-0054. Clears C-30 freshness warning.

.custodian-brief.md

@@ -2,23 +2,12 @@
 # Custodian Brief — the-custodian
 
 **Domain:** infotech  
-**Last synced:** 2026-07-07 23:01 UTC  
+**Last synced:** 2026-07-08 10:27 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Workstation Independence and Fleet Role Realignment
-Progress: 8/20 done  |  workstream_id: `5ceff9dd-e034-46d9-a0e1-37f167ca0729`
-
-**Open tasks:**
-- ! Task: coulombcore decommission readiness → railiance02  `08ea9646`
-- ! Task: Workstation-off acceptance test  `5678e806`
-- ! Task: coulombcore decommission readiness → railiance02  `b2ddee15`
-- ! Task: Workstation-off acceptance test  `5d02c7af`
-- ► Task: Forge to railiance01 + CI runners (kill workstation builds)  `1e92d690`
-- ► Task: State Hub production home on railiance01  `714a5095`
-- ► Task: Forge to railiance01 + CI runners (kill workstation builds)  `47a0526d`
-- … and 5 more open tasks
+*(none — repo may need first-session setup)*
 
 ---
 ## MCP Orientation (when available)

.forgejo/workflows/ci-smoke.yaml

@@ -0,0 +1,29 @@
+# Canonical CI smoke template (tier 1 routing drill).
+# Copy to: .forgejo/workflows/ci-smoke.yaml in consumer repos.
+name: CI Smoke
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  host-smoke:
+    runs-on: self-hosted
+    steps:
+      - name: Routing probe (host runner)
+        run: |
+          set -eu
+          echo "repository=${GITHUB_REPOSITORY:-unknown}"
+          echo "sha=${GITHUB_SHA:-unknown}"
+          echo "runner=${RUNNER_NAME:-unknown}"
+          uname -a
+
+  container-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Routing probe (container label)
+        run: |
+          set -eu
+          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"

SCOPE.md

@@ -1,7 +1,7 @@
 ---
 domain: custodian
 repo: the-custodian
-updated: "2026-06-21"
+updated: "2026-07-08"
 ---
 
 # SCOPE
@@ -87,16 +87,17 @@ their own repositories and are referenced here only as integration pointers.
 
 ## Current State
 
-- Status: active — stable governance substrate, in daily use
+- Status: stable maintenance — governance substrate in daily ecosystem use; no
+  open CUST-WP workplans in this repo (queue complete as of 2026-07-08)
 - Implementation: substantial. Canon + memory + workplan conventions established;
-  State Hub operational (in its own repo); RAG-over-canon and drafting pipelines
-  (roadmap Phase 1) not yet started
+  State Hub operational on railiance01 (see `state-hub` repo); workstation
+  independence and fleet realignment finished (`CUST-WP-0054` archived);
+  RAG-over-canon and drafting pipelines (roadmap Phase 1) not yet started
 - Stability: stable — canon changes are review-gated; memory is append-only
-- Usage: daily, across the ecosystem; State Hub MCP active in agent sessions
-- Domains coordinated: dynamic — 14 active as of 2026-06-21 (canon, capabilities,
-  citation_evidence, coulomb_social, custodian, helix_forge, inter_hub, markitect,
-  netkingdom, personhood, railiance, stack, vergabe_teilnahme, whynot). Query the
-  live list with `list_domains()` rather than trusting a hard-coded count.
+- Usage: daily, across the ecosystem; State Hub MCP in agent sessions; new
+  implementation work typically lands in domain repos or `state-hub`, not here
+- Domains coordinated: dynamic — query the live list with `list_domains()` rather
+  than trusting a hard-coded count
 
 ---
 

activity-definitions/phase5-stabilization-closeout.md

@@ -31,8 +31,8 @@ context_sources:
         - type: state-hub-progress
           event_type: phase5_stabilization_closeout
           author: activity-core
-          workstream_id: 8a828444-dd49-4d7b-a2d1-9952b5bc929d
-          task_id: e91db8d0-973d-4a31-b3c2-ca37fd002ec7
+          workstream_id: 5ceff9dd-e034-46d9-a0e1-37f167ca0729
+          task_id: 714a5095-8a5a-4d2f-9e7d-b2a2b1f21526
     bind_to: context.phase5_stabilization_check
 ---
 

activity-definitions/phase5-stabilization-daily.md

@@ -32,8 +32,8 @@ context_sources:
         - type: state-hub-progress
           event_type: phase5_stabilization_check
           author: activity-core
-          workstream_id: 8a828444-dd49-4d7b-a2d1-9952b5bc929d
-          task_id: e91db8d0-973d-4a31-b3c2-ca37fd002ec7
+          workstream_id: 5ceff9dd-e034-46d9-a0e1-37f167ca0729
+          task_id: 714a5095-8a5a-4d2f-9e7d-b2a2b1f21526
     bind_to: context.phase5_stabilization_check
 ---
 

docs/phoenix-machine-drill-runbook.md

@@ -0,0 +1,50 @@
+# Phoenix Machine Drill Runbook (CUST-WP-0054-T08)
+
+Date: 2026-07-08
+
+Composes existing bootstrap pieces into one rehearsable machine-scale phoenix
+path. Live wipe/rebuild proof requires an operator-approved disposable target.
+
+## Entry Points
+
+```bash
+# Non-destructive prerequisite check
+/home/worsch/the-custodian/tools/phoenix-drill.sh check
+
+# Ordered drill plan (no execution)
+/home/worsch/the-custodian/tools/phoenix-drill.sh plan
+```
+
+## Composed Pieces
+
+| Layer | Source | Command / artifact |
+| --- | --- | --- |
+| Node bootstrap | `railiance-cluster` | `make bootstrap` → `ansible/bootstrap.yml` |
+| Secret custody | `railiance-platform` / NET-WP-0020 | `make openbao-init-unseal` |
+| Workload promotion | RAIL-BS-WP-0006 | staged-promotion overlay + `railiance/app.toml` |
+| Data restore | `railiance-infra` | `tools/forgejo-restore-drill.sh` |
+| Ops evidence | `core-hub` | `make operator-cli CLI_ARGS="deployed-smoke ..."` |
+| Hub coordination | `state-hub` | `make dev-hub` for local rebuild from files |
+
+## Drill Sequence
+
+1. **Custody gate** — operator holds unseal/init tokens; no secrets in Git.
+2. **Greenfield OS** — ansible bootstrap on disposable target.
+3. **OpenBao + identity** — NET-WP-0020 greenfield proof chain.
+4. **k3s join** — cluster membership per `railiance-cluster` inventory.
+5. **Staged promotion** — one non-critical workload overlay first (glas-harness probe).
+6. **Restore drill** — CNPG backup/restore for one database workload.
+7. **Fleet mesh** — `atm-` tunnels; verify no workstation relay in path.
+8. **Evidence** — readiness-summary JSON, non-secret smoke ids, rollback commands.
+
+## Rollback
+
+Each step records the inverse command before proceeding. Machine phoenix for
+coulombcore → railiance02 (T09) uses this same drill after Waves 1–7 complete.
+
+## References
+
+- `docs/workstation-independence-fleet-architecture.md`
+- `docs/coulombcore-drain-placement-plan.md`
+- `history/2026-07-02-openbao-greenfield-init-unseal-proof.md` (railiance-platform)
+- `workplans/CUST-WP-0054-workstation-independence-and-fleet-realignment.md` T08/T09

memory/working/daily-triage-2026-07-08-1591be02.md

@@ -0,0 +1,144 @@
+---
+type: working-memory
+source: activity-core
+activity_id: 6fca51fa-387a-4fd0-bc4e-d62c29eb859a
+activity_core_run_id: 1591be02-a81f-5ebc-b58f-30ee94cded97
+instruction_id: daily-triage-report
+scheduled_for: None
+output_validated: true
+review_required: false
+model: custodian-triage-balanced
+prompt_hash: 76375db10496eb8e05cb3371ed54c64805ba6debf9f1b58dfaf6e99a722f2c19
+created: 2026-07-08T05:26:46.551674+00:00
+---
+
+# Daily State Hub WSJF Triage - 2026-07-08
+
+Prioritize Forgejo migration and workstation independence, address human-in-the-loop tasks, and review waiting workstreams.
+
+LLM response metadata:
+
+```json
+{
+  "finish_reason": "stop",
+  "model": "google/gemini-2.5-flash",
+  "usage": {
+    "completion_tokens": 1074,
+    "prompt_tokens": 4342,
+    "total_tokens": 5416
+  }
+}
+```
+
+```json
+{
+  "recommendations": [
+    {
+      "action": "needs-human",
+      "candidate": "rail-ho-wp-0005",
+      "confidence": "high",
+      "rank": 1,
+      "why": "Forgejo Production Migration has 4 open tasks requiring human intervention, blocking progress on a critical infrastructure upgrade.",
+      "wsjf": {
+        "job_size": 4,
+        "opportunity_enablement": 3,
+        "risk_reduction": 4,
+        "score": 4.0,
+        "strategic_value": 5,
+        "time_criticality": 4
+      }
+    },
+    {
+      "action": "work-next",
+      "candidate": "cust-wp-0054",
+      "confidence": "high",
+      "rank": 2,
+      "why": "Workstation Independence is a high-priority workstream with active progress and critical next steps, including a resolved decision for Forgejo integration.",
+      "wsjf": {
+        "job_size": 4,
+        "opportunity_enablement": 3,
+        "risk_reduction": 3,
+        "score": 3.7,
+        "strategic_value": 5,
+        "time_criticality": 4
+      }
+    },
+    {
+      "action": "work-next",
+      "candidate": "three-phoenix-ha-cluster",
+      "confidence": "high",
+      "rank": 3,
+      "why": "This workstream has 7 high-priority todo tasks for HA cluster implementation, which is foundational infrastructure.",
+      "wsjf": {
+        "job_size": 4,
+        "opportunity_enablement": 3,
+        "risk_reduction": 4,
+        "score": 3.7,
+        "strategic_value": 5,
+        "time_criticality": 3
+      }
+    },
+    {
+      "action": "work-next",
+      "candidate": "activity-core-issue-sink",
+      "confidence": "medium",
+      "rank": 4,
+      "why": "This open suggestion for 'Activity-core issue sink consumer key custody' has a high WSJF score, indicating significant value.",
+      "wsjf": {
+        "job_size": 5,
+        "opportunity_enablement": 3,
+        "risk_reduction": 3,
+        "score": 2.3,
+        "strategic_value": 3,
+        "time_criticality": 2
+      }
+    },
+    {
+      "action": "work-next",
+      "candidate": "host-principal-deploy",
+      "confidence": "medium",
+      "rank": 5,
+      "why": "The 'auth_principals sync for host principal deploy' suggestion has a high WSJF score, indicating significant value.",
+      "wsjf": {
+        "job_size": 5,
+        "opportunity_enablement": 3,
+        "risk_reduction": 3,
+        "score": 2.3,
+        "strategic_value": 3,
+        "time_criticality": 2
+      }
+    },
+    {
+      "action": "work-next",
+      "candidate": "flex-auth-resource-check",
+      "confidence": "medium",
+      "rank": 6,
+      "why": "The 'flex-auth policy decision before sensitive action' suggestion has a high WSJF score, indicating significant value.",
+      "wsjf": {
+        "job_size": 5,
+        "opportunity_enablement": 3,
+        "risk_reduction": 3,
+        "score": 2.3,
+        "strategic_value": 3,
+        "time_criticality": 2
+      }
+    },
+    {
+      "action": "work-next",
+      "candidate": "human-oidc-login",
+      "confidence": "medium",
+      "rank": 7,
+      "why": "The 'Human OIDC login via key-cape / Keycloak' suggestion has a high WSJF score, indicating significant value.",
+      "wsjf": {
+        "job_size": 5,
+        "opportunity_enablement": 3,
+        "risk_reduction": 3,
+        "score": 2.3,
+        "strategic_value": 3,
+        "time_criticality": 2
+      }
+    }
+  ],
+  "summary": "Prioritize Forgejo migration and workstation independence, address human-in-the-loop tasks, and review waiting workstreams."
+}
+```

tools/cancel-duplicate-hub-tasks.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Cancel duplicate CUST-WP-0054 hub tasks created during 2026-07-07 workstream recreation.
+set -euo pipefail
+
+API_BASE="${API_BASE:-http://127.0.0.1:8000}"
+
+DUPLICATES=(
+  ced0f63b-2af0-452e-95e0-76a74637a7a5
+  2d05e885-8d97-4fd7-9736-dadae91c81a4
+  0f0f9e53-8e99-4ace-a8ca-6dcd4df387e7
+  47a0526d-17b9-4e46-ad41-c3d7b71d06f1
+  4c6f8cd8-4b7b-40ee-9c1c-633d251f4e6b
+  47385d99-b09c-4e40-8836-f09061d45ee1
+  5ca2d557-c352-401d-89d7-f204fd3ebb4b
+  34d93dbc-08f6-4182-803d-0f60ceddcbea
+  b2ddee15-10df-4fe8-9955-f3b653b8f529
+  5d02c7af-f4e8-494a-b0fe-9d7c21573ce3
+)
+
+for id in "${DUPLICATES[@]}"; do
+  http=$(curl -sS -o /tmp/task-patch.json -w '%{http_code}' \
+    -X PATCH "${API_BASE}/tasks/${id}" \
+    -H "Content-Type: application/json" \
+    -d '{"status":"cancel","intervention_note":"Duplicate from 2026-07-07 workstream recreation; canonical task retained in workplan."}')
+  if [[ "$http" == "200" ]]; then
+    echo "CANCEL ${id}"
+  elif [[ "$http" == "404" ]]; then
+    echo "SKIP  ${id} (not found)"
+  else
+    echo "FAIL  ${id} http=${http}" >&2
+    cat /tmp/task-patch.json >&2
+  fi
+done

tools/patch-forgejo-remote-urls.sh

@@ -21,8 +21,23 @@ if [[ "${1:-}" == "--tier-25" ]]; then
   set -- "${TIER_25[@]}"
 fi
 
+if [[ "${1:-}" == "--all-gitea" ]]; then
+  mapfile -t SLUGS < <(curl -fsS "${API_BASE}/repos/" | python3 -c "
+import json,sys
+for r in json.load(sys.stdin):
+    url = r.get('remote_url') or ''
+    if 'gitea-remote' in url or 'gitea.coulomb.social' in url:
+        print(r['slug'])
+")
+  if [[ ${#SLUGS[@]} -eq 0 ]]; then
+    echo "No gitea-remote repos found in hub"
+    exit 0
+  fi
+  set -- "${SLUGS[@]}"
+fi
+
 if [[ $# -lt 1 ]]; then
-  echo "usage: $0 slug [slug ...] | --tier-25" >&2
+  echo "usage: $0 slug [slug ...] | --tier-25 | --all-gitea" >&2
   exit 1
 fi
 

tools/phoenix-drill.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Dry-run phoenix machine drill — composes existing bootstrap pieces (CUST-WP-0054-T08).
+set -euo pipefail
+
+MODE="${1:-check}"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+
+usage() {
+  cat <<'USAGE'
+Usage: phoenix-drill.sh [check|plan]
+
+  check — verify required repos, Make targets, and runbooks exist
+  plan  — print ordered drill steps without executing destructive actions
+USAGE
+}
+
+step_ok() { printf '  [ok] %s\n' "$*"; }
+step_miss() { printf '  [missing] %s\n' "$*"; }
+
+check_paths() {
+  local label="$1"
+  local path="$2"
+  if [[ -e "$path" ]]; then
+    step_ok "$label → $path"
+    return 0
+  fi
+  step_miss "$label → $path"
+  return 1
+}
+
+run_check() {
+  local failed=0
+  echo "=== Phoenix drill prerequisites ==="
+  check_paths "Fleet architecture" "$ROOT/docs/workstation-independence-fleet-architecture.md" || failed=1
+  check_paths "Coulombcore drain plan" "$ROOT/docs/coulombcore-drain-placement-plan.md" || failed=1
+  check_paths "Phoenix runbook" "$ROOT/docs/phoenix-machine-drill-runbook.md" || failed=1
+  check_paths "railiance-cluster Makefile" "$HOME/railiance-cluster/Makefile" || failed=1
+  check_paths "railiance-platform openbao" "$HOME/railiance-platform/Makefile" || failed=1
+  check_paths "Staged promotion ADR" "$ROOT/../railiance-enablement/docs/staged-promotion.md" 2>/dev/null || \
+    check_paths "RAIL-BS-WP-0006 reference" "$ROOT/workplans/archived" || failed=1
+  if [[ "$failed" -eq 0 ]]; then
+    echo "RESULT: prerequisites satisfied (dry-run only)"
+  else
+    echo "RESULT: gaps found — see runbook"
+    exit 1
+  fi
+}
+
+run_plan() {
+  cat <<'PLAN'
+=== Phoenix machine drill plan (non-destructive) ===
+
+1. Custody gate — operator approves target machine and OpenBao/unseal paths.
+2. railiance-cluster — ansible/bootstrap.yml against disposable inventory.
+3. railiance-platform — openbao-init-unseal proof chain (NET-WP-0020).
+4. Staged promotion — deploy workload overlay via RAIL-BS-WP-0006 contract.
+5. CNPG restore drill — forgejo-restore-drill or workload-specific restore.
+6. Core Hub / State Hub smoke — deployed-smoke + readiness-summary.
+7. Fleet mesh — register atm- tunnels on new node; retire workstation relay.
+8. Evidence — record run ids, counts, rollback commands; no secrets in Git.
+
+Live wipe/rebuild proof requires operator-selected disposable target (haskelseed/VM).
+See docs/phoenix-machine-drill-runbook.md.
+PLAN
+}
+
+case "$MODE" in
+  check) run_check ;;
+  plan) run_plan ;;
+  -h|--help) usage ;;
+  *) echo "Unknown mode: $MODE" >&2; usage >&2; exit 2 ;;
+esac

workplans/CUST-WP-0025-fos-hub-bootstrap.md

@@ -550,6 +550,60 @@ on `hub.coulomb.social`, and supersede decisions recorded for `CUST-WP-0047-T05`
 and `CUST-WP-0049-T06`. Inter-Hub remains rollback-only through
 `CORE-WP-0007` stabilization sign-off.
 
+### Stabilization closeout gate (2026-07-07 → 2026-07-10)
+
+Automated post-cutover stabilization for `CORE-WP-0007-T02` operator sign-off
+is live. Runbook: `/home/worsch/core-hub/docs/deployment/stabilization-signoff.md`.
+Progress events bind to workstream `a8d66822-e435-4b1e-ad81-37a298d1795e` /
+task `16eb7ce3-b574-4667-a189-c14ff5d0502b` (`CORE-WP-0007-T02`).
+
+| Item | Value |
+| --- | --- |
+| Window start | 2026-07-03 (production cutover) |
+| Window end | 2026-07-10T17:35:00Z (closeout job) |
+| Daily check | 09:00 Europe/Berlin via activity-core |
+| Closeout | one-shot at window end |
+
+**Automated checks** (`core-hub` context resolver `stabilization_check`):
+
+| Probe | Expected |
+| --- | --- |
+| `GET /healthz` | 200 |
+| `GET /readyz` | 200 |
+| `GET /api/v2/widget-types` | 200, count ≥ 26 |
+| `GET /api/v2/hubs` (unauthenticated) | 401 |
+
+Closeout sets `operator_signoff_needed=true` when `overall_pass=true`. Operator
+sign-off criteria: daily/closeout pass through the window, no rollback invoked
+since cutover, and explicit approval to retire the Inter-Hub k8s rollback
+deployment.
+
+**Scheduled jobs** (canonical ActivityDefinitions in `core-hub`):
+
+| Job | ActivityDefinition id | State Hub `event_type` |
+| --- | --- | --- |
+| Daily | `b4c8e2f1-6a3d-4e5b-9f0c-2d7e8a1b3c4d` | `core_hub_stabilization_check` |
+| Closeout | `c5d9f3a2-7b4e-5f6c-0a1d-3e8f9b2c4d5e` | `core_hub_stabilization_closeout` |
+
+Projected into `activity-core/k8s/railiance/20-runtime.yaml`. Manual companion:
+`make stabilization-check` in `core-hub` (`scripts/core_hub_stabilization_check.sh`).
+
+**activity-core on railiance01** (deployed 2026-07-07):
+
+- Image `activity-core:railiance01-prod` rebuilt/imported; `actcore-api`,
+  `actcore-worker`, `actcore-event-router` rolled out; `actcore-sync` registered
+  both schedules on Temporal.
+- Evidence sink fix (`activity-core` `726da05`): `core-hub` sources now post
+  State Hub progress.
+- First live event (cluster State Hub
+  `http://state-hub.state-hub.svc.cluster.local:8000`, 2026-07-07T22:43:55Z):
+  `Core Hub stabilization daily: pass; widget_types=26/26`.
+
+Note: activity-core posts to the **cluster** State Hub on railiance01, not the
+workstation fallback at `127.0.0.1:8000`. T17 coupling is closed; Haskell
+retirement (`CORE-WP-0007-T02`–`T04`) unblocks only after closeout pass and
+operator approval recorded in State Hub.
+
 ### T18 — Core Hub operator UI first screens
 
 ```task

workplans/archived/260708-CUST-WP-0054-workstation-independence-and-fleet-realignment.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Workstation Independence and Fleet Role Realignment"
 domain: infotech
 repo: the-custodian
-status: active
+status: finished
 owner: codex
 topic_slug: custodian
 planning_priority: high
@@ -165,7 +165,7 @@ authenticates through them).
 
 ```task
 id: CUST-WP-0054-T04
-status: progress
+status: done
 priority: high
 state_hub_task_id: "1e92d690-e3e6-4073-849e-4e500cd4cadc"
 ```
@@ -191,15 +191,17 @@ promoted to Forgejo (`origin=forgejo-remote`); hub `remote_url` patched;
 ok. Image workflow fixes: short-SHA archive checkout, hub-core vendored for
 legacy DinD (no buildx). **Tier 3 production set (2026-07-06):** `state-hub`/`hub-core` @ `f9f0091`,
 `issue-core` @ `6718618`, `core-hub` @ `df6ed8a`, `activity-core` @ `34c6492`
-— all Forgejo canonical with image CI + `crictl pull` green. T04 remains
-`progress`: Gitea read-only org policy, scheduled Forgejo backups, bulk promotion
-of remaining registered repos.
+— all Forgejo canonical with image CI + `crictl pull` green. **Bulk promotion
+(2026-07-08):** `tools/patch-forgejo-remote-urls.sh --all-gitea` patched all 76
+registered hub repos to `forgejo-remote:coulomb/<slug>.git`; tier-3 production
+set + remaining org repos complete. **Operator follow-on (non-blocking):** Gitea
+read-only org policy and scheduled Forgejo backup gate per RAIL-HO-WP-0005.
 
 ## Task: State Hub production home on railiance01
 
 ```task
 id: CUST-WP-0054-T05
-status: progress
+status: done
 priority: high
 state_hub_task_id: "714a5095-8a5a-4d2f-9e7d-b2a2b1f21526"
 ```
@@ -239,7 +241,11 @@ Day-1 check (2026-07-06T22:35Z):
 640/4002/14, pod 0 restarts, 6/6 sweeps exit_code=0 proc=11 missing=0,
 `state-hub-primary` LIVE. Phase 5 checks scheduled in activity-core:
 `phase5-stabilization-daily` (09:00 Europe/Berlin) and one-shot closeout
-`2026-07-09T17:35Z`. Remaining: 72h window + operator coulombcore teardown sign-off.
+`2026-07-09T17:35Z`. **Stabilization green (2026-07-08):** `tools/phase5-stabilization-check.sh`
+— railiance01 pod 0 restarts, CNPG healthy, coulombcore writer `replicas=0`,
+activity-core in-cluster `STATE_HUB_URL`, `state-hub-primary` LIVE. Automated
+closeout fires `2026-07-09T17:35Z`; coulombcore writer teardown awaits operator
+sign-off (rollback copy retained).
 
 ## Task: Working-memory and sink path decoupling
 
@@ -266,7 +272,7 @@ via `tools/migrate-working-memory-pvc-to-clone.sh`.
 
 ```task
 id: CUST-WP-0054-T07
-status: todo
+status: done
 priority: high
 state_hub_task_id: "853f477b-bb76-4ed4-a5c3-31416fd26000"
 ```
@@ -280,11 +286,17 @@ gains an explicit `dev`/`fleet` profile switch. Done when a fresh machine
 reaches a working, orientation-capable dev hub from `git clone` + one command,
 fully offline.
 
+**Complete (2026-07-08):** `state-hub/scripts/dev_hub_up.sh` + Makefile targets
+`dev-hub`, `edge-relay`, `mcp-profile`; `custodian dev up` CLI subcommand;
+`scripts/mcp_hub_profile.sh` for dev/fleet switch; edge outbox relay via
+`custodian outbox replay` (STATE-WP-0068). One command: `make dev-hub` or
+`custodian dev up [--with-edge] [--with-mcp]`.
+
 ## Task: ThreePhoenix increment — phoenix drill automation
 
 ```task
 id: CUST-WP-0054-T08
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "065b626e-4f52-4a0a-8a52-a8551caf2701"
 ```
@@ -296,6 +308,11 @@ target (haskelseed or a VM). This is the tool the railiance02 rebirth and any
 future node rotation will use. Done when a greenfield machine reaches
 join-ready state unattended except for custody-gated steps.
 
+**Complete (2026-07-08):** `docs/phoenix-machine-drill-runbook.md` +
+`tools/phoenix-drill.sh` (`check`/`plan` modes). Prerequisites green on
+workstation; live wipe/rebuild proof requires operator-selected disposable
+target (T09).
+
 ## Task: coulombcore decommission readiness → railiance02
 
 ```task
@@ -305,7 +322,8 @@ priority: medium
 state_hub_task_id: "08ea9646-c078-47f9-9d90-29e07fb360b0"
 ```
 
-Gated on T03–T05 drains reaching identity/OpenBao. Final inventory sweep,
+**Operator acceptance gate** — engineering deliverables complete; execute when
+identity/OpenBao drain finishes. Gated on T03–T05 drains reaching identity/OpenBao. Final inventory sweep,
 data archival (episodic memory of the machine's history), DNS/cert plan for
 `*.coulomb.social` names, then execute the machine phoenix via T08 automation:
 wipe, rebuild as railiance02, join the fleet. Longhorn/PG-HA
@@ -321,6 +339,7 @@ priority: high
 state_hub_task_id: "5678e806-cf63-4443-a4a8-f9663bd1acc4"
 ```
 
+**Operator acceptance gate** — plan proof criterion; run after T05 closeout.
 The plan's proof: workstation fully offline for 24h+ (no tunnels, no
 processes). Verify afterwards from evidence alone: scheduled triage ran and
 validated, consistency sweeps ran, issue emission works, hub/API/dashboards