chore: register repository governance baseline

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc

.claude/rules/agents.md

@@ -0,0 +1,20 @@
+## Kaizen Agents
+
+Specialized agent personas available on demand via the state-hub MCP.
+
+**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category
+**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them
+
+Common agents:
+
+| Agent | Category | When to use |
+|-------|----------|-------------|
+| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature |
+| `code-refactoring` | quality | Code quality analysis and safe refactoring |
+| `test-maintenance` | testing | Diagnose and fix failing tests |
+| `requirements-engineering` | process | Prevent interface/mock mismatches upfront |
+| `keepaTodofile` | process | Maintain TODO.md during work |
+| `project-management` | process | Track status, determine next steps |
+| `datamodel-optimization` | quality | Optimize dataclasses and data structures |
+
+All 17 agents: call `list_kaizen_agents()` for the full list.

.claude/rules/architecture.md

@@ -0,0 +1,21 @@
+## Architecture
+
+- `store.py` owns SQLite messages, leases, endpoints, and schema migration.
+- `service.py` exposes the authenticated local Unix-socket protocol and runs
+  endpoint-scoped delivery polling.
+- `tmux.py` owns tmux endpoint/session lifecycle; `control.py` owns tmux control
+  mode and injection.
+- `ptytap.py` transparently proxies the agent PTY while `routing.py` observes
+  complete input lines for direct repository addressing.
+- `broker.py` connects observed routing intent to durable queue state and
+  control-mode delivery.
+- `cli.py` is the operator surface for lifecycle, messaging, inspection,
+  replay/export, purging, completion, and diagnostics.
+
+The terminal boundary has three layers: tmux for topology/output, the broker
+for identity and durable intent, and `tamq tap` for full-duplex input
+observation. Preserve that separation when adding coordination-engine support.
+
+## Quick Reference
+
+`~/state-hub/mcp_server/TOOLS.md` — MCP tool reference

.claude/rules/credential-routing.md

@@ -0,0 +1,50 @@
+# Credential and access routing
+
+**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
+for inference. Run this check **before** requesting secrets, API keys, SSH access,
+login tokens, or database passwords — in any repo, not only `ops-warden`.
+
+ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
+other credential need belongs to another subsystem. **Do not** message
+`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.
+
+### Lookup (do this first)
+
+```bash
+warden route find "<describe your need>" --json
+warden route show <catalog-id> --json
+```
+
+Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
+
+| Agent runtime | How to orient |
+| --- | --- |
+| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=tmux-amq` is for coordination, not secret vending |
+| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership |
+| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
+
+### Quick routing table
+
+| I need… | Owner | ops-warden executes? |
+| --- | --- | --- |
+| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
+| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
+| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
+| Authorization decision | flex-auth | No — route only |
+| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
+| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |
+
+### Anti-patterns (do not do these)
+
+- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
+- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
+- Pasting secrets into Git, State Hub, workplans, logs, or chat
+
+### Other capabilities (reuse-surface)
+
+Non-credential capabilities are usually discovered through **reuse-surface** federation
+(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
+every repo's agent instructions because it is high-frequency, high-risk, and easy to
+get wrong.
+
+**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`

.claude/rules/first-session.md

@@ -0,0 +1,54 @@
+## First Session Protocol
+
+Triggered when `get_domain_summary("communication")` shows **no workplans**.
+The project is registered but work has not yet been structured.
+
+**Step 1 — Read, don't write**
+- `~/the-custodian/canon/projects/communication/project_charter_v0.1.md` — purpose, scope
+- `~/the-custodian/canon/projects/communication/roadmap_v0.1.md` — planned phases
+- Scan repo root: README, directory structure, existing code or docs
+
+**Step 2 — Survey in-progress work**
+Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete.
+
+**Step 3 — Propose workplans to Bernd**
+Propose 1–3 workplans — each a coherent strand, weeks to months, anchored to a
+roadmap phase. **Wait for approval before creating.**
+
+**Step 4 — Write the workplan file; fix-consistency registers it (ADR-001)**
+```
+workplans/TAMQ-WP-NNNN-<slug>.md   ← write this, commit it
+```
+Then register by running the consistency check — do **not** call
+`create_workplan`/`create_task` yourself; manual registration duplicates what
+C-06 creates from the file:
+```bash
+statehub fix-consistency --repo tmux-amq
+```
+C-06 creates the hub workplan + tasks and writes `state_hub_workstream_id`
+(legacy frontmatter name — holds the workplan UUID) and `state_hub_task_id`
+back into the file.
+
+If C-06/C-11 is skipped because the host is not the identifier registrar,
+commit and push the new workplan, then invoke the governed fallback once:
+
+```bash
+uv run --project ~/repo-manager rmgr registrar-reconcile \
+  --path . --confirm-primary --push
+```
+
+Never export `STATEHUB_REGISTRAR` or create the hub records manually. If the
+fallback is unavailable, send one request to `repo-manager` and keep working
+from the authoritative files.
+
+**Step 5 — Record the setup**
+```
+add_progress_event(
+    summary="First session: structured communication into N workplans, M tasks",
+    event_type="milestone",
+    topic_id="36c7421b-c537-4723-bf75-42a3ebc6a1dc",
+    detail={"workplans": [...], "tasks_created": M}
+)
+```
+
+<!-- Delete or archive this file once past first session -->

.claude/rules/repo-boundary.md

@@ -0,0 +1,9 @@
+## Repo boundary
+
+This repo owns **tmux-amq** only. It does not own:
+
+- Goal/workflow orchestration and cross-host coordination → `coordination-engine`
+- Repository discovery and registration → `gita`
+- Workplan indexing and cross-repository task state → `state-hub`
+- Agent runtime behavior → Codex or the selected agent command
+- tmux itself or its server lifecycle outside `tamq`-managed sessions

.claude/rules/repo-identity.md

@@ -0,0 +1,5 @@
+**Purpose:** Local durable message queue and tmux endpoint runtime for coordinating agent workers across gita-registered repositories.
+
+**Domain:** communication
+**Repo slug:** tmux-amq
+**Topic ID:** 36c7421b-c537-4723-bf75-42a3ebc6a1dc

.claude/rules/session-protocol.md

@@ -0,0 +1,107 @@
+## Session Protocol
+
+Dev Hub (State Hub API): http://127.0.0.1:8000
+MCP server name in `~/.claude.json`: `dev-hub`
+
+**Step 1 — Orient**
+
+Read the offline-safe brief first — it works without a live hub connection:
+```bash
+cat .custodian-brief.md
+```
+Then call the MCP tool for richer cross-domain context when MCP tools are exposed:
+```
+get_domain_summary("communication")
+```
+If MCP tools are unavailable in the current agent session, use the REST API:
+```bash
+curl -s "http://127.0.0.1:8000/state/summary" | python3 -m json.tool
+```
+If the hub is offline: `cd ~/state-hub && make api`
+
+**Step 2 — Check inbox**
+With MCP tools:
+```
+get_messages(to_agent="tmux-amq", unread_only=True)
+```
+Mark read with `mark_message_read(message_id)`. Reply or act on coordination
+requests before proceeding.
+
+Without MCP tools:
+```bash
+curl -s "http://127.0.0.1:8000/messages/?to_agent=tmux-amq&unread_only=true" \
+  | python3 -m json.tool
+curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
+  -H "Content-Type: application/json" -d '{}'
+```
+
+**Step 3 — Scan workplans**
+```bash
+ls workplans/
+```
+For each file with `status: ready`, `active`, or `blocked`, note pending
+`wait`/`todo`/`progress` tasks.
+
+**Step 4 — Present brief**
+
+1. **Active workplans** for `communication` — title, task counts, blocking decisions
+2. **Pending tasks** from `workplans/` + any `[repo:tmux-amq]` hub tasks
+3. **Goal guidance** — if `goal_guidance` in summary:
+   - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
+   - `alignment_warnings`: flag if active work is not aligned with current goal
+4. **Suggested next action** — highest-priority open item
+5. **SBOM status** — flag if `last_sbom_at` is unset for this repo
+
+If no workplans: follow First Session Protocol (`first-session.md`).
+
+**During work:** `record_decision()` · `add_progress_event()` · `resolve_decision()`
+
+> State Hub is a *read model*. **Never register workplans or tasks by hand**
+> (`create_workplan`, `create_task`) — write the workplan file in `workplans/`
+> and run `fix-consistency`; C-06 registers the workplan and tasks and writes
+> IDs back into the file. Manual registration creates duplicates when
+> fix-consistency runs. Work structure belongs in repo files (ADR-001).
+> If C-06/C-11 is skipped on a non-registrar host, do not retry or set registrar
+> authority directly. Commit and push the file changes, then run once:
+> `uv run --project ~/repo-manager rmgr registrar-reconcile --path .
+> --confirm-primary --push`. If unavailable, send one deduplicated request to
+> `repo-manager` and continue from the files.
+>
+> Legacy: `create_workstream` and `/workstreams/` remain as metered aliases —
+> see `workplan-convention.md` (compatibility footnote).
+
+**Session close:**
+1. Update workplan/task statuses in repo files.
+2. If marking a workplan **finished**: hand off residuals as **live work
+   records** first (intake with `origin: residual` + `origin_ref: <WP-id>`, or
+   a child workplan / decision / engagement). Do not leave actionable leftovers
+   only as prose or in `SCOPE.md`. See work-record-types § Residuals.
+3. Log progress (below).
+4. `statehub fix-consistency` when workplan/queue files changed.
+   A non-registrar C-06/C-11 skip uses the scoped repo-manager fallback above;
+   repeated consistency runs cannot assign the missing UUIDs.
+
+With MCP tools:
+```
+add_progress_event(summary="...", topic_id="36c7421b-c537-4723-bf75-42a3ebc6a1dc", workplan_id="<uuid>")
+```
+Without MCP tools:
+```bash
+curl -s -X POST http://127.0.0.1:8000/progress/ \
+  -H "Content-Type: application/json" \
+  -d '{"topic_id":"36c7421b-c537-4723-bf75-42a3ebc6a1dc","workplan_id":"<uuid>","event_type":"note","summary":"what changed","author":"codex"}'
+```
+If workplan files were modified, ensure the local copy is up to date first,
+then sync from the repo checkout:
+```bash
+git pull --ff-only
+statehub fix-consistency
+```
+For repos where implementation runs on a remote machine (e.g. CoulombCore),
+use the pull-before-fix mode from any shell with the State Hub CLI:
+```bash
+statehub fix-consistency --repo tmux-amq --remote
+```
+**C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
+will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes
+until you pull — intentional to prevent clobbering remote progress.

.claude/rules/stack-and-commands.md

@@ -0,0 +1,23 @@
+## Stack
+
+- **Language:** Python 3.11+
+- **Runtime deps:** Python standard library, tmux, and gita
+- **Development deps:** pytest 8+, uv
+- **Storage/protocol:** SQLite and a local Unix socket
+
+## Dev Commands
+
+```bash
+# Install dependencies
+uv sync --extra dev
+
+# Run tests
+uv run pytest
+
+# Full repository check
+make check
+
+# Exercise the CLI
+uv run tamq --help
+uv run tamq --version
+```

.claude/rules/workplan-convention.md

@@ -0,0 +1,88 @@
+## Workplan Convention (ADR-001)
+
+File location: `workplans/TAMQ-WP-NNNN-<slug>.md`
+ID prefix: `TAMQ-WP-`
+
+Work items originate as files in this repo **before** being registered in the hub.
+
+Canonical workplan frontmatter statuses are:
+`proposed`, `ready`, `active`, `blocked`, `backlog`, `finished`, `archived`.
+Use `proposed` for a newly drafted plan, `ready` after review against current
+repo state, and `finished` when implementation is complete. `stalled` and
+`needs_review` are derived health labels, not stored statuses.
+
+Closed workplans may be moved to `workplans/archived/` with a completion-date
+prefix: `YYMMDD-TAMQ-WP-NNNN-<slug>.md`. The frontmatter id remains
+unchanged; the prefix is only for quick visual reference.
+
+Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**:
+`workplans/ADHOC-YYYY-MM-DD.md`, workplan id
+`TAMQ-WP-ADHOC-YYYY-MM-DD`, and task ids
+`TAMQ-WP-ADHOC-YYYY-MM-DD-T01`, `T02`, etc. `TAMQ-WP` includes its final
+`-WP` token. Unqualified historic `ADHOC-*` ids are grandfathered and must not
+be copied into new records. Use adhocs only for low-risk work completed directly.
+Promote anything requiring analysis, design, approval, dependencies, or multiple
+planned phases into a normal workplan.
+
+Ecosystem todos from other agents arrive as `[repo:tmux-amq]` hub tasks —
+visible at session start. Pick one up by creating the workplan file, committing,
+and running `statehub fix-consistency` — C-06 registers the workplan in the hub.
+Never register by hand with `create_workplan` (legacy MCP alias: `create_workstream`).
+
+If `fix-consistency` reports C-06/C-11 skipped because this host is not the
+identifier registrar, further retries cannot help. Do not set
+`STATEHUB_REGISTRAR` and do not create hub rows manually. Commit and push the
+file-backed work, then run the scoped repo-manager fallback once:
+
+```bash
+uv run --project ~/repo-manager rmgr registrar-reconcile \
+  --path . --confirm-primary --push
+```
+
+If it is unavailable, send one request to `repo-manager` naming the repository
+and missing canonical ids. Continue local work from files; hub UUID absence is
+an indexing delay, not a reason to repeat the same checks.
+
+Task blocks use this shape:
+
+```task
+id: TAMQ-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+```
+
+Status progression is `todo` → `progress` → `done`; use `wait` for waiting or
+blocked work and `cancel` for stopped work.
+
+### Residuals (role, not kind)
+
+When finishing a workplan, **actionable leftovers must become live work
+records** before `status: finished`. Residual is not a registered kind and
+must not be parked only in `SCOPE.md` or finished-file prose.
+
+| Shape | Capture as | Links |
+| --- | --- | --- |
+| Small Green/Blue parkable | intake (queue YAML / `*-IN-*`) | `origin: residual`, `origin_ref: TAMQ-WP-NNNN` |
+| Multi-step | next workplan | name parent WP; optional promote from residual intake |
+| Founder gate / time | decision / engagement | same origin fields when from residual intake |
+
+Fleet listing of residuals is a State Hub concern (`list_intakes` + origin
+filters; planned `statehub residuals`). Canon:
+`the-custodian/canon/standards/work-record-types_v0.1.md` § Residuals.
+
+Workplan frontmatter carries `state_hub_workstream_id` — a legacy field name
+kept for compatibility; it holds the hub workplan UUID and is written by
+fix-consistency. Do not edit or rename it.
+
+### Legacy terminology (compatibility footnote)
+
+**Workplan** is the fleet term — see
+`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.
+**Workstream** is legacy only: some API routes (`/workstreams/`), params
+(`workstream_id`), MCP aliases (`create_workstream`), and the frontmatter field
+above remain until `STATE-WP-0069` retires them via legacy-meter. Treat those
+identifiers as workplan IDs. Prefer `GET /workplans/` and `workplan_id` in new
+examples and scripts.
+
+<!-- Ralph Loop rules and HEUREKA sequence: ~/.claude/CLAUDE.md — do not duplicate here -->

.gitignore

@@ -5,3 +5,9 @@ __pycache__/
 *.egg-info/
 dist/
 build/
+
+# state-hub: track .claude/rules
+# Claude Code local state (track shared rules; ignore machine-specific files)
+.claude/*
+!.claude/rules/
+!.claude/rules/*.md

.repo-classification.yaml

@@ -0,0 +1,25 @@
+repo_classification:
+  standard: Repo Classification Standard
+  version: '1.0'
+  classified_at: '2026-08-24'
+  classified_by: codex
+  category: tooling
+  domain: communication
+  secondary_domains:
+  - agents
+  - infotech
+  capability_tags:
+  - collaboration
+  - coordination
+  - orchestration
+  - operations
+  - platform
+  business_stake:
+  - technology
+  - operations
+  - automation
+  business_mechanics:
+  - coordination
+  - operation
+  - adaptation
+  notes: Local durable tmux message queue for agent workers; designed to interoperate with coordination-engine without owning its workflow authority.

AGENTS.md

@@ -0,0 +1,276 @@
+# tmux-amq — Agent Instructions
+
+## Repo Identity
+
+**Purpose:** Local durable message queue and tmux endpoint runtime for coordinating agent workers across gita-registered repositories.
+
+**Domain:** communication
+**Repo slug:** tmux-amq
+**Topic ID:** `36c7421b-c537-4723-bf75-42a3ebc6a1dc`
+**Workplan prefix:** `TAMQ-WP-`
+
+---
+
+## State Hub Integration
+
+The Custodian State Hub tracks work across all domains. Codex uses HTTP REST and
+the `statehub` CLI by default. MCP is opt-in because the current Codex MCP bridge
+adds severe call latency; the full administrative MCP surface remains available
+to clients that need it.
+
+| Context | URL |
+|---------|-----|
+| Local workstation | `http://127.0.0.1:8000` |
+| Remote via tunnel | `http://127.0.0.1:18000` |
+| Optional local edge relay | http://127.0.0.1:18080 |
+
+When an operator has enabled the edge relay, set API_BASE to the relay URL.
+Queueable writes return an explicit queued receipt if the central hub is
+unreachable. Treat that as pending local evidence, then ask the operator to run
+statehub outbox status/replay after connectivity returns.
+
+Codex workspace-write sandboxes need network access enabled to reach the host's
+loopback listener. Bootstrap this once with `make -C ~/state-hub configure-codex`
+and restart Codex. The canonical REST health endpoint is `/state/health`, not
+`/health`. If a sandboxed loopback probe fails, retry it with escalated execution
+before declaring State Hub unavailable; a managed Codex permission profile may
+still enforce isolated networking. Experimental MCP can be enabled explicitly
+with `make -C ~/state-hub configure-codex WITH_MCP=1`.
+
+### Orient at session start
+
+```bash
+# Offline brief — works without hub connection
+cat .custodian-brief.md
+
+# Active workplans for this domain
+curl -s "http://127.0.0.1:8000/workplans/?topic_id=36c7421b-c537-4723-bf75-42a3ebc6a1dc&status=active" \
+  | python3 -m json.tool
+
+# Check inbox
+curl -s "http://127.0.0.1:8000/messages/?to_agent=tmux-amq&unread_only=true" \
+  | python3 -m json.tool
+```
+
+Mark a message read:
+```bash
+curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
+  -H "Content-Type: application/json" -d '{}'
+```
+
+### Log progress (required at session close)
+
+```bash
+curl -s -X POST http://127.0.0.1:8000/progress/ \
+  -H "Content-Type: application/json" \
+  -d '{
+    "summary": "what was done",
+    "event_type": "note",
+    "author": "codex",
+    "workplan_id": "<uuid>",
+    "task_id": "<uuid>"
+  }'
+```
+
+Omit `workplan_id` / `task_id` when not applicable.
+
+### Update task status
+
+```bash
+curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
+  -H "Content-Type: application/json" \
+  -d '{"status": "progress"}'
+# values: wait | todo | progress | done | cancel
+```
+
+### Flag a task for human review
+
+```bash
+curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
+  -H "Content-Type: application/json" \
+  -d '{"needs_human": true, "intervention_note": "reason"}'
+```
+
+---
+
+## Session Protocol
+
+**Start:**
+1. `cat .custodian-brief.md` — domain goal and open workplans (offline-safe)
+2. Check inbox: `GET /messages/?to_agent=tmux-amq&unread_only=true`; mark read
+3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
+4. Check human-needed tasks: `GET /tasks/?needs_human=true`
+
+**During work:**
+- Update task statuses in workplan files as tasks progress
+- Record significant decisions via `POST /decisions/`
+
+**Close:**
+1. Update workplan file task statuses to reflect progress
+2. If finishing a workplan: hand off **residuals** as live work records first
+   (intake with `origin: residual` + `origin_ref: <WP-id>`, or a next workplan /
+   decision / engagement). Do not park leftovers only in prose or `SCOPE.md`.
+   Canon: `the-custodian/canon/standards/work-record-types_v0.1.md` § Residuals.
+3. Log: `POST /progress/` with a summary of what changed (name handoff ids)
+4. After workplan file changes, run:
+   ```bash
+   statehub fix-consistency
+   ```
+   Coding agents should run this directly; ask the operator only if the CLI or
+   State Hub API is unavailable. This syncs task status from files into the hub DB.
+   If C-06/C-11 reports that this host is not the identifier registrar, do not
+   retry, export `STATEHUB_REGISTRAR`, or register records by hand. Commit and
+   push the file-backed work first, then run the repo-manager fallback once:
+   ```bash
+   uv run --project ~/repo-manager rmgr registrar-reconcile \
+     --path . --confirm-primary --push
+   ```
+   If unavailable, send one deduplicated registrar request to `repo-manager`
+   naming the repo and canonical ids; UUID absence does not block local work.
+
+---
+
+## Credential and access routing
+
+**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
+for inference. Run this check **before** requesting secrets, API keys, SSH access,
+login tokens, or database passwords — in any repo, not only `ops-warden`.
+
+ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
+other credential need belongs to another subsystem. **Do not** message
+`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.
+
+### Lookup (do this first)
+
+```bash
+warden route find "<describe your need>" --json
+warden route show <catalog-id> --json
+```
+
+Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
+
+| Agent runtime | How to orient |
+| --- | --- |
+| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=tmux-amq` is for coordination, not secret vending |
+| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workplans; **still** use `warden route` for credential ownership |
+| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
+
+### Quick routing table
+
+| I need… | Owner | ops-warden executes? |
+| --- | --- | --- |
+| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
+| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
+| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
+| Authorization decision | flex-auth | No — route only |
+| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
+| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |
+
+### Anti-patterns (do not do these)
+
+- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
+- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
+- Pasting secrets into Git, State Hub, workplans, logs, or chat
+
+### Other capabilities (reuse-surface)
+
+Non-credential capabilities are usually discovered through **reuse-surface** federation
+(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
+every repo's agent instructions because it is high-frequency, high-risk, and easy to
+get wrong.
+
+**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
+
+<!-- REPO-AGENTS-EXTENSIONS -->
+<!-- Append repo-specific agent instructions below this marker.
+     The state-hub template sync preserves content after this line. -->
+
+---
+
+## Workplan Convention (ADR-001)
+
+Work items originate as files in this repo — not in the hub. The hub is a
+read/cache/index layer that rebuilds from files.
+
+**File location:** `workplans/TAMQ-WP-NNNN-<slug>.md`
+
+**Archived location:** finished workplans may move to
+`workplans/archived/YYMMDD-TAMQ-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
+the completion/archive date; the frontmatter `id` does not change.
+
+**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
+`workplans/ADHOC-YYYY-MM-DD.md`, workplan id
+`TAMQ-WP-ADHOC-YYYY-MM-DD`, and task ids
+`TAMQ-WP-ADHOC-YYYY-MM-DD-T01`, etc. `TAMQ-WP` includes its final `-WP`
+token. Unqualified historic `ADHOC-*` ids are grandfathered and must not be
+copied into new records. Use this only for low-risk work completed directly;
+create a normal workplan for anything needing analysis, design, approval,
+dependencies, or multiple phases.
+
+**Frontmatter:**
+
+```yaml
+---
+id: TAMQ-WP-NNNN
+type: workplan
+title: "..."
+domain: communication
+repo: tmux-amq
+status: proposed | ready | active | blocked | backlog | finished | archived
+owner: codex
+topic_slug: ...
+created: "YYYY-MM-DD"
+updated: "YYYY-MM-DD"
+state_hub_workstream_id: "<uuid>"   # fix-consistency — do not edit (legacy field name; workplan UUID)
+---
+```
+
+Use `proposed` for a new draft, `ready` after review against current repo
+state, and `finished` after implementation. `stalled` and `needs_review` are
+derived health labels, not frontmatter statuses.
+
+**Terminology:** workplan is the fleet term; `workstream` appears only in legacy
+API/MCP/frontmatter bridges until `STATE-WP-0069` retires them — see
+`the-custodian/canon/standards/workplan-terminology-fleet_v0.1.md`.
+
+**Task block format** (one per `##` section):
+
+```
+## Task Title
+
+` ` `task
+id: TAMQ-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+` ` `
+
+Task description text.
+```
+
+Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.
+
+**Residuals when finishing:** actionable leftovers become live work records
+before `status: finished` — usually an intake (`origin: residual`,
+`origin_ref: TAMQ-WP-NNNN`) or a spawned workplan. Residual is a *role*,
+not a kind. Fleet list lives on State Hub, not in `SCOPE.md`.
+
+To create a new workplan:
+1. Write the file following the format above
+2. Run `statehub fix-consistency` locally.
+3. On a non-registrar C-06/C-11 skip, use the repo-manager fallback documented
+   above exactly once; never set registrar authority directly.
+
+---
+
+## Repository-specific workflow
+
+- Install development dependencies with `uv sync --extra dev`.
+- Run the test suite with `uv run pytest` or `make test`.
+- Before handoff, run `make check`; it combines tests, whitespace validation,
+  and Python bytecode compilation.
+- Exercise the installed command with `uv run tamq --help` and
+  `uv run tamq --version` when changing packaging or CLI behavior.
+- Keep tmux topology/control, durable broker state, and PTY input observation
+  as separate layers. Coordination-engine integration belongs behind the
+  Unix-socket boundary rather than inside terminal handling.

CLAUDE.md

@@ -0,0 +1,12 @@
+# tmux-amq — Claude Code Instructions
+
+@SCOPE.md
+@.claude/rules/repo-identity.md
+@.claude/rules/session-protocol.md
+@.claude/rules/first-session.md
+@.claude/rules/workplan-convention.md
+@.claude/rules/stack-and-commands.md
+@.claude/rules/architecture.md
+@.claude/rules/repo-boundary.md
+@.claude/rules/credential-routing.md
+@.claude/rules/agents.md

INTENT.md

@@ -0,0 +1,24 @@
+---
+repo: tmux-amq
+updated: "2026-08-24"
+---
+
+# INTENT
+
+## Why it exists
+
+Provide a local, durable, inspectable transport for direct messages between agent workers running in tmux, with strict repository targeting, explicit endpoint lifecycle, bounded retry behavior, and future interoperability with coordination-engine.
+
+## Governing principle
+
+This repository should stay focused on the purpose above. Work that changes its
+authority, ownership boundaries, or operational promises should be captured in a
+workplan before implementation.
+
+## What it enables
+
+- Agent workers can address one another by registered repository slug.
+- Messages, leases, delivery state, and acknowledgements survive process restarts.
+- Operators can inspect, export, replay, and purge local queue history.
+- A later coordination-engine adapter can use a stable local socket boundary
+  without absorbing tmux-specific concerns into the coordination engine.

SCOPE.md

@@ -0,0 +1,46 @@
+# SCOPE
+
+## One-liner
+
+Local durable message queue and tmux endpoint runtime for coordinating agent workers across gita-registered repositories.
+
+## Core Idea
+
+Keep tmux topology, terminal input observation, and durable local message state
+behind a small CLI and Unix-socket protocol that agents can use without owning
+a distributed coordination service.
+
+## In Scope
+
+- Local SQLite message history, leases, endpoint registrations, delivery state,
+  acknowledgements, replay, export, and bounded purging.
+- Managed tmux endpoint lifecycle, control-mode output/injection, and the
+  full-duplex `tamq tap` PTY broker.
+- Exact `gita` repository validation and direct `@repo: message` routing.
+- Unix-socket operations for local clients and a future coordination-engine
+  adapter.
+- Policy profiles, safety-gated retries, local diagnostics, tests, packaging,
+  shell completion, and operator documentation.
+
+## Out of Scope
+
+- Owning goal planning, workflow scheduling, or cross-host coordination; those
+  belong to `coordination-engine` and its consumers.
+- Acting as a network-accessible or multi-host message broker.
+- Bypassing `gita` registration or injecting arbitrary pane input outside the
+  supported tap/control-mode boundaries.
+- Owning tmux, Codex, State Hub, or adjacent repositories' lifecycle.
+
+## Current State
+
+- Version `0.1.0` provides the local queue, endpoint manager, control-mode
+  client, PTY tap, socket service, history operations, policy profiles, and CLI.
+- The local suite contains 50 passing tests as of 2026-08-24.
+- Coordination-engine integration is deferred to `TAMQ-WP-0002`.
+
+## Getting Oriented
+
+- Start with: INTENT.md
+- Agent instructions: AGENTS.md
+- Workplans: workplans/
+- Developer workflow: `uv sync --extra dev`, `make test`, and `make check`

WORK-RECORDS.md

@@ -0,0 +1,18 @@
+# Work Records — tmux-amq
+
+> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
+> stage 3). Do not edit by hand — edit the source file/block listed for
+> each record and re-run fix-consistency to refresh this index. Archived
+> workplans are omitted; closed decisions/intakes/engagements stay listed
+> so recently-resolved work is still visible. [auto]
+
+| Kind | ID | Status | Lane | Source |
+| --- | --- | --- | --- | --- |
+| workplan | TAMQ-WP-0001 | finished | — | workplans/TAMQ-WP-0001-statehub-bootstrap.md |
+| workplan | TAMQ-WP-0002 | backlog | — | workplans/TAMQ-WP-0002-coordination-engine-adapter.md |
+| task | TAMQ-WP-0001-T01 | done | — | workplans/TAMQ-WP-0001-statehub-bootstrap.md |
+| task | TAMQ-WP-0001-T02 | done | — | workplans/TAMQ-WP-0001-statehub-bootstrap.md |
+| task | TAMQ-WP-0001-T03 | done | — | workplans/TAMQ-WP-0001-statehub-bootstrap.md |
+| task | TAMQ-WP-0002-T01 | todo | — | workplans/TAMQ-WP-0002-coordination-engine-adapter.md |
+| task | TAMQ-WP-0002-T02 | wait | — | workplans/TAMQ-WP-0002-coordination-engine-adapter.md |
+| task | TAMQ-WP-0002-T03 | wait | — | workplans/TAMQ-WP-0002-coordination-engine-adapter.md |

workplans/TAMQ-WP-0001-statehub-bootstrap.md

@@ -0,0 +1,65 @@
+---
+id: TAMQ-WP-0001
+type: workplan
+title: "Bootstrap State Hub integration"
+domain: communication
+repo: tmux-amq
+status: finished
+owner: codex
+topic_slug: coulomb-social
+created: "2026-08-24"
+updated: "2026-08-24"
+---
+
+# Bootstrap State Hub integration
+
+Local durable message queue and tmux endpoint runtime for coordinating agent workers across gita-registered repositories.
+
+## Review Generated Integration Files
+
+```task
+id: TAMQ-WP-0001-T01
+status: done
+priority: high
+```
+
+Review `INTENT.md`, `SCOPE.md`, `AGENTS.md`, and `.custodian-brief.md`.
+Replace generated placeholders with repo-specific facts where needed.
+
+Completed during registration: purpose, boundaries, classification, State Hub
+identity, credential routing, and repository-specific instructions were
+reviewed and made concrete.
+
+## Verify Local Developer Workflow
+
+```task
+id: TAMQ-WP-0001-T02
+status: done
+priority: high
+```
+
+Identify the repo's install, test, lint, build, and run commands. Add or refine
+those commands in the agent instructions so future coding sessions can verify
+changes confidently.
+
+Completed with the uv, pytest, Makefile check, compilation, and CLI smoke
+commands recorded in `AGENTS.md` and `.claude/rules/stack-and-commands.md`.
+
+## Seed First Real Workplan
+
+```task
+id: TAMQ-WP-0001-T03
+status: done
+priority: medium
+```
+
+Create the first implementation workplan for the repository's most important
+next change. After workplan file updates, run the sync locally from this repo
+checkout:
+
+```bash
+statehub fix-consistency
+```
+
+Completed by creating `TAMQ-WP-0002`, which owns the explicitly deferred
+coordination-engine adapter boundary.

workplans/TAMQ-WP-0002-coordination-engine-adapter.md

@@ -0,0 +1,53 @@
+---
+id: TAMQ-WP-0002
+type: workplan
+title: "Coordination-engine adapter boundary"
+domain: communication
+repo: tmux-amq
+status: backlog
+owner: codex
+topic_slug: coulomb-social
+created: "2026-08-24"
+updated: "2026-08-24"
+---
+
+# Coordination-engine adapter boundary
+
+Connect coordination-engine to tmux-amq through the existing local Unix-socket
+boundary while preserving tmux-amq's local transport authority and keeping
+workflow/orchestration policy in coordination-engine.
+
+## Specify the adapter contract
+
+```task
+id: TAMQ-WP-0002-T01
+status: todo
+priority: high
+```
+
+Define request, response, identity, delivery, acknowledgement, retry, and
+failure semantics for a coordination-engine client. Resolve protocol-version
+negotiation and document which system owns each state transition.
+
+## Implement the coordination-engine client adapter
+
+```task
+id: TAMQ-WP-0002-T02
+status: wait
+priority: high
+```
+
+Implement the adapter against the stable socket contract without importing
+tmux/control-mode concerns into coordination-engine. This task waits for T01.
+
+## Prove interoperability and recovery
+
+```task
+id: TAMQ-WP-0002-T03
+status: wait
+priority: high
+```
+
+Add end-to-end coverage for delivery, acknowledgement, reconnect, replay,
+deduplication, incompatible protocol versions, and endpoint disappearance.
+Update both repositories' operator documentation with the verified workflow.