Add Forgejo CI smoke workflow (enablement template)

Reviewed for the reuse-surface capability registry coverage campaign;
no reusable capability to register at this time. See file for rationale.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.claude/rules/agents.md

@@ -0,0 +1,20 @@
+## Kaizen Agents
+
+Specialized agent personas available on demand via the state-hub MCP.
+
+**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category
+**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them
+
+Common agents:
+
+| Agent | Category | When to use |
+|-------|----------|-------------|
+| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature |
+| `code-refactoring` | quality | Code quality analysis and safe refactoring |
+| `test-maintenance` | testing | Diagnose and fix failing tests |
+| `requirements-engineering` | process | Prevent interface/mock mismatches upfront |
+| `keepaTodofile` | process | Maintain TODO.md during work |
+| `project-management` | process | Track status, determine next steps |
+| `datamodel-optimization` | quality | Optimize dataclasses and data structures |
+
+All 17 agents: call `list_kaizen_agents()` for the full list.

.claude/rules/architecture.md

@@ -0,0 +1,8 @@
+## Architecture
+
+<!-- TODO: Describe the key design decisions and component structure.
+     Key modules, data flows, external integrations, state machines, etc. -->
+
+## Quick Reference
+
+`~/state-hub/mcp_server/TOOLS.md` — MCP tool reference

.claude/rules/credential-routing.md

@@ -0,0 +1,50 @@
+# Credential and access routing
+
+**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
+for inference. Run this check **before** requesting secrets, API keys, SSH access,
+login tokens, or database passwords — in any repo, not only `ops-warden`.
+
+ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
+other credential need belongs to another subsystem. **Do not** message
+`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.
+
+### Lookup (do this first)
+
+```bash
+warden route find "<describe your need>" --json
+warden route show <catalog-id> --json
+```
+
+Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
+
+| Agent runtime | How to orient |
+| --- | --- |
+| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=whynot-control` is for coordination, not secret vending |
+| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workstreams; **still** use `warden route` for credential ownership |
+| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
+
+### Quick routing table
+
+| I need… | Owner | ops-warden executes? |
+| --- | --- | --- |
+| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
+| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
+| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
+| Authorization decision | flex-auth | No — route only |
+| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
+| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |
+
+### Anti-patterns (do not do these)
+
+- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
+- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
+- Pasting secrets into Git, State Hub, workplans, logs, or chat
+
+### Other capabilities (reuse-surface)
+
+Non-credential capabilities are usually discovered through **reuse-surface** federation
+(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
+every repo's agent instructions because it is high-frequency, high-risk, and easy to
+get wrong.
+
+**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`

.claude/rules/first-session.md

@@ -0,0 +1,38 @@
+## First Session Protocol
+
+Triggered when `get_domain_summary("consumer")` shows **no workstreams**.
+The project is registered but work has not yet been structured.
+
+**Step 1 — Read, don't write**
+- `~/the-custodian/canon/projects/consumer/project_charter_v0.1.md` — purpose, scope
+- `~/the-custodian/canon/projects/consumer/roadmap_v0.1.md` — planned phases
+- Scan repo root: README, directory structure, existing code or docs
+
+**Step 2 — Survey in-progress work**
+Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete.
+
+**Step 3 — Propose workstreams to Bernd**
+Propose 1–3 workstreams — each a coherent strand, weeks to months, anchored to a
+roadmap phase. **Wait for approval before creating.**
+
+**Step 4 — Create workplan file first, then DB record (ADR-001)**
+```
+workplans/WHYNOT-WP-NNNN-<slug>.md   ← write this first
+```
+Then register in the hub:
+```
+create_workstream(topic_id="4c2e5315-2cb9-447c-9d16-a39bdb0aabd0", title="...", owner="...", description="...")
+create_task(workstream_id="<id>", title="...", priority="high|medium|low")
+```
+
+**Step 5 — Record the setup**
+```
+add_progress_event(
+    summary="First session: structured consumer into N workstreams, M tasks",
+    event_type="milestone",
+    topic_id="4c2e5315-2cb9-447c-9d16-a39bdb0aabd0",
+    detail={"workstreams": [...], "tasks_created": M}
+)
+```
+
+<!-- Delete or archive this file once past first session -->

.claude/rules/repo-boundary.md

@@ -0,0 +1,8 @@
+## Repo boundary
+
+This repo owns **Whynot Control** only. It does not own:
+
+<!-- TODO: List what belongs in adjacent repos, e.g.:
+- SSH key management → railiance-infra/
+- State hub code     → state-hub/
+-->

.claude/rules/repo-identity.md

@@ -0,0 +1,5 @@
+**Purpose:** Whynot Control - (fill in purpose)
+
+**Domain:** consumer
+**Repo slug:** whynot-control
+**Topic ID:** 4c2e5315-2cb9-447c-9d16-a39bdb0aabd0

.claude/rules/session-protocol.md

@@ -0,0 +1,85 @@
+## Session Protocol
+
+Dev Hub (State Hub API): http://127.0.0.1:8000
+MCP server name in `~/.claude.json`: `dev-hub`
+
+**Step 1 — Orient**
+
+Read the offline-safe brief first — it works without a live hub connection:
+```bash
+cat .custodian-brief.md
+```
+Then call the MCP tool for richer cross-domain context when MCP tools are exposed:
+```
+get_domain_summary("consumer")
+```
+If MCP tools are unavailable in the current agent session, use the REST API:
+```bash
+curl -s "http://127.0.0.1:8000/state/summary" | python3 -m json.tool
+```
+If the hub is offline: `cd ~/state-hub && make api`
+
+**Step 2 — Check inbox**
+With MCP tools:
+```
+get_messages(to_agent="whynot-control", unread_only=True)
+```
+Mark read with `mark_message_read(message_id)`. Reply or act on coordination
+requests before proceeding.
+
+Without MCP tools:
+```bash
+curl -s "http://127.0.0.1:8000/messages/?to_agent=whynot-control&unread_only=true" \
+  | python3 -m json.tool
+curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
+  -H "Content-Type: application/json" -d '{}'
+```
+
+**Step 3 — Scan workplans**
+```bash
+ls workplans/
+```
+For each file with `status: ready`, `active`, or `blocked`, note pending
+`wait`/`todo`/`progress` tasks.
+
+**Step 4 — Present brief**
+
+1. **Active workstreams** for `consumer` — title, task counts, blocking decisions
+2. **Pending tasks** from `workplans/` + any `[repo:whynot-control]` hub tasks
+3. **Goal guidance** — if `goal_guidance` in summary:
+   - `needs_workplan`: surface as top action — *"Repo goal '{title}' has no workplan yet"*
+   - `alignment_warnings`: flag if active work is not aligned with current goal
+4. **Suggested next action** — highest-priority open item
+5. **SBOM status** — flag if `last_sbom_at` is unset for this repo
+
+If no workstreams: follow First Session Protocol (`first-session.md`).
+
+**During work:** `record_decision()` · `add_progress_event()` · `resolve_decision()`
+
+> State Hub is a *read model*. Bootstrap tools (`create_workstream`, `create_task`)
+> are First Session Protocol only. Work structure belongs in repo files (ADR-001).
+
+**Session close:**
+With MCP tools:
+```
+add_progress_event(summary="...", topic_id="4c2e5315-2cb9-447c-9d16-a39bdb0aabd0", workstream_id="<uuid>")
+```
+Without MCP tools:
+```bash
+curl -s -X POST http://127.0.0.1:8000/progress/ \
+  -H "Content-Type: application/json" \
+  -d '{"topic_id":"4c2e5315-2cb9-447c-9d16-a39bdb0aabd0","workstream_id":"<uuid>","event_type":"note","summary":"what changed","author":"codex"}'
+```
+If workplan files were modified, ensure the local copy is up to date first:
+```bash
+git -C <repo_path> pull --ff-only
+cd ~/state-hub && make fix-consistency REPO=whynot-control
+```
+For repos where implementation runs on a remote machine (e.g. CoulombCore),
+use the combined target which pulls before fixing:
+```bash
+cd ~/state-hub && make fix-consistency-remote REPO=whynot-control
+```
+**C-15** (DB task ahead of file) is normal in multi-machine workflows — writeback
+will sync the file to match DB.  **C-16** (repo behind remote) blocks all writes
+until you pull — intentional to prevent clobbering remote progress.

.claude/rules/stack-and-commands.md

@@ -0,0 +1,15 @@
+## Stack
+
+- **Language:** Markdown-first control/planning repository (no application runtime)
+- **Key deps:** State Hub workplans, agent instructions, optional `registry/` scaffold
+
+## Dev Commands
+
+```bash
+cat .custodian-brief.md
+cat INTENT.md
+ls workplans/
+
+# After workplan edits — from ~/state-hub
+make fix-consistency REPO=whynot-control
+```

.claude/rules/workplan-convention.md

@@ -0,0 +1,40 @@
+## Workplan Convention (ADR-001)
+
+File location: `workplans/WHYNOT-WP-NNNN-<slug>.md`
+ID prefix: `WHYNOT-WP-`
+
+Work items originate as files in this repo **before** being registered in the hub.
+
+Canonical workplan/workstream frontmatter statuses are:
+`proposed`, `ready`, `active`, `blocked`, `backlog`, `finished`, `archived`.
+Use `proposed` for a newly drafted plan, `ready` after review against current
+repo state, and `finished` when implementation is complete. `stalled` and
+`needs_review` are derived health labels, not stored statuses.
+
+Closed workplans may be moved to `workplans/archived/` with a completion-date
+prefix: `YYMMDD-WHYNOT-WP-NNNN-<slug>.md`. The frontmatter id remains
+unchanged; the prefix is only for quick visual reference.
+
+Small opportunistic tasks discovered during another session use **Ad Hoc Tasks**:
+`workplans/ADHOC-YYYY-MM-DD.md`, workstream slug `adhoc-YYYY-MM-DD`, and task ids
+`ADHOC-YYYY-MM-DD-T01`, `T02`, etc. Use adhocs only for low-risk work completed
+directly. Promote anything requiring analysis, design, approval, dependencies, or
+multiple planned phases into a normal workplan.
+
+Ecosystem todos from other agents arrive as `[repo:whynot-control]` hub tasks —
+visible at session start. Pick one up by creating the workplan file, then registering
+the workstream.
+
+Task blocks use this shape:
+
+```task
+id: WHYNOT-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+```
+
+Status progression is `todo` → `progress` → `done`; use `wait` for waiting or
+blocked work and `cancel` for stopped work.
+
+<!-- Ralph Loop rules and HEUREKA sequence: ~/.claude/CLAUDE.md — do not duplicate here -->

.custodian-brief.md

@@ -0,0 +1,18 @@
+<!-- custodian-brief: generated by fix-consistency — do not edit manually -->
+# Custodian Brief — whynot-control
+
+**Domain:** consumer  
+**Last synced:** 2026-07-03 18:41 UTC  
+**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
+
+## Active Workstreams
+
+*(none — repo may need first-session setup)*
+
+---
+## MCP Orientation (when available)
+
+If the state-hub MCP server is reachable, call:
+`get_domain_summary("consumer")`
+This provides richer cross-domain context.
+If the MCP call fails, use this file as your orientation source.

.forgejo/workflows/ci-smoke.yaml

@@ -0,0 +1,29 @@
+# Canonical CI smoke template (tier 1 routing drill).
+# Copy to: .forgejo/workflows/ci-smoke.yaml in consumer repos.
+name: CI Smoke
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+jobs:
+  host-smoke:
+    runs-on: self-hosted
+    steps:
+      - name: Routing probe (host runner)
+        run: |
+          set -eu
+          echo "repository=${GITHUB_REPOSITORY:-unknown}"
+          echo "sha=${GITHUB_SHA:-unknown}"
+          echo "runner=${RUNNER_NAME:-unknown}"
+          uname -a
+
+  container-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Routing probe (container label)
+        run: |
+          set -eu
+          echo "container-smoke ok for ${GITHUB_REPOSITORY:-unknown}"

.repo-classification.yaml

@@ -0,0 +1,23 @@
+repo_classification:
+  standard: Repo Classification Standard
+  version: '1.0'
+  classified_at: '2026-06-22'
+  classified_by: agent
+  category: research
+  domain: consumer
+  secondary_domains:
+  - communication
+  capability_tags:
+  - product-development
+  - knowledge
+  - coordination
+  - documentation
+  business_stake:
+  - product
+  - experience
+  - intelligence
+  business_mechanics:
+  - intention
+  - coordination
+  - adaptation
+  notes: whynot prototype and market-signal control repository.

AGENTS.md

@@ -0,0 +1,219 @@
+# Whynot Control — Agent Instructions
+
+## Repo Identity
+
+**Purpose:** Whynot Control - (fill in purpose)
+
+**Domain:** consumer
+**Repo slug:** whynot-control
+**Topic ID:** `4c2e5315-2cb9-447c-9d16-a39bdb0aabd0`
+**Workplan prefix:** `WHYNOT-WP-`
+
+---
+
+## State Hub Integration
+
+The Custodian State Hub tracks work across all domains. Interact via HTTP REST —
+there is no MCP server for Codex agents.
+
+| Context | URL |
+|---------|-----|
+| Local workstation | `http://127.0.0.1:8000` |
+| Remote via tunnel | `http://127.0.0.1:18000` |
+
+### Orient at session start
+
+```bash
+# Offline brief — works without hub connection
+cat .custodian-brief.md
+
+# Active workstreams for this domain
+curl -s "http://127.0.0.1:8000/workstreams/?topic_id=4c2e5315-2cb9-447c-9d16-a39bdb0aabd0&status=active" \
+  | python3 -m json.tool
+
+# Check inbox
+curl -s "http://127.0.0.1:8000/messages/?to_agent=whynot-control&unread_only=true" \
+  | python3 -m json.tool
+```
+
+Mark a message read:
+```bash
+curl -s -X PATCH "http://127.0.0.1:8000/messages/<id>/read" \
+  -H "Content-Type: application/json" -d '{}'
+```
+
+### Log progress (required at session close)
+
+```bash
+curl -s -X POST http://127.0.0.1:8000/progress/ \
+  -H "Content-Type: application/json" \
+  -d '{
+    "summary": "what was done",
+    "event_type": "note",
+    "author": "codex",
+    "workstream_id": "<uuid>",
+    "task_id": "<uuid>"
+  }'
+```
+
+Omit `workstream_id` / `task_id` when not applicable.
+
+### Update task status
+
+```bash
+curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
+  -H "Content-Type: application/json" \
+  -d '{"status": "progress"}'
+# values: wait | todo | progress | done | cancel
+```
+
+### Flag a task for human review
+
+```bash
+curl -s -X PATCH "http://127.0.0.1:8000/tasks/<task_id>" \
+  -H "Content-Type: application/json" \
+  -d '{"needs_human": true, "intervention_note": "reason"}'
+```
+
+---
+
+## Session Protocol
+
+**Start:**
+1. `cat .custodian-brief.md` — domain goal and open workstreams (offline-safe)
+2. Check inbox: `GET /messages/?to_agent=whynot-control&unread_only=true`; mark read
+3. Scan workplans: `ls workplans/` — note `status: ready`, `active`, or `blocked` files and open tasks
+4. Check human-needed tasks: `GET /tasks/?needs_human=true`
+
+**During work:**
+- Update task statuses in workplan files as tasks progress
+- Record significant decisions via `POST /decisions/`
+
+**Close:**
+1. Update workplan file task statuses to reflect progress
+2. Log: `POST /progress/` with a summary of what changed
+3. Note for the custodian operator: after workplan file changes, run from
+   `~/state-hub`:
+   ```bash
+   make fix-consistency REPO=whynot-control
+   ```
+   This syncs task status from files into the hub DB.
+
+---
+
+## Credential and access routing
+
+**Audience:** Codex, Claude Code, Grok, and custodian agents that call **llm-connect**
+for inference. Run this check **before** requesting secrets, API keys, SSH access,
+login tokens, or database passwords — in any repo, not only `ops-warden`.
+
+ops-warden **issues SSH certificates only** (`warden sign`, `cert_command`). Every
+other credential need belongs to another subsystem. **Do not** message
+`ops-warden` on State Hub expecting a secret value; the reply is a pointer, not a key.
+
+### Lookup (do this first)
+
+```bash
+warden route find "<describe your need>" --json
+warden route show <catalog-id> --json
+```
+
+Requires the `warden` CLI from `~/ops-warden` (`uv tool install .` or `uv run warden`).
+
+| Agent runtime | How to orient |
+| --- | --- |
+| **Codex / Grok** (shell, HTTP State Hub) | `warden route` commands above; inbox `to_agent=whynot-control` is for coordination, not secret vending |
+| **Claude Code** (MCP when available) | `get_domain_summary("custodian")` for workstreams; **still** use `warden route` for credential ownership |
+| **llm-connect** (inference service) | Never put secret retrieval in prompts; route custody to OpenBao/operator paths surfaced by `warden route` |
+
+### Quick routing table
+
+| I need… | Owner | ops-warden executes? |
+| --- | --- | --- |
+| SSH cert (`adm`/`agt`/`atm`) | ops-warden | **Yes** — `warden sign` |
+| API key, DB password, provider token | OpenBao (`railiance-platform`) | No — route only |
+| Login / OIDC / MFA | key-cape / Keycloak | No — route only |
+| Authorization decision | flex-auth | No — route only |
+| activity-core → issue-core emission | activity-core + issue-core | No — `warden route show activity-core-issue-sink` |
+| SSH tunnel | ops-bridge (+ `cert_command` from warden) | No — route only |
+
+### Anti-patterns (do not do these)
+
+- `POST /messages/` to `ops-warden` asking for `ISSUE_CORE_API_KEY`, `OPENROUTER_API_KEY`, etc.
+- Inventing `warden secret`, `warden login`, `warden bao`, `warden tunnel` — they do not exist
+- Pasting secrets into Git, State Hub, workplans, logs, or chat
+
+### Other capabilities (reuse-surface)
+
+Non-credential capabilities are usually discovered through **reuse-surface** federation
+(`reuse-surface` registry / `capability.*` indexes). Credential routing is inlined in
+every repo's agent instructions because it is high-frequency, high-risk, and easy to
+get wrong.
+
+**Canon:** `~/ops-warden/wiki/CredentialRouting.md` · catalog `~/ops-warden/registry/routing/catalog.yaml`
+
+<!-- REPO-AGENTS-EXTENSIONS -->
+<!-- Append repo-specific agent instructions below this marker.
+     The state-hub template sync preserves content after this line. -->
+
+---
+
+## Workplan Convention (ADR-001)
+
+Work items originate as files in this repo — not in the hub. The hub is a
+read/cache/index layer that rebuilds from files.
+
+**File location:** `workplans/WHYNOT-WP-NNNN-<slug>.md`
+
+**Archived location:** finished workplans may move to
+`workplans/archived/YYMMDD-WHYNOT-WP-NNNN-<slug>.md`. The `YYMMDD` prefix is
+the completion/archive date; the frontmatter `id` does not change.
+
+**Ad Hoc Tasks:** small opportunistic fixes discovered during a session use
+`workplans/ADHOC-YYYY-MM-DD.md` with task ids `ADHOC-YYYY-MM-DD-T01`, etc. Use
+this only for low-risk work completed directly; create a normal workplan for
+anything needing analysis, design, approval, dependencies, or multiple phases.
+
+**Frontmatter:**
+
+```yaml
+---
+id: WHYNOT-WP-NNNN
+type: workplan
+title: "..."
+domain: consumer
+repo: whynot-control
+status: proposed | ready | active | blocked | backlog | finished | archived
+owner: codex
+topic_slug: ...
+created: "YYYY-MM-DD"
+updated: "YYYY-MM-DD"
+state_hub_workstream_id: "<uuid>"   # written by fix-consistency — do not edit
+---
+```
+
+Use `proposed` for a new draft, `ready` after review against current repo
+state, and `finished` after implementation. `stalled` and `needs_review` are
+derived health labels, not frontmatter statuses.
+
+**Task block format** (one per `##` section):
+
+```
+## Task Title
+
+` ` `task
+id: WHYNOT-WP-NNNN-T01
+status: wait | todo | progress | done | cancel
+priority: high | medium | low
+state_hub_task_id: "<uuid>"         # written by fix-consistency — do not edit
+` ` `
+
+Task description text.
+```
+
+Status progression: `todo` → `progress` → `done`; use `wait` for waiting/blocked work and `cancel` for stopped work.
+
+To create a new workplan:
+1. Write the file following the format above
+2. Notify the custodian operator to run `make fix-consistency REPO=whynot-control`
+   (or send a message to the hub agent via `POST /messages/`)

BETA_SIGNAL_INTAKE.md

@@ -0,0 +1,59 @@
+# Beta Signal Intake
+
+## Purpose
+
+This playbook defines how a `whynot` idea moves from prototype intake through beta, signal review, and promotion decision.
+
+## Flow
+
+### 1. Intake and Triage
+
+- Capture loose ideas in `inbox/`.
+- Use `PROTOTYPE_PIPELINE.md` Stage 0 and Stage 1 to decide whether to park, reject, merge, or create a prototype card.
+- If the idea deserves structured work, create a prototype card from `templates/prototype-card.md` in `prototypes/`.
+
+### 2. Prototype Readiness
+
+A prototype is ready for beta planning when it has:
+
+- a named audience;
+- a learning question;
+- a smallest useful test;
+- an expected signal;
+- a plausible promotion target if the signal is positive.
+
+### 3. Beta Planning
+
+- Use `BETA_MODEL.md` to choose the beta type and confirm entry criteria.
+- Create a beta plan from `templates/beta-plan.md` in `betas/`.
+- Keep the beta small, explicit, and reversible.
+
+### 4. Signal Capture
+
+- Record feedback and market evidence in `signals/`.
+- Use `MARKET_SIGNAL.md` and `templates/signal-record.md`.
+- Preserve null, weak, and contradictory signals rather than rewriting history.
+
+### 5. Promotion Decision
+
+- Review prototype state, beta notes, and signal strength together.
+- Draft a decision from `templates/promotion-decision.md`.
+- Record the final promotion or non-promotion outcome in `DECISIONS.md`.
+
+## Required Artifacts
+
+| Stage | Required artifact | Location |
+|---|---|---|
+| Intake | raw note or captured idea | `inbox/` |
+| Prototype | prototype card | `prototypes/` |
+| Beta | beta plan | `betas/` |
+| Signal | signal record | `signals/` |
+| Decision | promotion decision record | `DECISIONS.md` and optionally a filled copy of `templates/promotion-decision.md` |
+
+## Seeded Agent Tasks
+
+- `agent-tasks/triage-prototype-intake.md`
+- `agent-tasks/prepare-beta-plan.md`
+- `agent-tasks/review-signals-and-draft-decision.md`
+
+Use these when the repo needs a repeatable agent prompt instead of ad hoc instructions.

CLAUDE.md

@@ -0,0 +1,12 @@
+# Whynot Control — Claude Code Instructions
+
+@SCOPE.md
+@.claude/rules/repo-identity.md
+@.claude/rules/session-protocol.md
+@.claude/rules/first-session.md
+@.claude/rules/workplan-convention.md
+@.claude/rules/stack-and-commands.md
+@.claude/rules/architecture.md
+@.claude/rules/repo-boundary.md
+@.claude/rules/credential-routing.md
+@.claude/rules/agents.md

README.md

@@ -9,9 +9,10 @@ Control repository for the `whynot` organization.
 1. Read `INTENT.md`.
 2. Review `SCOPE.md`.
 3. Use `PROTOTYPE_PIPELINE.md` to classify ideas.
-4. Capture loose ideas in `inbox/`.
+4. Use `BETA_SIGNAL_INTAKE.md` for the prototype -> beta -> signal -> decision flow.
-5. Create prototype cards only for ideas that deserve structured exploration.
+5. Capture loose ideas in `inbox/`.
-6. Promote only validated candidates toward Helix, Coulomb, Sloppers, Plenitude, or Binky.
+6. Create prototype cards only for ideas that deserve structured exploration.
+7. Promote only validated candidates toward Helix, Coulomb, Sloppers, Plenitude, or Binky.
 
 ## Core Principle
 

agent-tasks/prepare-beta-plan.md

@@ -0,0 +1,35 @@
+# Agent Task: Prepare Beta Plan
+
+## Goal
+Draft a small, controlled beta plan for a named prototype.
+
+## Context
+`whynot` uses closed betas to learn quickly without implying production maturity. Beta rules are defined in `BETA_MODEL.md`.
+
+## Inputs
+- A prototype card from `prototypes/`
+- `BETA_MODEL.md`
+- `templates/beta-plan.md`
+
+## Allowed Changes
+- Create or refine a beta plan in `betas/`.
+- Clarify the learning question, target audience, entry criteria, and feedback method.
+- Recommend the most appropriate beta type.
+
+## Forbidden Changes
+- Do not announce a public beta.
+- Do not promise production readiness.
+- Do not add payment or investment mechanics unless explicitly approved.
+
+## Expected Output
+- One beta plan with a clear learning question, beta type, entry criteria, feedback method, and end condition.
+
+## Acceptance Criteria
+- The plan names the prototype and audience.
+- The plan explains how feedback will be captured.
+- The beta is small and reversible.
+
+## Human Approval Required For
+- Public launch language.
+- Paid beta mechanics.
+- Cross-repo implementation commitments.

agent-tasks/review-signals-and-draft-decision.md

@@ -0,0 +1,38 @@
+# Agent Task: Review Signals And Draft Decision
+
+## Goal
+Turn prototype and beta evidence into a clear signal review and draft promotion decision.
+
+## Context
+Signals are evidence, not enthusiasm. `MARKET_SIGNAL.md` defines strength levels, and `PROTOTYPE_PIPELINE.md` requires an explicit decision before promotion.
+
+## Inputs
+- A prototype card
+- Any related beta notes or beta plan
+- Signal notes or records
+- `MARKET_SIGNAL.md`
+- `templates/signal-record.md`
+- `templates/promotion-decision.md`
+
+## Allowed Changes
+- Create or refine signal records in `signals/`.
+- Summarize beta feedback faithfully.
+- Draft a promotion decision for later human review.
+
+## Forbidden Changes
+- Do not upgrade weak evidence into strong signal.
+- Do not hide contradictory evidence.
+- Do not mark promotion as final without explicit approval.
+
+## Expected Output
+- A signal summary with strength assessment.
+- A draft decision: promote, iterate, park, reject, or merge.
+
+## Acceptance Criteria
+- Evidence and counter-evidence are both represented.
+- The recommendation matches the recorded signal strength.
+- The proposed next step is explicit.
+
+## Human Approval Required For
+- Final promotion into another initiative.
+- Any external-facing launch or commercial claim.

agent-tasks/triage-prototype-intake.md

@@ -0,0 +1,34 @@
+# Agent Task: Triage Prototype Intake
+
+## Goal
+Turn a rough idea into a clear triage outcome: prototype card, merge, park, or reject.
+
+## Context
+`whynot-control` uses `PROTOTYPE_PIPELINE.md` to move ideas from raw capture into structured prototype exploration.
+
+## Inputs
+- One item from `inbox/` or an equivalent rough note.
+- `PROTOTYPE_PIPELINE.md`
+- `templates/prototype-card.md`
+
+## Allowed Changes
+- Create or refine a prototype card in `prototypes/`.
+- Improve wording and structure of the input note.
+- Recommend park, merge, or reject when a prototype card is not justified.
+
+## Forbidden Changes
+- Do not treat the idea as a committed product.
+- Do not invent signal evidence that does not exist.
+- Do not create beta, pricing, or public launch commitments.
+
+## Expected Output
+- One explicit triage outcome.
+- If promoted to prototype, one draft prototype card with learning question, test, and expected signal.
+
+## Acceptance Criteria
+- The output states who might care, what is being tested, and the smallest useful next step.
+- The outcome is one of: prototype card, merge, park, or reject.
+
+## Human Approval Required For
+- Promoting the idea beyond prototype exploration.
+- Making external commitments.

registry/NO_CAPABILITIES.md

@@ -0,0 +1,15 @@
+---
+repo: whynot-control
+reason: >
+  Business-signal/beta-tracking scaffolding (betas/, prototypes/, offers/, signals/) with only README stubs — no independent reusable component.
+reviewed: "2026-07-06"
+reviewed_by: claude-code
+revisit: >
+  Revisit if beta-tracking tooling becomes a standalone implemented service.
+---
+
+# No reusable capability
+
+This repo was reviewed for the `reuse-surface` capability registry
+(REUSE-WP-0017 coverage campaign) and has no capability to register at this
+time. See the `reason` field above.

registry/README.md

@@ -0,0 +1,12 @@
+# Capability Registry
+
+Markdown-first capability index for federation and reuse planning.
+
+## Authoring
+
+1. Copy a capability entry template (see reuse-surface `templates/capability-entry.template.md`).
+2. Add the row to `indexes/capabilities.yaml`.
+3. Run `reuse-surface validate` from a checkout with the CLI installed.
+4. Merge to `main` and verify publish with `reuse-surface establish --publish-check`.
+
+Federation contract: reuse-surface `docs/RegistryFederation.md`.

registry/indexes/capabilities.yaml

@@ -0,0 +1,4 @@
+version: 1
+updated: '2026-06-16'
+domain: helix_forge
+capabilities: []

workplans/WHYNOT-WP-0001-statehub-bootstrap.md

@@ -0,0 +1,67 @@
+---
+id: WHYNOT-WP-0001
+type: workplan
+title: "Bootstrap State Hub integration"
+domain: consumer
+repo: whynot-control
+status: finished
+owner: codex
+topic_slug: consumer
+created: "2026-06-22"
+updated: "2026-06-22"
+state_hub_workstream_id: "e09fd25b-c678-412e-9231-66ce5efc04e8"
+---
+
+# Bootstrap State Hub integration
+
+Whynot control plane.
+
+## Review Generated Integration Files
+
+```task
+id: WHYNOT-WP-0001-T01
+status: done
+priority: high
+state_hub_task_id: "64aaa12f-b724-4cfe-8a0b-797209d5f1eb"
+
+```
+
+Result 2026-06-22: INTENT.md reviewed.
+
+Review `INTENT.md`, `SCOPE.md`, `AGENTS.md`, and `.custodian-brief.md`.
+Replace generated placeholders with repo-specific facts where needed.
+
+## Verify Local Developer Workflow
+
+```task
+id: WHYNOT-WP-0001-T02
+status: done
+priority: high
+state_hub_task_id: "2164991f-c870-4b4e-bebc-147336e2341e"
+
+```
+
+Result 2026-06-22: Control-repo workflow documented.
+
+Identify the repo's install, test, lint, build, and run commands. Add or refine
+those commands in the agent instructions so future coding sessions can verify
+changes confidently.
+
+## Seed First Real Workplan
+
+```task
+id: WHYNOT-WP-0001-T03
+status: done
+priority: medium
+state_hub_task_id: "0cc23609-4995-46b8-82cb-2b00125b049e"
+
+```
+
+Result 2026-06-22: Created WHYNOT-WP-0002.
+
+Create the first implementation workplan for the repository's most important
+next change. After workplan file updates, run from `~/state-hub`:
+
+```bash
+make fix-consistency REPO=whynot-control
+```

workplans/WHYNOT-WP-0002-beta-signal-intake.md

@@ -0,0 +1,30 @@
+---
+id: WHYNOT-WP-0002
+type: workplan
+title: "Beta signal intake pipeline"
+domain: consumer
+repo: whynot-control
+status: finished
+owner: codex
+topic_slug: consumer
+created: "2026-06-22"
+updated: "2026-07-03"
+state_hub_workstream_id: "f0b119be-93f7-4115-a83c-1c54060d1ce3"
+---
+
+# Beta signal intake pipeline
+
+Structure how prototype signals, betas, and feedback enter the whynot organization.
+
+## Beta intake pipeline
+
+```task
+id: WHYNOT-WP-0002-T01
+status: done
+priority: high
+state_hub_task_id: "cbe32490-2bc3-4a87-a9b3-faf6fe9d3723"
+```
+
+Result 2026-07-03: Added `BETA_SIGNAL_INTAKE.md`, linked it from `README.md`, and seeded intake-specific prompts in `agent-tasks/`.
+
+Document intake stages from prototype → beta → signal → promotion decision; seed first agent-tasks/ entries.