Wire Forge-native release infrastructure

services/mcp-hub/README.md

@@ -0,0 +1,25 @@
+# Burrow MCP Hub Extraction
+
+This directory is the in-repo extraction plan for a dedicated MCP hub repository.
+
+Target repository:
+
+```text
+compatible.systems/burrow/mcp-hub
+```
+
+The hub should expose Burrow-operated tools for:
+
+- Authentik users, groups, OIDC, SAML, SCIM, and WIF applications
+- OpenBao mounts, policies, AppRole, and secret-read workflows
+- Google KMS key catalog, public-key export, and signing readiness
+- Forgejo workflow dispatch, runner identity, and Namespace runner status
+- Grafana dashboard and alert checks
+- Jitsi meeting readiness and service health
+- mail and webmail readiness after the Stalwart phase starts
+- release signing, store upload readiness, and distribution metadata checks
+- agent identity inventory derived from `contributors.nix`
+
+The hub must keep identity and authorization explicit. Agent identities should be
+named, attributable, and backed by Authentik/WIF or OpenBao AppRole rather than
+static shared tokens.