docs(reuse): establish reviewed NetKingdom security capabilities

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

registry/capabilities/capability.audit.event-retain.md

@@ -1,16 +1,23 @@
 ---
 id: capability.audit.event-retain
-name: Audit Event Retention
-summary: Collect, normalize, retain, and search audit events with integrity evidence across tenants.
 owner: audit-core
-status: production
+status: draft
 domain: infotech
-tags: [audit, retention, compliance]
-joins:
-  itc_cap: operations.audit
-  provision: data/capability/audit-core-operational.json
-  provision_maturity: D4
-
+maturity:
+  discovery:
+    current: D3
+    target: D5
+    confidence: medium
+    rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
+      are documented; no exhaustive or generalized maturity claim.
+  availability:
+    current: A4
+    target: A4
+    confidence: medium
+    rationale: 'Source interface assessed 2026-10-14: Tenant-aware event ingestion,
+      chain integrity, heartbeat and reconciliation. Availability describes the delivery
+      form, not production acceptance. Custody after arrival does not prove source
+      completeness; freshness bounds integrity assertions.'
 external_evidence:
   completeness:
     level: C3
@@ -18,71 +25,91 @@ external_evidence:
     confidence: medium
     basis: live_receiver_and_restore_walk
     satisfied_expectations:
-      - HTTP ingest through the backend contract
-      - append-only Postgres custody on platform-pg
-      - recovery cited to the live platform data.backup provision
+    - HTTP ingest through the backend contract
+    - append-only Postgres custody on platform-pg
+    - recovery cited to the live platform data.backup provision
     broken_expectations:
-      - data.archive sink not provided
+    - data.archive sink not provided
     out_of_scope_expectations:
-      - application business audit semantics ownership
-      - booked-cost origination
+    - application business audit semantics ownership
+    - booked-cost origination
   reliability:
     level: R2
     confidence: medium
     basis: failure_matrix_and_restore_walk
     known_reliability_risks:
-      - single replica
-
+    - single replica
+name: Independent audit custody
+summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.
+tags:
+- security
+- netkingdom
+- framework-reuse
 discovery:
-  intent: >
-    Provide independent audit fabric for collecting, retaining, searching, and
-    proving integrity of audit events.
+  intent: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation
   includes:
-    - audit ingestion
-    - retention policy
-    - search and export
-    - tamper evidence
+  - Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation
   excludes:
-    - generating domain business events
-    - procuring or operating platform backup
-    - booked financial facts
-  use_cases: []
-
+  - Custody after arrival does not prove source completeness; freshness bounds integrity
+    assertions
+  use_cases:
+  - 'U08: Consumer emits security events and reconciles independently retained evidence'
+  - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and
+    verifies outcomes'
+  - 'U10: Operator recovers identity, custody or data with independently held recovery
+    material'
 availability:
   current_level: A4
-  target_level: A5
+  target_level: A4
   current_artifacts:
-    - audit-core/deploy/audit-core.yaml
-    - audit-core/audit_core/postgres_backend.py
-    - rapp-postgres/consumers/audit-core.yaml
+  - SCOPE.md
+  - docs/stream-completeness.md
   consumption_modes:
-    - http ingest
-    - source module
-
+  - HTTP API
+  - source
 relations:
-  depends_on: []
   related_to:
-    - capability.activity.event-coordinate
-    - capability.statehub.progress-log
-  uses_provisions:
-    - data.transactional (rapp-postgres/platform-pg)
-    - data.backup (resource:platform:audit-storage, cited)
-    - security.secrets (OpenBao / ESO)
-
+  - capability.security.approval-lifecycle
+  - capability.identity.tenant-facts
+  - capability.security.posture-assessment
+  - capability.observability.security-signals
+evidence:
+  documentation:
+  - SCOPE.md
+  - docs/stream-completeness.md
 consumer_guidance:
   recommended_for:
-    - platform and application audit event delivery over POST /v1/events
+  - Consumer emits security events and reconciles independently retained evidence
+  - Maintainer observes posture, prioritizes findings, coordinates work and verifies
+    outcomes
+  - Operator recovers identity, custody or data with independently held recovery material
   not_recommended_for:
-    - treating this store as WORM archive
-    - replacing application-level logging only
+  - Custody after arrival does not prove source completeness; freshness bounds integrity
+    assertions
   known_limitations:
-    - recoverable history is the 30-day platform backup window
-    - no hash-chain or export API yet
+  - Custody after arrival does not prove source completeness; freshness bounds integrity
+    assertions
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
 ---
 
-# Audit Event Retention
+# Independent audit custody
 
-Audit Core provides the operational custody layer for audit events.
-ITC-CAP join: `operations.audit` at provision maturity D4
-(`data/capability/audit-core-operational.json`). Maturity is not a
-property of this abstract capability.
+Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.
+
+## Reuse boundary
+
+Custody after arrival does not prove source completeness; freshness bounds integrity assertions.
+
+## Supported use cases
+
+- U08: Consumer emits security events and reconciles independently retained evidence
+- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes
+- U10: Operator recovers identity, custody or data with independently held recovery material
+
+## Evidence and integration
+
+- [SCOPE.md](../../SCOPE.md)
+- [docs/stream-completeness.md](../../docs/stream-completeness.md)
+
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

registry/indexes/capabilities.yaml

@@ -1,22 +1,19 @@
 version: 1
-updated: '2026-08-16'
+updated: '2026-10-14'
 domain: infotech
 capabilities:
 - id: capability.audit.event-retain
-  name: Audit Event Retention
-  summary: Collect, normalize, retain, and search audit events with integrity evidence
-    across tenants.
-  joins: operations.audit
-  provision: data/capability/audit-core-operational.json
-  vector: D4 provision / A4 / C3 / R2
+  name: Independent audit custody
+  summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.
   domain: infotech
-  status: production
+  status: draft
   owner: audit-core
-  path: registry/capabilities/capability.audit.event-retain.md
   tags:
-  - audit
-  - retention
-  - compliance
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C3 / R2
+  path: registry/capabilities/capability.audit.event-retain.md
   consumption_modes:
-  - http ingest
-  - source module
+  - HTTP API
+  - source