feat(posture): add deterministic feedback proposals

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02929-244b-7391-b933-c04010e8eedb

registry/capabilities/capability.security.iam-tooling-suite.md

@@ -2,7 +2,7 @@
 id: capability.security.iam-tooling-suite
 name: NetKingdom Security/IAM Tooling Suite
 summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation,
-  and deterministic plan-only security scenario composition.
+  deterministic plan-only security scenario composition, and proposal-only posture feedback.
 owner: net-kingdom
 status: draft
 domain: infotech
@@ -25,7 +25,7 @@ maturity:
     target: A3
     confidence: medium
     rationale: 'No top-level package manifest, but tools/ holds independently documented and runnable
-      conformance, posture, scenario-composition, and guarded bootstrap tools; local-identity is separately
+      conformance, posture, posture-feedback, scenario-composition, and guarded bootstrap tools; local-identity is separately
       packaged and tested.'
 external_evidence:
   completeness:
@@ -53,6 +53,7 @@ discovery:
   - playbook capability contract validator
   - deterministic plan-only security scenario composer
   - tenancy posture schema and validator
+  - deterministic proposal-only posture feedback evaluator
   - security bootstrap console (local, non-secret-collecting)
   - packaged local bootstrap identity CLI
   excludes:
@@ -69,6 +70,7 @@ availability:
   - tools/playbook-capability-contract
   - tools/security-scenario-composer
   - tools/tenancy-posture
+  - tools/posture-feedback
   - tools/security-bootstrap-console
   - local-identity
   target_artifacts: []
@@ -105,7 +107,7 @@ promotion_history: []
 
 `net-kingdom` provides canonical IAM and security architecture, executable
 conformance and posture checks, deterministic plan-only scenario composition,
-a local bootstrap identity package, and a non-secret-collecting security
+proposal-only posture feedback, a local bootstrap identity package, and a non-secret-collecting security
 bootstrap console. Provider implementations remain in sibling repositories such
 as `key-cape`; the self-optimizing platform remains an intent rather than a
 current delivery claim.

registry/indexes/capabilities.yaml

@@ -5,7 +5,7 @@ capabilities:
 - id: capability.security.iam-tooling-suite
   name: NetKingdom Security/IAM Tooling Suite
   summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture
-    validation, and deterministic plan-only security scenario composition.
+    validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.
   vector: D3 / A2 / C1 / R1
   domain: infotech
   status: draft