docs(reuse): establish reviewed NetKingdom security capabilities

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

registry/capabilities/capability.railiance.infra-provisioning.md

@@ -1,9 +1,7 @@
 ---
 id: capability.railiance.infra-provisioning
-name: RailianceHosts Infrastructure Provisioning
+name: Host convergence and security baseline
-summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
+summary: Ansible inventory, firewall, SSH bootstrap and baseline verification.
-  cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
-  of truth.
 owner: railiance-infra
 status: draft
 domain: financials
@@ -12,20 +10,26 @@ tags:
 - terraform
 - ansible
 - infrastructure
+- security
+- netkingdom
+- framework-reuse
 maturity:
   discovery:
     current: D4
     target: D5
     confidence: high
-    rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets
+    rationale: README documents a complete, concrete quickstart (clone, prerequisites,
-      setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`)
+      SOPS/age secrets setup, provider setup, terraform apply, ansible convergence)
-      as source of truth — an unusually complete operational README among the swept repos.
+      with a specific inventory file (`inventory/servers.yaml`) as source of truth
+      — an unusually complete operational README among the swept repos.
   availability:
     current: A2
     target: A3
     confidence: high
-    rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI
+    rationale: 'Source interface assessed 2026-10-14: Ansible inventory, firewall,
-      already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
+      SSH bootstrap and baseline verification. Availability describes the delivery
+      form, not production acceptance. Current hosts differ from the retained Hetzner
+      provisioning path.'
 external_evidence:
   completeness:
     level: C2
@@ -42,41 +46,39 @@ external_evidence:
     confidence: low
     basis: consumer_quality_signals
     known_reliability_risks:
-    - reproducibility not independently re-verified via a live provisioning run in this sweep
+    - reproducibility not independently re-verified via a live provisioning run in
+      this sweep
 discovery:
-  intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle,
+  intent: Ansible inventory, firewall, SSH bootstrap and baseline verification
-    cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance
-    OAS Stack.
   includes:
-  - Terraform server lifecycle management
+  - Ansible inventory, firewall, SSH bootstrap and baseline verification
-  - cloud-init first-boot configuration
-  - Ansible convergence playbooks
-  - SOPS+age encrypted secrets in-repo
   excludes:
-  - Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster)
+  - Current hosts differ from the retained Hetzner provisioning path
-  - platform services (see railiance-platform)
   assumptions: []
-  use_cases: []
+  use_cases:
+  - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
+    connectivity'
+  - 'U10: Operator recovers identity, custody or data with independently held recovery
+    material'
+  - 'U13: Platform owner deploys and rolls back a workload with explicit substrate
+    and custody bindings'
   research_memos: []
 availability:
   current_level: A2
   target_level: A3
   current_artifacts:
-  - Terraform configs
+  - SCOPE.md
-  - Ansible playbooks
-  - scripts/
-  - tools/
   target_artifacts: []
   consumption_modes:
-  - cli (terraform/ansible)
+  - CLI
-  - gitops
+  - source
 relations:
   depends_on: []
   supports: []
-  related_to: []
+  related_to:
+  - capability.security.iam-tooling-suite
 evidence:
   documentation:
-  - README.md
   - SCOPE.md
   tests:
   - sbom-tools.yaml
@@ -86,46 +88,36 @@ evidence:
   incidents: []
 consumer_guidance:
   recommended_for:
-  - operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody
+  - Operator or automation obtains a bounded SSH certificate and maintains private
+    connectivity
+  - Operator recovers identity, custody or data with independently held recovery material
+  - Platform owner deploys and rolls back a workload with explicit substrate and custody
+    bindings
   not_recommended_for:
-  - needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform
+  - Current hosts differ from the retained Hetzner provisioning path
-    for shared services)
   known_limitations:
-  - reproducibility not independently re-verified via a live provisioning run in this sweep
+  - Current hosts differ from the retained Hetzner provisioning path
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
 promotion_history: []
 ---
 
-# RailianceHosts Infrastructure Provisioning
+# Host convergence and security baseline
 
-## Overview
+Ansible inventory, firewall, SSH bootstrap and baseline verification.
 
-`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
+## Reuse boundary
 
-## Assessment notes
+Current hosts differ from the retained Hetzner provisioning path.
 
-### Discovery
+## Supported use cases
 
-README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos.
+- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
+- U10: Operator recovers identity, custody or data with independently held recovery material
+- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings
 
-### Availability
+## Evidence and integration
 
-Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
+- [SCOPE.md](../../SCOPE.md)
 
-### Completeness
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
-
-First-pass honest assessment from the REUSE-WP-0017 coverage campaign
-(reuse-surface). No external consumer feedback exists yet; levels reflect
-scope-vs-intent documentation quality, not internal code quality.
-
-### Reliability
-
-No production consumer telemetry exists yet; reliability level is
-intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
-
-## Promotion checklist
-
-- [x] ID follows `capability.<domain>.<name>` pattern
-- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
-- [x] `external_evidence` is populated separately from `maturity`
-- [ ] Relations reference valid capability IDs (none yet)
-- [x] Index entry added in `registry/indexes/capabilities.yaml`

registry/indexes/capabilities.yaml

@@ -1,22 +1,23 @@
 version: 1
-updated: '2026-07-06'
+updated: '2026-10-14'
 domain: helix_forge
 capabilities:
 - id: capability.railiance.infra-provisioning
-  name: RailianceHosts Infrastructure Provisioning
+  name: Host convergence and security baseline
-  summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
+  summary: Ansible inventory, firewall, SSH bootstrap and baseline verification.
-    cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
-    of truth.
-  vector: D4 / A2 / C2 / R1
   domain: financials
   status: draft
   owner: railiance-infra
-  path: registry/capabilities/capability.railiance.infra-provisioning.md
   tags:
   - railiance
   - terraform
   - ansible
   - infrastructure
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A2 / C2 / R1
+  path: registry/capabilities/capability.railiance.infra-provisioning.md
   consumption_modes:
-  - cli (terraform/ansible)
+  - CLI
-  - gitops
+  - source