docs(reuse): wire complete NetKingdom local discovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

docs/NetKingdomSecurityDiscovery.md

@@ -0,0 +1,27 @@
+# NetKingdom security capability discovery
+
+The workstation federation includes 70 reviewed security and supporting capabilities from 60 sibling repositories. Two additional inspected repositories are nonproviders: rapp-secrets-engine is retired and rapp-forgejo is a placeholder without a package declaration. The owner capability entries are the reusable source; the architecture assessment is in the-custodian CUST-WP-0081.
+
+## Local discovery
+
+From a reuse-surface checkout beside those repositories:
+
+```sh
+reuse-surface federation compose
+reuse-surface plan-check --intent "bound approval consumption before credential delivery" --no-llm
+reuse-surface plan-check --intent "deterministic posture feedback evidence expiry" --no-llm
+```
+
+The source manifest uses relative sibling paths for the reviewed cohort and requires their indexes to exist. Other federation sources are preserved. A missing sibling is a composition error rather than silent loss of a reviewed capability. The composed local index supports planning; it is not a runtime readiness or authorization grant. `reuse-surface query` searches this repository's own index, while `plan-check` uses the composed federation.
+
+## Hosted discovery
+
+```sh
+reuse-surface plan-check --hub-url https://reuse.coulomb.social --intent "bound approval consumption" --no-llm
+```
+
+As checked on 2026-10-14, all 60 source registry commits are published, while the hosted hub contains 32 of the 70 reviewed capabilities. Thirty-eight new owner registrations remain pending scoped write access: the normal Warden lane was allowed by the PDP but OpenBao refused the current caller with HTTP 403. Seven of those indexes also require admitted private-source read access; anonymous retrieval returns 404. Do not change repository visibility or reuse another workload's credential to make discovery pass.
+
+The seven private sources are rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-telemetry, rapp-tenant-engine, rapp-user-engine and rapp-sbom-nexus. Hosted registration supports an `auth_env` reference to a credential already configured at the hub. Source-owner approval, scoped read provisioning and a successful native fetch must precede their registration. Thirty-one public-source registrations are otherwise ready.
+
+The exact registration plan, source commits, raw retrieval results and local/hosted verification receipts are retained in the-custodian at `docs/assessments/netkingdom-2026-10-14/`. Existing IDs were preserved where valid; the copied Secrets Engine repository-template entry was removed. Registry C/R values retained from older entries remain owner assessments, not renewed evidence.

registry/federation/sources.yaml

@@ -2,20 +2,26 @@ version: 1
 domain: helix_forge
 collision_policy: warn
 sources:
+- repo: access-engine
+  index: ../access-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: activity-core
-  url: https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../activity-core/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: agentic-resources
-  url: https://forgejo.coulomb.social/coulomb/agentic-resources/raw/main/registry/indexes/capabilities.yaml
+  index: ../agentic-resources/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: approval-engine
+  index: ../approval-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: artifact-store
   url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -24,12 +30,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: audit-core
-  url: https://forgejo.coulomb.social/coulomb/audit-core/raw/main/registry/indexes/capabilities.yaml
+  index: ../audit-core/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: can-you-assist
   url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -58,6 +62,13 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: commerce-canon
+  url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
+  enabled: true
+  required: false
+  domain: helix_forge
+  cache_ttl_seconds: 86400
+  auth_header: Authorization
 - repo: config-atlas
   url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -66,12 +77,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: coordination-engine
-  url: https://forgejo.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
+  index: ../coordination-engine/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: core-hub
   url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -93,6 +102,11 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: emergent-security
+  index: ../emergent-security/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: evidence-anchor
   url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -121,13 +135,21 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: access-engine
-  url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
+- repo: fin-hub
+  index: ../fin-hub/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: gate-house
+  index: ../gate-house/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: glas-harness
+  index: ../glas-harness/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: guide-board
   url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -156,13 +178,6 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: commerce-canon
-  url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
 - repo: ihp-railiance-probe
   url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -171,12 +186,15 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: info-tech-canon
-  url: https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/main/registry/indexes/capabilities.yaml
+  index: ../info-tech-canon/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: informed-decision
+  index: ../informed-decision/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: infospace-bench
   url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -185,12 +203,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: issue-core
-  url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../issue-core/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: kaizen-agentic
   url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -199,12 +215,15 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: key-cape
-  url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../key-cape/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: kings-guard
+  index: ../kings-guard/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: kontextual-engine
   url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -247,13 +266,16 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: net-kingdom
-  url: https://forgejo.coulomb.social/coulomb/net-kingdom/raw/main/registry/indexes/capabilities.yaml
+- repo: maturity-engine
+  index: ../maturity-engine/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: net-kingdom
+  index: ../net-kingdom/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: open-cmis-tck
   url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -269,12 +291,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: ops-bridge
-  url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml
+  index: ../ops-bridge/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: ops-hub
   url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -282,13 +302,16 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: ops-warden
-  url: https://forgejo.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
+- repo: ops-mason
+  index: ../ops-mason/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: ops-warden
+  index: ../ops-warden/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: phase-memory
   url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -296,55 +319,131 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: policy-nexus
+  index: ../policy-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rail-knative
+  index: ../rail-knative/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rail-kubernetes
+  index: ../rail-kubernetes/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: railiance-apps
-  url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-apps/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: railiance-bootstrap
+  index: ../railiance-bootstrap/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: railiance-cluster
-  url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-cluster/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-enablement
-  url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-enablement/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-fabric
-  url: https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/main/registry/indexes/capabilities.yaml
+  index: ../railiance-fabric/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-forge
-  url: https://forgejo.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
+  index: ../railiance-forge/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-infra
-  url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-infra/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: railiance-master
+  index: ../railiance-master/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: railiance-platform
-  url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-platform/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: railiance-telemetry
+  index: ../railiance-telemetry/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-openbao
+  index: ../rapp-openbao/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-playwright
+  index: ../rapp-playwright/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-policy-nexus
+  index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-postgres
+  index: ../rapp-postgres/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-sbom-nexus
+  index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-telemetry
+  index: ../rapp-telemetry/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-tenant-engine
+  index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-user-engine
+  index: ../rapp-user-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: reef-railiance
+  index: ../reef-railiance/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rein-aharness
+  index: ../rein-aharness/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rein-openweights
+  index: ../rein-openweights/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: repo-manager
+  index: ../repo-manager/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: repo-scoping
   url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -359,13 +458,51 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: reuse-surface
-  # Include this checkout's entries in local plan-check before publication.
-  index: registry/indexes/capabilities.yaml
+- repo: resource-control
+  index: ../resource-control/registry/indexes/capabilities.yaml
   enabled: true
   required: true
-  domain: helix_forge
-  description: Capability registry for helix_forge
+  domain: infotech
+- repo: reuse-surface
+  index: ../reuse-surface/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: risk-nexus
+  index: ../risk-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: role-engine
+  index: ../role-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: runbook-tutorials
+  index: ../runbook-tutorials/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: sand-boxer
+  index: ../sand-boxer/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: sbom-nexus
+  index: ../sbom-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: secrets-engine
+  index: ../secrets-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: security-canon
+  index: ../security-canon/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: shard-wiki
   url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -374,12 +511,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: state-hub
-  url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../state-hub/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: tegwick-control
   url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -387,20 +522,21 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: tenant-engine
+  index: ../tenant-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: the-custodian
-  url: https://forgejo.coulomb.social/coulomb/the-custodian/raw/main/registry/indexes/capabilities.yaml
+  index: ../the-custodian/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: user-engine
-  url: https://forgejo.coulomb.social/coulomb/user-engine/raw/main/registry/indexes/capabilities.yaml
+  index: ../user-engine/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: vantage-point
   url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -415,6 +551,11 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: whitehat-security
+  index: ../whitehat-security/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: whynot-control
   url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -429,3 +570,8 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: zone-engine
+  index: ../zone-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech