diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml
index 4a8cd06..1476bf4 100644
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -145,6 +145,11 @@ sources:
   enabled: true
   required: true
   domain: infotech
+- repo: gated-executor
+  index: ../gated-executor/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: glas-harness
   index: ../glas-harness/registry/indexes/capabilities.yaml
   enabled: true
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 46ee10f..f6222ee 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-10-19'
+updated: '2026-10-21'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -88,6 +88,9 @@ sources:
 - repo: gate-house
   count: 1
   index: ../gate-house/registry/indexes/capabilities.yaml
+- repo: gated-executor
+  count: 1
+  index: ../gated-executor/registry/indexes/capabilities.yaml
 - repo: glas-harness
   count: 1
   index: ../glas-harness/registry/indexes/capabilities.yaml
@@ -2106,6 +2109,27 @@ capabilities:
   - source
   source_repo: net-kingdom
   source_index: ../net-kingdom/registry/indexes/capabilities.yaml
+- id: capability.security.exact-approval-execution
+  name: Exact-approval privileged execution
+  summary: gexec runs a privileged action only under a supervisor signature bound
+    to its digest, agent, target, single-use nonce and expiry; receipts for every
+    outcome.
+  domain: infotech
+  status: draft
+  owner: gated-executor
+  tags:
+  - security
+  - approval
+  - executor
+  - supervised-agents
+  - receipts
+  - ssh-signature
+  vector: D4 / A3 / C3 / R2
+  path: registry/capabilities/capability.security.exact-approval-execution.md
+  consumption_modes:
+  - CLI
+  source_repo: gated-executor
+  source_index: ../gated-executor/registry/indexes/capabilities.yaml
 - id: capability.security.forge-secret-prevention
   name: Independent introduced-history secret prevention
   summary: Pinned receive adapter, lifecycle template and fail-closed scan.