diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 77077e3..045e186 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-09-06'
+updated: '2026-09-20'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -37,10 +37,6 @@ sources:
   count: 0
   url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/citation-work.yaml
-- repo: commerce-canon
-  count: 2
-  url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/commerce-canon.yaml
 - repo: config-atlas
   count: 1
   url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
@@ -66,7 +62,7 @@ sources:
   url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/evidence-anchor.yaml
 - repo: evidence-binder
-  count: 0
+  count: 2
   url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/evidence-binder.yaml
 - repo: evidence-source
@@ -97,6 +93,10 @@ sources:
   count: 1
   url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/human-resources.yaml
+- repo: commerce-canon
+  count: 2
+  url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
+  cache: registry/federation/cache/commerce-canon.yaml
 - repo: ihp-railiance-probe
   count: 0
   url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
@@ -162,7 +162,7 @@ sources:
   url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/ops-bridge.yaml
 - repo: ops-hub
-  count: 0
+  count: 1
   url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/ops-hub.yaml
 - repo: ops-warden
@@ -589,6 +589,49 @@ capabilities:
   source_repo: whynot-design
   source_url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/whynot-design.yaml
+- id: capability.evidence.binding
+  name: Evidence-to-Target Binding
+  summary: Links evidence items to structured targets with relation, status, and confidence
+    metadata, bidirectional queries, active-state coordination, and canonical engine
+    events.
+  vector: D3 / A2 / C3 / R3
+  domain: infotech
+  status: draft
+  owner: evidence-binder
+  path: registry/capabilities/capability.evidence.binding.md
+  tags:
+  - evidence
+  - binding
+  - evidence-link
+  - form-field
+  - citation-evidence
+  consumption_modes:
+  - source module
+  - React provider
+  source_repo: evidence-binder
+  source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/evidence-binder.yaml
+- id: capability.evidence.rect-registry
+  name: Visual-Guide Rect Registry
+  summary: Coordinates field, evidence-card, and highlight rectangles from independent
+    renderers so an SVG overlay can draw the active visual guide without polling.
+  vector: D3 / A2 / C3 / R3
+  domain: infotech
+  status: draft
+  owner: evidence-binder
+  path: registry/capabilities/capability.evidence.rect-registry.md
+  tags:
+  - rect-registry
+  - visual-guide
+  - overlay
+  - active-state
+  - citation-evidence
+  consumption_modes:
+  - source module
+  - React component
+  source_repo: evidence-binder
+  source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/evidence-binder.yaml
 - id: capability.feature-control.evaluate
   name: Feature Availability Evaluation
   summary: Evaluate whether a feature is active, hidden, disabled, or unavailable
@@ -920,8 +963,8 @@ capabilities:
   source_index: registry/federation/cache/hub-core.yaml
 - id: capability.infotech.issue-tracking
   name: Universal Issue Tracking Coordination
-  summary: Unified Python/CLI interface for issue tracking across Gitea, GitHub, and
-    GitLab, preventing direct platform API usage and credential sprawl for coordinating
+  summary: Unified Python/CLI interface for issue tracking across Forgejo, GitHub,
+    and GitLab, preventing direct platform API usage and credential sprawl for coordinating
     agents.
   vector: D4 / A2 / C2 / R1
   domain: infotech
@@ -1017,6 +1060,26 @@ capabilities:
   source_repo: phase-memory
   source_url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/phase-memory.yaml
+- id: capability.operations.ops-hub
+  name: Operations Hub Extension Contract
+  summary: Versioned hub-extension package and bootstrap client for operational truth,
+    service-catalog records, readiness evidence, and migration gates.
+  vector: D3 / A1 / C1 / R1
+  domain: operations
+  status: reviewed
+  owner: ops-hub
+  path: registry/capabilities/capability.operations.ops-hub.md
+  tags:
+  - operations
+  - service-catalog
+  - readiness
+  - hub-extension
+  consumption_modes:
+  - contract package
+  - command-line bootstrap
+  source_repo: ops-hub
+  source_url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
+  source_index: registry/federation/cache/ops-hub.yaml
 - id: capability.ops.tunnel-bridge
   name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge)
   summary: CLI that manages named SSH reverse tunnels keeping remote execution environments
@@ -1244,10 +1307,9 @@ capabilities:
   source_index: registry/federation/cache/reuse-surface.yaml
 - id: capability.security.iam-tooling-suite
   name: NetKingdom Security/IAM Tooling Suite
-  summary: Dynamic, self-optimizing security platform for Kubernetes-deployed IT infrastructure;
-    owns canonical IAM/security standards and executable conformance tooling (IAM
-    profile conformance, playbook capability contract validation, security bootstrap
-    console).
+  summary: Canonical security architecture and executable reference tooling for IAM,
+    bootstrap, posture validation, deterministic plan-only security scenario composition,
+    and proposal-only posture feedback.
   vector: D3 / A2 / C1 / R1
   domain: infotech
   status: draft
diff --git a/workplans/REUSE-WP-0023-access-engine-source-rename.md b/workplans/REUSE-WP-0023-access-engine-source-rename.md
new file mode 100644
index 0000000..346c3e1
--- /dev/null
+++ b/workplans/REUSE-WP-0023-access-engine-source-rename.md
@@ -0,0 +1,87 @@
+---
+id: REUSE-WP-0023
+type: workplan
+title: "Follow the access-engine repository rename in federation sources"
+domain: infotech
+repo: reuse-surface
+status: active
+flavor: residual
+owner: claude
+origin: residual
+origin_ref: FLEX-WP-0020
+created: "2026-09-20"
+updated: "2026-09-20"
+---
+
+# access-engine source-coordinate handoff
+
+flex-auth is being renamed to access-engine under FLEX-WP-0020. Forge
+repository ID 42 is unchanged and the State Hub repo UUID
+`fda8ad85-a7d7-4055-8f21-902a533e59df` stays. **Runtime names stay
+`flex-auth`** per FLEX-DEC-2026-013 — this is a repository-coordinate rename
+only, not a service or capability rename.
+
+This repository owns the federation-source side: the URL, cache path, and
+roster entry that point at the renamed repository, plus evidence that the
+published capability survives the move unchanged.
+
+This is the same shape as **REUSE-WP-0021** (identity-canon → commerce-canon,
+finished 2026-09-20); reuse that workplan's approach and evidence format.
+
+## Status at registration — 2026-09-20
+
+**The rename has not landed yet.** Probed on 2026-09-20:
+
+- `https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml` → **404**
+- `https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml` → **303** (still resolves)
+
+T01 therefore starts in `wait`. Do not pre-emptively rewrite the source
+coordinates: flipping the URL before the forge rename lands would break an
+enabled, publish-passing source and drop its capability from the composed
+index. Start T01 when `access-engine` serves the raw index.
+
+## Update source coordinates and verify federation
+
+```task
+id: REUSE-WP-0023-T01
+status: wait
+flavor: residual
+priority: medium
+```
+
+Blocked until the forge rename lands (see above).
+
+Update `registry/federation/sources.yaml` and
+`registry/federation/local-repo-roster.yaml` to the canonical access-engine
+URL and path. Refresh that source's cache and recompose
+`registry/indexes/federated.yaml` through the repository's federation tooling.
+
+Preserve the capability identifier published by flex-auth — a repository
+rename alone does not redefine a capability, and runtime names are explicitly
+unchanged by FLEX-DEC-2026-013. Source owner/URL/cache metadata should match
+the newly published access-engine registry.
+
+Verify the capability entry remains discoverable with canonical source links,
+confirm the composed row count does not drop, record commands and results,
+commit, and hand evidence back to FLEX-WP-0020. Leave historical
+workplan/completion provenance intact. No credential, runtime service, or
+capability-semantic migration is authorized by this task.
+
+## Reconcile the hosted hub registration
+
+```task
+id: REUSE-WP-0023-T02
+status: wait
+flavor: residual
+priority: medium
+```
+
+Blocked on T01.
+
+The production hub at `https://reuse.coulomb.social` carries its own repo
+registrations independent of the checked-in manifest. Register the
+access-engine coordinates there and retire the flex-auth registration the same
+way commerce-canon was handled under REUSE-WP-0021: keep the superseded
+registration disabled with a replacement note rather than deleting it, so the
+rename stays auditable. Confirm the hub's composed index serves the capability
+from the canonical URL with no target warnings.