docs(reuse): establish reviewed NetKingdom security capabilities

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

registry/capabilities/capability.registry.validate.md

@@ -1,24 +1,31 @@
 ---
 id: capability.registry.validate
-name: Registry Entry Validation
-summary: Validate capability registry entries against schema, index consistency, and relation integrity.
+name: Capability registry validation
+summary: Schema, index consistency and relation checks.
 owner: reuse-surface
 status: draft
 domain: helix_forge
-tags: [registry, validation, cli]
-
+tags:
+- registry
+- validation
+- cli
+- security
+- netkingdom
+- framework-reuse
 maturity:
   discovery:
     current: D4
     target: D5
     confidence: medium
-    rationale: UC-RS-023 is implemented via reuse-surface validate with schema and drift checks.
+    rationale: UC-RS-023 is implemented via reuse-surface validate with schema and
+      drift checks.
   availability:
     current: A3
     target: A3
     confidence: high
-    rationale: Available as reuse-surface validate CLI command.
-
+    rationale: 'Source interface assessed 2026-10-14: Schema, index consistency and
+      relation checks. Availability describes the delivery form, not production acceptance.
+      Schema validity alone proves neither capability behavior nor hosted freshness.'
 external_evidence:
   completeness:
     level: C3
@@ -26,82 +33,102 @@ external_evidence:
     confidence: medium
     basis: scope_vs_intent_and_consumer_expectations
     satisfied_expectations:
-      - schema validation for entry front matter
-      - index drift detection
-      - optional relation integrity checks
+    - schema validation for entry front matter
+    - index drift detection
+    - optional relation integrity checks
     broken_expectations: []
     out_of_scope_expectations:
-      - runtime validation of registered capability implementations
+    - runtime validation of registered capability implementations
   reliability:
     level: R3
     name: Usable
     confidence: medium
     basis: consumer_quality_signals
     known_reliability_risks:
-      - requires local venv install
-      - relation warnings require explicit --relations flag
+    - requires local venv install
+    - relation warnings require explicit --relations flag
     evidence:
       satisfied_signals:
-        - validate --relations --fail-on-warnings in CI
-        - tests/test_registry.py schema and drift coverage
-
+      - validate --relations --fail-on-warnings in CI
+      - tests/test_registry.py schema and drift coverage
 discovery:
-  intent: Keep registry data structurally sound so agents and humans can trust discovery metadata.
+  intent: Schema, index consistency and relation checks
   includes:
-    - JSON Schema validation
-    - index drift warnings
-    - relation reference checks
+  - Schema, index consistency and relation checks
   excludes:
-    - validating implementation code in other repos
+  - Schema validity alone proves neither capability behavior nor hosted freshness
   use_cases:
-    - UC-RS-023
+  - UC-RS-023
+  - 'U01: Architect composes a security deployment from explicit owner contracts and
+    case types'
+  - 'U14: Framework adopter validates and reuses selected contracts, tools and reference
+    compositions'
   research_memos:
-    - specs/UseCaseCatalog.md
-
+  - specs/UseCaseCatalog.md
 availability:
   current_level: A3
   target_level: A3
   current_artifacts:
-    - reuse_surface/cli.py
-    - schemas/capability.schema.yaml
+  - docs/RegistryFederation.md
+  - schemas/capability.schema.yaml
   consumption_modes:
-    - cli
-
+  - library
+  - CLI
 relations:
   depends_on:
-    - capability.registry.register
+  - capability.registry.register
   supports: []
   related_to:
-    - capability.registry.register
-
+  - capability.registry.register
+  - capability.security.iam-tooling-suite
 evidence:
   documentation:
-    - tools/README.md
-    - .forgejo/workflows/ci.yml
+  - docs/RegistryFederation.md
+  - schemas/capability.schema.yaml
   tests:
-    - tests/test_registry.py
+  - tests/test_registry.py
   consumer_feedback:
-    - >
-        reuse-surface CI: registry changes fail when schema validation or relation
-        checks warn with --fail-on-warnings, giving agents a dependable pre-merge gate.
+  - 'reuse-surface CI: registry changes fail when schema validation or relation checks
+    warn with --fail-on-warnings, giving agents a dependable pre-merge gate.
 
+    '
 consumer_guidance:
   recommended_for:
-    - pre-commit and CI validation of registry changes
+  - Architect composes a security deployment from explicit owner contracts and case
+    types
+  - Framework adopter validates and reuses selected contracts, tools and reference
+    compositions
   not_recommended_for:
-    - certifying business correctness of capability claims
+  - Schema validity alone proves neither capability behavior nor hosted freshness
   known_limitations:
-    - warnings do not fail CI unless --fail-on-warnings is set
-
+  - Schema validity alone proves neither capability behavior nor hosted freshness
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
 promotion_history:
-  - date: "2026-06-16"
-    dimension: reliability
-    from: R2
-    to: R3
-    rationale: CI fail-on-warnings and pytest registry coverage support dependable validation.
-    author: reuse-surface
+- date: '2026-06-16'
+  dimension: reliability
+  from: R2
+  to: R3
+  rationale: CI fail-on-warnings and pytest registry coverage support dependable validation.
+  author: reuse-surface
 ---
 
-# Registry Entry Validation
+# Capability registry validation
 
-Validates registry shape and consistency through the reuse-surface CLI.
+Schema, index consistency and relation checks.
+
+## Reuse boundary
+
+Schema validity alone proves neither capability behavior nor hosted freshness.
+
+## Supported use cases
+
+- U01: Architect composes a security deployment from explicit owner contracts and case types
+- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions
+
+## Evidence and integration
+
+- [docs/RegistryFederation.md](../../docs/RegistryFederation.md)
+- [schemas/capability.schema.yaml](../../schemas/capability.schema.yaml)
+
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.