From 181c8f64148db5f18ca9da4eb48cbabe3e0ad229 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Tue, 8 Sep 2026 14:01:49 +0200 Subject: [PATCH 01/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-08: - update .custodian-brief.md for reuse-surface Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- .custodian-brief.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 56f1c78..d77ed59 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,11 +2,17 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-05 23:35 UTC +**Last synced:** 2026-09-08 12:01 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams +### Use current hosted capability discovery in factory planning +Progress: 1/2 done | workplan_id: `9f90448a-b149-5d04-91b5-0bfc163a9ea2` + +**Open tasks:** +- ► Publish and return the consumer receipt `a97e7347` + ### Follow the CommerceCanon repository rename in federation sources Progress: 1/2 done | workplan_id: `0d1beafd-e638-5bb9-b91d-13543ac42a04` From 0350ee53c493113d3bb0d442a924158fbad2fd64 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 8 Sep 2026 14:07:45 +0200 Subject: [PATCH 02/55] Complete hosted discovery delivery and retain explicit factory handoffs Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- workplans/REUSE-WP-0022-hosted-plan-check.md | 22 ++++++++++++++++++-- 1 file changed, 20 insertions(+), 2 deletions(-) diff --git a/workplans/REUSE-WP-0022-hosted-plan-check.md b/workplans/REUSE-WP-0022-hosted-plan-check.md index 205f540..06d038d 100644 --- a/workplans/REUSE-WP-0022-hosted-plan-check.md +++ b/workplans/REUSE-WP-0022-hosted-plan-check.md @@ -4,12 +4,13 @@ type: workplan title: "Use current hosted capability discovery in factory planning" domain: infotech repo: reuse-surface -status: active +status: finished owner: the-custodian topic_slug: helix-forge created: "2026-09-08" updated: "2026-09-08" related: [HFACT-WP-0001, VERGABE-WP-0018] +state_hub_workstream_id: "9f90448a-b149-5d04-91b5-0bfc163a9ea2" --- # Hosted query-before-build @@ -28,6 +29,7 @@ id: REUSE-WP-0022-T01 status: done priority: high assignee: the-custodian +state_hub_task_id: "004ba579-64d0-5b56-9847-b4b02fbf0f7a" ``` Use the existing public GET /v1/federated. Preserve local mode compatibility. @@ -41,10 +43,11 @@ No additional service, model call or mutation credential is necessary. ```task id: REUSE-WP-0022-T02 -status: progress +status: done priority: high assignee: the-custodian depends_on: [REUSE-WP-0022-T01] +state_hub_task_id: "a97e7347-70b1-5ce6-93fa-ff9fb1df2133" ``` Publish the tested implementation through the existing Forgejo review path. @@ -60,3 +63,18 @@ warning). Vergabe-teilnahme invoked the CLI against the real hosted federation: `bfb6b79970867ac981fc48286dea24b2ff766cf732d3675f73ccbddb8971e498`. Consumer receipt: `vergabe-teilnahme/docs/evidence/2026-09-08-hosted-plan-check.json`. This attended implementation does not count as a governed factory run. + +## Completion and handoff + +Integrated on published `main` at `998a5ef3efd42af728fb276594f634f516855daa` +after PR 1 and live CI run 331 passed. Main CI 333 and image publication 334 +passed. Image `main-998a5ef` has digest +`sha256:b510acc6bb1aee0e70709f65e53c61a96336ca837eba6dd75ceaa1f5cbf3d441`. +Vergabe-teilnahme's consumer and build gate are integrated and its image is +published under VERGABE-WP-0018. No production deployment is claimed here. + +Residual integration/operating acceptance remains live in HFACT-WP-0001-T06/T07. +HFACT-WP-0001-T02 also owns disposition of three archived REUSE-WP-0017/0018/0019 +null-ID consistency findings; these are historical projection issues, not failed +checks for REUSE-WP-0022. Forgejo PR 1 metadata still needs the authenticated +`manually-merged` receipt after OpenBao caller login; source is already on main. From 39d22ef22f3a1c0e8b22b71b519afe39f40225bb Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Tue, 8 Sep 2026 14:19:37 +0200 Subject: [PATCH 03/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-08: - update .custodian-brief.md for reuse-surface Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- .custodian-brief.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index d77ed59..de4b333 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,11 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-08 12:01 UTC +**Last synced:** 2026-09-08 12:19 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Use current hosted capability discovery in factory planning -Progress: 1/2 done | workplan_id: `9f90448a-b149-5d04-91b5-0bfc163a9ea2` - -**Open tasks:** -- ► Publish and return the consumer receipt `a97e7347` - ### Follow the CommerceCanon repository rename in federation sources Progress: 1/2 done | workplan_id: `0d1beafd-e638-5bb9-b91d-13543ac42a04` From fc814cd554c882536fbdef9c32bb73ffc1ba8ccc Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 8 Sep 2026 14:21:21 +0200 Subject: [PATCH 04/55] Refresh registered work-record index after hosted capability completion Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc --- WORK-RECORDS.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 4729120..b3731c9 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -21,6 +21,7 @@ | workplan | REUSE-WP-0016 | finished | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | | workplan | REUSE-WP-0020 | finished | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | | workplan | REUSE-WP-0021 | active | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | +| workplan | REUSE-WP-0022 | finished | — | workplans/REUSE-WP-0022-hosted-plan-check.md | | task | REUSE-WP-0001-T01 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | | task | REUSE-WP-0001-T02 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | | task | REUSE-WP-0001-T03 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | @@ -82,3 +83,5 @@ | task | REUSE-WP-0020-T09 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | | task | REUSE-WP-0021-T01 | done | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | | task | REUSE-WP-0021-T02 | wait | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | +| task | REUSE-WP-0022-T01 | done | — | workplans/REUSE-WP-0022-hosted-plan-check.md | +| task | REUSE-WP-0022-T02 | done | — | workplans/REUSE-WP-0022-hosted-plan-check.md | From 07e7e14b5f7a9064457cdd0e2b03b3d6696368e4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 14 Sep 2026 15:50:48 +0200 Subject: [PATCH 05/55] Classify open workplans with flavor (CUST-WP-0072). Set flavor on open workplans from origin/prose/status. Copy existing depends_on aliases only. Do not promote residuals. Assistant: grok Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267 --- workplans/REUSE-WP-0021-commerce-canon-source-rename.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/workplans/REUSE-WP-0021-commerce-canon-source-rename.md b/workplans/REUSE-WP-0021-commerce-canon-source-rename.md index d1511a7..de483c3 100644 --- a/workplans/REUSE-WP-0021-commerce-canon-source-rename.md +++ b/workplans/REUSE-WP-0021-commerce-canon-source-rename.md @@ -5,6 +5,7 @@ title: "Follow the CommerceCanon repository rename in federation sources" domain: infotech repo: reuse-surface status: active +flavor: residual owner: codex origin: residual origin_ref: IDENTITY-WP-0004 @@ -25,6 +26,7 @@ repository's source/refresh evidence. ```task id: REUSE-WP-0021-T01 status: done +flavor: residual priority: medium state_hub_task_id: "b7803b7d-0b70-5aac-8f6a-2704794fccf2" ``` @@ -48,6 +50,7 @@ service, or capability-semantic migration is authorized by this task. ```task id: REUSE-WP-0021-T02 status: wait +flavor: residual priority: low state_hub_task_id: "ceba0cd4-3992-5f16-bdd2-1f054055d10b" ``` From ef1c7e76d860a1fef77e40a14bb62713b8ba3774 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 20 Sep 2026 22:35:05 +0200 Subject: [PATCH 06/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-20: - update .custodian-brief.md for reuse-surface Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- .custodian-brief.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index de4b333..1d2e9e1 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-08 12:19 UTC +**Last synced:** 2026-09-20 20:35 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -13,6 +13,12 @@ Progress: 1/2 done | workplan_id: `0d1beafd-e638-5bb9-b91d-13543ac42a04` **Open tasks:** - ! Repair archived workplan bindings reported during handoff registration `ceba0cd4` +## Inbox Hygiene + +**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 1 unread message(s) lack supersession chains. +- ! flex-auth: FLEX-WP-0020 handoff request (other) `08919217` + --- ## MCP Orientation (when available) From 3e7743d83e2c934eeb57523ce568d2fa43e418aa Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 20 Sep 2026 22:38:23 +0200 Subject: [PATCH 07/55] Restore archived work-record bindings and close REUSE-WP-0021 Rebind REUSE-WP-0017/0018/0019 to their authoritative State Hub records: workplan UUIDs restored into blank frontmatter, task ids rebound to the 2026-07-06 originals (matched by heading and creation order) rather than the 2026-08-28 deterministic duplicates. Bindings upload now syncs 22/22 instead of returning 422; C-03 clears. Closes REUSE-WP-0021-T02 and the workplan. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- ...SE-WP-0021-commerce-canon-source-rename.md | 37 +++++++++++++++++-- ...SE-WP-0017-capability-coverage-campaign.md | 16 ++++---- ...USE-WP-0018-plan-check-consumption-loop.md | 14 +++---- ...P-0019-forgejo-automation-and-telemetry.md | 14 +++---- 4 files changed, 56 insertions(+), 25 deletions(-) diff --git a/workplans/REUSE-WP-0021-commerce-canon-source-rename.md b/workplans/REUSE-WP-0021-commerce-canon-source-rename.md index de483c3..e83320f 100644 --- a/workplans/REUSE-WP-0021-commerce-canon-source-rename.md +++ b/workplans/REUSE-WP-0021-commerce-canon-source-rename.md @@ -4,13 +4,13 @@ type: workplan title: "Follow the CommerceCanon repository rename in federation sources" domain: infotech repo: reuse-surface -status: active +status: finished flavor: residual owner: codex origin: residual origin_ref: IDENTITY-WP-0004 created: "2026-09-05" -updated: "2026-09-06" +updated: "2026-09-20" state_hub_workstream_id: "0d1beafd-e638-5bb9-b91d-13543ac42a04" --- @@ -49,7 +49,7 @@ service, or capability-semantic migration is authorized by this task. ```task id: REUSE-WP-0021-T02 -status: wait +status: done flavor: residual priority: low state_hub_task_id: "ceba0cd4-3992-5f16-bdd2-1f054055d10b" @@ -91,3 +91,34 @@ a stale UUID. Do not manually substitute identifiers or run a derived-identity migration to quiet this audit. T02 must use a reviewed restoration tool that verifies existing primary records and historical source provenance. These archived binding defects do not invalidate the source-coordinate refresh. + +## Binding repair completed — 2026-09-20 + +T02 is done. The restoration used the State Hub's own authoritative records +rather than derived identifiers, so work-record identity and history are intact. + +**Workplan bindings.** The hub already carried correct `backing_relative_path` +and `backing_archived: true` for all three archived workplans, which confirmed +each UUID against its file. The verified existing identities were written back +into the blank frontmatter fields — the same three UUIDs recorded in the +2026-09-06 note above, not newly derived ones. `bindings` upload then returned +`synced 22/22` instead of 422; C-03 cleared at the workplan level. + +**Task bindings.** The file task ids matched neither DB set. The hub holds each +archived task twice: the original records created 2026-07-06 at registration, +and a deterministic UUIDv5 duplicate set created 2026-08-28 by an unrelated +migration. The files were rebound to the **2026-07-06 originals** — the +historical identities — matched one-to-one by section heading and creation +order, with every title aligning exactly. The v5 duplicates were left in place; +removing them is hub-side data repair and is not authorized from this repo. + +**One collateral repair.** An intermediate `fix-consistency` run canceled +REUSE-WP-0019-T06 (`a9f44d45…`) as an orphan while its file binding was still +missing. Once rebound, the task was restored to `done` via +`PATCH /tasks/{id}` — a sanctioned status update reflecting work already +completed in 2026-07. + +`statehub fix-consistency --repo reuse-surface` now reports +**0 automation-error, 0 assessment-fail, PASS (with warnings)**. Remaining +warnings are unrelated: C-24 capability-tag advisories and an unread flex-auth +inbox message (C-28/C-29, FLEX-WP-0020 handoff). diff --git a/workplans/archived/260707-REUSE-WP-0017-capability-coverage-campaign.md b/workplans/archived/260707-REUSE-WP-0017-capability-coverage-campaign.md index 7b4a0d7..4b81e08 100644 --- a/workplans/archived/260707-REUSE-WP-0017-capability-coverage-campaign.md +++ b/workplans/archived/260707-REUSE-WP-0017-capability-coverage-campaign.md @@ -9,7 +9,7 @@ owner: claude-code topic_slug: helix-forge created: "2026-07-06" updated: "2026-07-07" -state_hub_workstream_id: +state_hub_workstream_id: "a2d83504-fcd0-4561-8688-b77a01cb7f06" --- > **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). @@ -76,7 +76,7 @@ and CI. id: REUSE-WP-0017-T01 status: done priority: high -state_hub_task_id: "40236c01-58f0-43a2-a4d6-5bf5bd80bdc7" +state_hub_task_id: "90fe5bf2-7c03-4af5-bc4a-e5d608c7e879" ``` - Add `capability_status: has | none | pending` to roster schema and @@ -93,7 +93,7 @@ state_hub_task_id: "40236c01-58f0-43a2-a4d6-5bf5bd80bdc7" id: REUSE-WP-0017-T02 status: done priority: high -state_hub_task_id: "8f608a69-4bd1-4018-b51d-bb19d0ca887c" +state_hub_task_id: "17ea8783-1344-4d04-8f7f-f93859ae4a20" ``` - For each empty-scaffold repo: read INTENT/SCOPE/README + top-level layout, @@ -110,7 +110,7 @@ state_hub_task_id: "8f608a69-4bd1-4018-b51d-bb19d0ca887c" id: REUSE-WP-0017-T03 status: done priority: medium -state_hub_task_id: "2e0b5b06-b000-45a8-8d8c-31fee5eb6678" +state_hub_task_id: "3465cebf-84f9-4d67-8d8a-cca9771f2f06" ``` For each confirmed `no-capability` repo: @@ -126,7 +126,7 @@ For each confirmed `no-capability` repo: id: REUSE-WP-0017-T04 status: done priority: high -state_hub_task_id: "89a30f80-d0bd-432f-81ae-005fd1ec1356" +state_hub_task_id: "20d67516-331b-46bd-8a90-1170139313c2" ``` **Note:** `establish --discover` requires a running `llm-connect` backend, @@ -194,7 +194,7 @@ Notable calls in this cohort: id: REUSE-WP-0017-T05 status: done priority: high -state_hub_task_id: "efa64aab-dde5-499e-a10b-11ce81ef6941" +state_hub_task_id: "56b68b6f-4dca-4fed-925f-d20783dc40d9" ``` - Bernd reviews drafted entries per cohort (maturity honesty, scope, ids) @@ -215,7 +215,7 @@ refresh. id: REUSE-WP-0017-T06 status: done priority: medium -state_hub_task_id: "e94a792d-9b6d-4a4b-b9a6-6171a52557d2" +state_hub_task_id: "1a04b60a-b982-4b5f-ae20-955bc88d4204" ``` **Diagnosis complete — two separate issues, conflated in the original note:** @@ -259,7 +259,7 @@ config-atlas is now present among the 61 sources at id: REUSE-WP-0017-T07 status: done priority: low -state_hub_task_id: "c8cf18f5-3140-42f1-a065-9aa6f03de1f0" +state_hub_task_id: "24ac37bf-2509-4077-9aa3-c09a599dd644" ``` - `report gaps` shows 0 unclassified scaffolds; record final coverage ratio diff --git a/workplans/archived/260707-REUSE-WP-0018-plan-check-consumption-loop.md b/workplans/archived/260707-REUSE-WP-0018-plan-check-consumption-loop.md index b31de7d..d7e10fb 100644 --- a/workplans/archived/260707-REUSE-WP-0018-plan-check-consumption-loop.md +++ b/workplans/archived/260707-REUSE-WP-0018-plan-check-consumption-loop.md @@ -10,7 +10,7 @@ topic_slug: helix-forge created: "2026-07-06" updated: "2026-07-07" reuse_check: "new — dogfooded 2026-07-07 via reuse-surface plan-check against the full 61-capability federated index; no existing capability covers query-before-build matching" -state_hub_workstream_id: +state_hub_workstream_id: "cd8683ff-6e6c-4f6c-a62f-565bd55113ea" --- > **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). @@ -87,7 +87,7 @@ maturity vector, owning repo, and consumer guidance. id: REUSE-WP-0018-T01 status: done priority: high -state_hub_task_id: "2507e1d0-5c67-491e-a5d1-6ac32a59ed7f" +state_hub_task_id: "c7b3407a-2b9d-46ba-ae9c-7ab12235f0ba" ``` Design doc `specs/PlanCheck.md`: @@ -107,7 +107,7 @@ Design doc `specs/PlanCheck.md`: id: REUSE-WP-0018-T02 status: done priority: high -state_hub_task_id: "33bbe7c8-461b-43e9-9b51-1a10f6413e6a" +state_hub_task_id: "24911d0e-41bc-4c8c-a39a-7dc8ec65d8c6" ``` Implemented in `reuse_surface/plan_check.py` + `plan-check` CLI command: @@ -130,7 +130,7 @@ Implemented in `reuse_surface/plan_check.py` + `plan-check` CLI command: id: REUSE-WP-0018-T03 status: done priority: medium -state_hub_task_id: "cf3f1923-a7b7-4ccc-8b81-6b21ba040835" +state_hub_task_id: "9040505a-238e-4815-ae1a-8c5f8c12afa9" ``` Unblocked 2026-07-07 — `llm-connect` running locally (mock provider, @@ -167,7 +167,7 @@ Unblocked 2026-07-07 — `llm-connect` running locally (mock provider, id: REUSE-WP-0018-T04 status: done priority: medium -state_hub_task_id: "ef94baac-57ed-405c-a9f1-9752683bfc71" +state_hub_task_id: "8249dca7-18ca-4150-9671-ca87e6a5ad88" ``` Implemented in `reuse_surface/statehub_bridge.py` against the live local @@ -195,7 +195,7 @@ State Hub HTTP API (`http://127.0.0.1:8000`, confirmed reachable): id: REUSE-WP-0018-T05 status: done priority: high -state_hub_task_id: "572bd9ed-1e2d-46bc-8ae5-e8b5f8ea03ea" +state_hub_task_id: "c232a669-b263-4978-a8b1-3721b8bfaa68" ``` Gate cleared 2026-07-07: WP-0017 finished, `federated.yaml` composed with @@ -225,7 +225,7 @@ WP-0017 landed. id: REUSE-WP-0018-T06 status: done priority: low -state_hub_task_id: "6c00931f-5ff6-4bde-b04d-9146a999047d" +state_hub_task_id: "ff0a91eb-cc41-487b-b726-8c2f84860399" ``` - `tools/README.md` command reference for `plan-check` and diff --git a/workplans/archived/260707-REUSE-WP-0019-forgejo-automation-and-telemetry.md b/workplans/archived/260707-REUSE-WP-0019-forgejo-automation-and-telemetry.md index e2022a5..e1456fb 100644 --- a/workplans/archived/260707-REUSE-WP-0019-forgejo-automation-and-telemetry.md +++ b/workplans/archived/260707-REUSE-WP-0019-forgejo-automation-and-telemetry.md @@ -10,7 +10,7 @@ topic_slug: helix-forge created: "2026-07-06" updated: "2026-07-08" reuse_check: "new — dogfooded 2026-07-07 via reuse-surface plan-check against the full 61-capability federated index; no existing capability covers Forgejo webhook automation or reuse telemetry" -state_hub_workstream_id: +state_hub_workstream_id: "569be717-34f8-4039-bb26-497685f60159" --- > **Terminology note:** Historical text in this archived workplan may use the legacy term "workstream". The fleet term is **workplan** (`canon/standards/workplan-terminology-fleet_v0.1.md`). @@ -66,7 +66,7 @@ refresh* and moves reliability evidence beyond structural. id: REUSE-WP-0019-T01 status: done priority: high -state_hub_task_id: "337866d5-9952-40b8-a338-8ac16a699be0" +state_hub_task_id: "4a187b56-bff9-4097-abd0-b423e7bf9442" ``` **Inventory findings (2026-07-07):** cross-referenced `sources.yaml` (61 @@ -117,7 +117,7 @@ Implemented: id: REUSE-WP-0019-T02 status: done priority: high -state_hub_task_id: "212352fe-3caf-4999-b5a2-58fa2441ca56" +state_hub_task_id: "691eb32a-6f20-4a2a-b9ff-0ae427b659aa" ``` **Note:** `POST /v1/federated/compose` (token-auth, triggers a real @@ -193,7 +193,7 @@ production ingress template edit outside this workplan's scope. id: REUSE-WP-0019-T03 status: done priority: medium -state_hub_task_id: "a8e0bdc6-0a92-4a87-a7b2-19cf0a46db70" +state_hub_task_id: "aa9e9f80-b878-490c-832e-515d8cbbbb60" ``` **Org-level Forgejo webhook — done by `railiance-apps` (2026-07-07), @@ -271,7 +271,7 @@ whenever a future deploy wants to switch registries. id: REUSE-WP-0019-T04 status: done priority: medium -state_hub_task_id: "88e240d1-0b85-42d8-9d9e-44fb46937894" +state_hub_task_id: "c8e9064e-5c39-4c84-80e9-8b255f8edaec" ``` The shared schema (`schemas/reuse-event.schema.json`) already existed from @@ -314,7 +314,7 @@ Implemented: id: REUSE-WP-0019-T05 status: done priority: medium -state_hub_task_id: "5694b776-f516-47ec-a848-714060dd2261" +state_hub_task_id: "f0282cfa-0a71-4b46-a558-80b51ef04fa7" ``` "Blocked on T04 plus initial event volume" — T04 is done, and the @@ -376,7 +376,7 @@ follow-up rather than rushed in. id: REUSE-WP-0019-T06 status: done priority: low -state_hub_task_id: "b5b4cfaf-16fa-45ce-b1f2-6ad48fb090ab" +state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b" ``` SCOPE.md's "automatic hub refresh" flip was already done incidentally in From 152e88a38e23ca199849784261c252be89fb3feb Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 20 Sep 2026 22:39:10 +0200 Subject: [PATCH 08/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-20: - update .custodian-brief.md for reuse-surface Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- .custodian-brief.md | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 1d2e9e1..0853813 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,16 +2,12 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-20 20:35 UTC +**Last synced:** 2026-09-20 20:39 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Follow the CommerceCanon repository rename in federation sources -Progress: 1/2 done | workplan_id: `0d1beafd-e638-5bb9-b91d-13543ac42a04` - -**Open tasks:** -- ! Repair archived workplan bindings reported during handoff registration `ceba0cd4` +*(none — repo may need first-session setup)* ## Inbox Hygiene From 1df9c19c9626654efc54c4c7772c1d496a68c6c2 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 20 Sep 2026 22:39:35 +0200 Subject: [PATCH 09/55] Archive closed workplans with completion-date prefixes Moves the remaining finished workplans into workplans/archived/. Prefixes use each workplan's own completion date per the convention, not the date the archive sweep ran. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- WORK-RECORDS.md | 4 ++-- .../260615-REUSE-WP-0001-statehub-bootstrap.md} | 0 .../260615-REUSE-WP-0002-mvp-registry-foundation.md} | 0 .../260615-REUSE-WP-0003-intent-scope-gap-closure.md} | 0 .../260615-REUSE-WP-0004-registry-hardening.md} | 0 .../260615-REUSE-WP-0005-registry-federation.md} | 0 .../260615-REUSE-WP-0006-registry-hygiene-and-coverage.md} | 0 .../260615-REUSE-WP-0007-interactive-catalog.md} | 0 .../260615-REUSE-WP-0008-graph-explorer.md} | 0 .../260615-REUSE-WP-0009-cli-hardening.md} | 0 .../260615-REUSE-WP-0010-network-federation.md} | 0 .../260617-REUSE-WP-0016-interactive-registry-maintain.md} | 0 .../260821-REUSE-WP-0020-coulombcore-retirement-cutover.md} | 0 .../260908-REUSE-WP-0022-hosted-plan-check.md} | 0 .../260920-REUSE-WP-0021-commerce-canon-source-rename.md} | 0 15 files changed, 2 insertions(+), 2 deletions(-) rename workplans/{REUSE-WP-0001-statehub-bootstrap.md => archived/260615-REUSE-WP-0001-statehub-bootstrap.md} (100%) rename workplans/{REUSE-WP-0002-mvp-registry-foundation.md => archived/260615-REUSE-WP-0002-mvp-registry-foundation.md} (100%) rename workplans/{REUSE-WP-0003-intent-scope-gap-closure.md => archived/260615-REUSE-WP-0003-intent-scope-gap-closure.md} (100%) rename workplans/{REUSE-WP-0004-registry-hardening.md => archived/260615-REUSE-WP-0004-registry-hardening.md} (100%) rename workplans/{REUSE-WP-0005-registry-federation.md => archived/260615-REUSE-WP-0005-registry-federation.md} (100%) rename workplans/{REUSE-WP-0006-registry-hygiene-and-coverage.md => archived/260615-REUSE-WP-0006-registry-hygiene-and-coverage.md} (100%) rename workplans/{REUSE-WP-0007-interactive-catalog.md => archived/260615-REUSE-WP-0007-interactive-catalog.md} (100%) rename workplans/{REUSE-WP-0008-graph-explorer.md => archived/260615-REUSE-WP-0008-graph-explorer.md} (100%) rename workplans/{REUSE-WP-0009-cli-hardening.md => archived/260615-REUSE-WP-0009-cli-hardening.md} (100%) rename workplans/{REUSE-WP-0010-network-federation.md => archived/260615-REUSE-WP-0010-network-federation.md} (100%) rename workplans/{REUSE-WP-0016-interactive-registry-maintain.md => archived/260617-REUSE-WP-0016-interactive-registry-maintain.md} (100%) rename workplans/{REUSE-WP-0020-coulombcore-retirement-cutover.md => archived/260821-REUSE-WP-0020-coulombcore-retirement-cutover.md} (100%) rename workplans/{REUSE-WP-0022-hosted-plan-check.md => archived/260908-REUSE-WP-0022-hosted-plan-check.md} (100%) rename workplans/{REUSE-WP-0021-commerce-canon-source-rename.md => archived/260920-REUSE-WP-0021-commerce-canon-source-rename.md} (100%) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b3731c9..e1374af 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -20,7 +20,7 @@ | workplan | REUSE-WP-0010 | finished | — | workplans/REUSE-WP-0010-network-federation.md | | workplan | REUSE-WP-0016 | finished | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | | workplan | REUSE-WP-0020 | finished | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| workplan | REUSE-WP-0021 | active | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | +| workplan | REUSE-WP-0021 | finished | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | | workplan | REUSE-WP-0022 | finished | — | workplans/REUSE-WP-0022-hosted-plan-check.md | | task | REUSE-WP-0001-T01 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | | task | REUSE-WP-0001-T02 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | @@ -82,6 +82,6 @@ | task | REUSE-WP-0020-T08 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | | task | REUSE-WP-0020-T09 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | | task | REUSE-WP-0021-T01 | done | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | -| task | REUSE-WP-0021-T02 | wait | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | +| task | REUSE-WP-0021-T02 | done | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | | task | REUSE-WP-0022-T01 | done | — | workplans/REUSE-WP-0022-hosted-plan-check.md | | task | REUSE-WP-0022-T02 | done | — | workplans/REUSE-WP-0022-hosted-plan-check.md | diff --git a/workplans/REUSE-WP-0001-statehub-bootstrap.md b/workplans/archived/260615-REUSE-WP-0001-statehub-bootstrap.md similarity index 100% rename from workplans/REUSE-WP-0001-statehub-bootstrap.md rename to workplans/archived/260615-REUSE-WP-0001-statehub-bootstrap.md diff --git a/workplans/REUSE-WP-0002-mvp-registry-foundation.md b/workplans/archived/260615-REUSE-WP-0002-mvp-registry-foundation.md similarity index 100% rename from workplans/REUSE-WP-0002-mvp-registry-foundation.md rename to workplans/archived/260615-REUSE-WP-0002-mvp-registry-foundation.md diff --git a/workplans/REUSE-WP-0003-intent-scope-gap-closure.md b/workplans/archived/260615-REUSE-WP-0003-intent-scope-gap-closure.md similarity index 100% rename from workplans/REUSE-WP-0003-intent-scope-gap-closure.md rename to workplans/archived/260615-REUSE-WP-0003-intent-scope-gap-closure.md diff --git a/workplans/REUSE-WP-0004-registry-hardening.md b/workplans/archived/260615-REUSE-WP-0004-registry-hardening.md similarity index 100% rename from workplans/REUSE-WP-0004-registry-hardening.md rename to workplans/archived/260615-REUSE-WP-0004-registry-hardening.md diff --git a/workplans/REUSE-WP-0005-registry-federation.md b/workplans/archived/260615-REUSE-WP-0005-registry-federation.md similarity index 100% rename from workplans/REUSE-WP-0005-registry-federation.md rename to workplans/archived/260615-REUSE-WP-0005-registry-federation.md diff --git a/workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md b/workplans/archived/260615-REUSE-WP-0006-registry-hygiene-and-coverage.md similarity index 100% rename from workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md rename to workplans/archived/260615-REUSE-WP-0006-registry-hygiene-and-coverage.md diff --git a/workplans/REUSE-WP-0007-interactive-catalog.md b/workplans/archived/260615-REUSE-WP-0007-interactive-catalog.md similarity index 100% rename from workplans/REUSE-WP-0007-interactive-catalog.md rename to workplans/archived/260615-REUSE-WP-0007-interactive-catalog.md diff --git a/workplans/REUSE-WP-0008-graph-explorer.md b/workplans/archived/260615-REUSE-WP-0008-graph-explorer.md similarity index 100% rename from workplans/REUSE-WP-0008-graph-explorer.md rename to workplans/archived/260615-REUSE-WP-0008-graph-explorer.md diff --git a/workplans/REUSE-WP-0009-cli-hardening.md b/workplans/archived/260615-REUSE-WP-0009-cli-hardening.md similarity index 100% rename from workplans/REUSE-WP-0009-cli-hardening.md rename to workplans/archived/260615-REUSE-WP-0009-cli-hardening.md diff --git a/workplans/REUSE-WP-0010-network-federation.md b/workplans/archived/260615-REUSE-WP-0010-network-federation.md similarity index 100% rename from workplans/REUSE-WP-0010-network-federation.md rename to workplans/archived/260615-REUSE-WP-0010-network-federation.md diff --git a/workplans/REUSE-WP-0016-interactive-registry-maintain.md b/workplans/archived/260617-REUSE-WP-0016-interactive-registry-maintain.md similarity index 100% rename from workplans/REUSE-WP-0016-interactive-registry-maintain.md rename to workplans/archived/260617-REUSE-WP-0016-interactive-registry-maintain.md diff --git a/workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md b/workplans/archived/260821-REUSE-WP-0020-coulombcore-retirement-cutover.md similarity index 100% rename from workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md rename to workplans/archived/260821-REUSE-WP-0020-coulombcore-retirement-cutover.md diff --git a/workplans/REUSE-WP-0022-hosted-plan-check.md b/workplans/archived/260908-REUSE-WP-0022-hosted-plan-check.md similarity index 100% rename from workplans/REUSE-WP-0022-hosted-plan-check.md rename to workplans/archived/260908-REUSE-WP-0022-hosted-plan-check.md diff --git a/workplans/REUSE-WP-0021-commerce-canon-source-rename.md b/workplans/archived/260920-REUSE-WP-0021-commerce-canon-source-rename.md similarity index 100% rename from workplans/REUSE-WP-0021-commerce-canon-source-rename.md rename to workplans/archived/260920-REUSE-WP-0021-commerce-canon-source-rename.md From e05b48f0032e2211ea6ec04e95b739e9b3964f13 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 20 Sep 2026 22:40:47 +0200 Subject: [PATCH 10/55] chore(consistency): regenerate work-record index Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- WORK-RECORDS.md | 77 ------------------------------------------------- 1 file changed, 77 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index e1374af..b105c72 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,80 +8,3 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | REUSE-WP-0001 | finished | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | -| workplan | REUSE-WP-0002 | finished | — | workplans/REUSE-WP-0002-mvp-registry-foundation.md | -| workplan | REUSE-WP-0003 | finished | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| workplan | REUSE-WP-0004 | finished | — | workplans/REUSE-WP-0004-registry-hardening.md | -| workplan | REUSE-WP-0005 | finished | — | workplans/REUSE-WP-0005-registry-federation.md | -| workplan | REUSE-WP-0006 | finished | — | workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md | -| workplan | REUSE-WP-0007 | finished | — | workplans/REUSE-WP-0007-interactive-catalog.md | -| workplan | REUSE-WP-0008 | finished | — | workplans/REUSE-WP-0008-graph-explorer.md | -| workplan | REUSE-WP-0009 | finished | — | workplans/REUSE-WP-0009-cli-hardening.md | -| workplan | REUSE-WP-0010 | finished | — | workplans/REUSE-WP-0010-network-federation.md | -| workplan | REUSE-WP-0016 | finished | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| workplan | REUSE-WP-0020 | finished | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| workplan | REUSE-WP-0021 | finished | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | -| workplan | REUSE-WP-0022 | finished | — | workplans/REUSE-WP-0022-hosted-plan-check.md | -| task | REUSE-WP-0001-T01 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | -| task | REUSE-WP-0001-T02 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | -| task | REUSE-WP-0001-T03 | done | — | workplans/REUSE-WP-0001-statehub-bootstrap.md | -| task | REUSE-WP-0002-T01 | done | — | workplans/REUSE-WP-0002-mvp-registry-foundation.md | -| task | REUSE-WP-0002-T02 | done | — | workplans/REUSE-WP-0002-mvp-registry-foundation.md | -| task | REUSE-WP-0002-T03 | done | — | workplans/REUSE-WP-0002-mvp-registry-foundation.md | -| task | REUSE-WP-0002-T04 | done | — | workplans/REUSE-WP-0002-mvp-registry-foundation.md | -| task | REUSE-WP-0002-T05 | done | — | workplans/REUSE-WP-0002-mvp-registry-foundation.md | -| task | REUSE-WP-0002-T06 | done | — | workplans/REUSE-WP-0002-mvp-registry-foundation.md | -| task | REUSE-WP-0003-T01 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0003-T02 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0003-T03 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0003-T04 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0003-T05 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0003-T06 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0003-T07 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0003-T08 | done | — | workplans/REUSE-WP-0003-intent-scope-gap-closure.md | -| task | REUSE-WP-0004-T01 | done | — | workplans/REUSE-WP-0004-registry-hardening.md | -| task | REUSE-WP-0004-T02 | done | — | workplans/REUSE-WP-0004-registry-hardening.md | -| task | REUSE-WP-0004-T03 | done | — | workplans/REUSE-WP-0004-registry-hardening.md | -| task | REUSE-WP-0004-T04 | done | — | workplans/REUSE-WP-0004-registry-hardening.md | -| task | REUSE-WP-0005-T01 | done | — | workplans/REUSE-WP-0005-registry-federation.md | -| task | REUSE-WP-0005-T02 | done | — | workplans/REUSE-WP-0005-registry-federation.md | -| task | REUSE-WP-0005-T03 | done | — | workplans/REUSE-WP-0005-registry-federation.md | -| task | REUSE-WP-0005-T04 | done | — | workplans/REUSE-WP-0005-registry-federation.md | -| task | REUSE-WP-0005-T05 | done | — | workplans/REUSE-WP-0005-registry-federation.md | -| task | REUSE-WP-0006-T01 | done | — | workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md | -| task | REUSE-WP-0006-T02 | done | — | workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md | -| task | REUSE-WP-0006-T03 | done | — | workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md | -| task | REUSE-WP-0006-T04 | done | — | workplans/REUSE-WP-0006-registry-hygiene-and-coverage.md | -| task | REUSE-WP-0007-T01 | done | — | workplans/REUSE-WP-0007-interactive-catalog.md | -| task | REUSE-WP-0007-T02 | done | — | workplans/REUSE-WP-0007-interactive-catalog.md | -| task | REUSE-WP-0007-T03 | done | — | workplans/REUSE-WP-0007-interactive-catalog.md | -| task | REUSE-WP-0008-T01 | done | — | workplans/REUSE-WP-0008-graph-explorer.md | -| task | REUSE-WP-0008-T02 | done | — | workplans/REUSE-WP-0008-graph-explorer.md | -| task | REUSE-WP-0009-T01 | done | — | workplans/REUSE-WP-0009-cli-hardening.md | -| task | REUSE-WP-0009-T02 | done | — | workplans/REUSE-WP-0009-cli-hardening.md | -| task | REUSE-WP-0009-T03 | done | — | workplans/REUSE-WP-0009-cli-hardening.md | -| task | REUSE-WP-0010-T01 | done | — | workplans/REUSE-WP-0010-network-federation.md | -| task | REUSE-WP-0010-T02 | done | — | workplans/REUSE-WP-0010-network-federation.md | -| task | REUSE-WP-0010-T03 | done | — | workplans/REUSE-WP-0010-network-federation.md | -| task | REUSE-WP-0016-T01 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T02 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T03 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T04 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T05 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T06 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T07 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T08 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0016-T09 | done | — | workplans/REUSE-WP-0016-interactive-registry-maintain.md | -| task | REUSE-WP-0020-T01 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T02 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T03 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T04 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T05 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T06 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T07 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T08 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0020-T09 | done | — | workplans/REUSE-WP-0020-coulombcore-retirement-cutover.md | -| task | REUSE-WP-0021-T01 | done | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | -| task | REUSE-WP-0021-T02 | done | — | workplans/REUSE-WP-0021-commerce-canon-source-rename.md | -| task | REUSE-WP-0022-T01 | done | — | workplans/REUSE-WP-0022-hosted-plan-check.md | -| task | REUSE-WP-0022-T02 | done | — | workplans/REUSE-WP-0022-hosted-plan-check.md | From b4d65d06b9d6c06be77615ec692eeea4575e7379 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 20 Sep 2026 22:58:03 +0200 Subject: [PATCH 11/55] Add REUSE-WP-0023 for the access-engine source rename Residual handoff from FLEX-WP-0020 (flex-auth -> access-engine). Forge ID 42 and the repo UUID are unchanged, and runtime names stay flex-auth per FLEX-DEC-2026-013, so this is a federation-source-coordinate change only. Both tasks start in wait: the forge rename has not landed (access-engine raw index returns 404, flex-auth still resolves), and flipping the URL early would drop an enabled publish-passing source from the composed index. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- registry/indexes/federated.yaml | 88 ++++++++++++++++--- ...USE-WP-0023-access-engine-source-rename.md | 87 ++++++++++++++++++ 2 files changed, 162 insertions(+), 13 deletions(-) create mode 100644 workplans/REUSE-WP-0023-access-engine-source-rename.md diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml index 77077e3..045e186 100644 --- a/registry/indexes/federated.yaml +++ b/registry/indexes/federated.yaml @@ -1,7 +1,7 @@ # Composed federated capability index. Regenerate with: # reuse-surface federation compose version: 1 -updated: '2026-09-06' +updated: '2026-09-20' domain: helix_forge collision_policy: warn sources: @@ -37,10 +37,6 @@ sources: count: 0 url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml cache: registry/federation/cache/citation-work.yaml -- repo: commerce-canon - count: 2 - url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml - cache: registry/federation/cache/commerce-canon.yaml - repo: config-atlas count: 1 url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml @@ -66,7 +62,7 @@ sources: url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml cache: registry/federation/cache/evidence-anchor.yaml - repo: evidence-binder - count: 0 + count: 2 url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml cache: registry/federation/cache/evidence-binder.yaml - repo: evidence-source @@ -97,6 +93,10 @@ sources: count: 1 url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml cache: registry/federation/cache/human-resources.yaml +- repo: commerce-canon + count: 2 + url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml + cache: registry/federation/cache/commerce-canon.yaml - repo: ihp-railiance-probe count: 0 url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml @@ -162,7 +162,7 @@ sources: url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml cache: registry/federation/cache/ops-bridge.yaml - repo: ops-hub - count: 0 + count: 1 url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml cache: registry/federation/cache/ops-hub.yaml - repo: ops-warden @@ -589,6 +589,49 @@ capabilities: source_repo: whynot-design source_url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml source_index: registry/federation/cache/whynot-design.yaml +- id: capability.evidence.binding + name: Evidence-to-Target Binding + summary: Links evidence items to structured targets with relation, status, and confidence + metadata, bidirectional queries, active-state coordination, and canonical engine + events. + vector: D3 / A2 / C3 / R3 + domain: infotech + status: draft + owner: evidence-binder + path: registry/capabilities/capability.evidence.binding.md + tags: + - evidence + - binding + - evidence-link + - form-field + - citation-evidence + consumption_modes: + - source module + - React provider + source_repo: evidence-binder + source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml + source_index: registry/federation/cache/evidence-binder.yaml +- id: capability.evidence.rect-registry + name: Visual-Guide Rect Registry + summary: Coordinates field, evidence-card, and highlight rectangles from independent + renderers so an SVG overlay can draw the active visual guide without polling. + vector: D3 / A2 / C3 / R3 + domain: infotech + status: draft + owner: evidence-binder + path: registry/capabilities/capability.evidence.rect-registry.md + tags: + - rect-registry + - visual-guide + - overlay + - active-state + - citation-evidence + consumption_modes: + - source module + - React component + source_repo: evidence-binder + source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml + source_index: registry/federation/cache/evidence-binder.yaml - id: capability.feature-control.evaluate name: Feature Availability Evaluation summary: Evaluate whether a feature is active, hidden, disabled, or unavailable @@ -920,8 +963,8 @@ capabilities: source_index: registry/federation/cache/hub-core.yaml - id: capability.infotech.issue-tracking name: Universal Issue Tracking Coordination - summary: Unified Python/CLI interface for issue tracking across Gitea, GitHub, and - GitLab, preventing direct platform API usage and credential sprawl for coordinating + summary: Unified Python/CLI interface for issue tracking across Forgejo, GitHub, + and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents. vector: D4 / A2 / C2 / R1 domain: infotech @@ -1017,6 +1060,26 @@ capabilities: source_repo: phase-memory source_url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml source_index: registry/federation/cache/phase-memory.yaml +- id: capability.operations.ops-hub + name: Operations Hub Extension Contract + summary: Versioned hub-extension package and bootstrap client for operational truth, + service-catalog records, readiness evidence, and migration gates. + vector: D3 / A1 / C1 / R1 + domain: operations + status: reviewed + owner: ops-hub + path: registry/capabilities/capability.operations.ops-hub.md + tags: + - operations + - service-catalog + - readiness + - hub-extension + consumption_modes: + - contract package + - command-line bootstrap + source_repo: ops-hub + source_url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml + source_index: registry/federation/cache/ops-hub.yaml - id: capability.ops.tunnel-bridge name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge) summary: CLI that manages named SSH reverse tunnels keeping remote execution environments @@ -1244,10 +1307,9 @@ capabilities: source_index: registry/federation/cache/reuse-surface.yaml - id: capability.security.iam-tooling-suite name: NetKingdom Security/IAM Tooling Suite - summary: Dynamic, self-optimizing security platform for Kubernetes-deployed IT infrastructure; - owns canonical IAM/security standards and executable conformance tooling (IAM - profile conformance, playbook capability contract validation, security bootstrap - console). + summary: Canonical security architecture and executable reference tooling for IAM, + bootstrap, posture validation, deterministic plan-only security scenario composition, + and proposal-only posture feedback. vector: D3 / A2 / C1 / R1 domain: infotech status: draft diff --git a/workplans/REUSE-WP-0023-access-engine-source-rename.md b/workplans/REUSE-WP-0023-access-engine-source-rename.md new file mode 100644 index 0000000..346c3e1 --- /dev/null +++ b/workplans/REUSE-WP-0023-access-engine-source-rename.md @@ -0,0 +1,87 @@ +--- +id: REUSE-WP-0023 +type: workplan +title: "Follow the access-engine repository rename in federation sources" +domain: infotech +repo: reuse-surface +status: active +flavor: residual +owner: claude +origin: residual +origin_ref: FLEX-WP-0020 +created: "2026-09-20" +updated: "2026-09-20" +--- + +# access-engine source-coordinate handoff + +flex-auth is being renamed to access-engine under FLEX-WP-0020. Forge +repository ID 42 is unchanged and the State Hub repo UUID +`fda8ad85-a7d7-4055-8f21-902a533e59df` stays. **Runtime names stay +`flex-auth`** per FLEX-DEC-2026-013 — this is a repository-coordinate rename +only, not a service or capability rename. + +This repository owns the federation-source side: the URL, cache path, and +roster entry that point at the renamed repository, plus evidence that the +published capability survives the move unchanged. + +This is the same shape as **REUSE-WP-0021** (identity-canon → commerce-canon, +finished 2026-09-20); reuse that workplan's approach and evidence format. + +## Status at registration — 2026-09-20 + +**The rename has not landed yet.** Probed on 2026-09-20: + +- `https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml` → **404** +- `https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml` → **303** (still resolves) + +T01 therefore starts in `wait`. Do not pre-emptively rewrite the source +coordinates: flipping the URL before the forge rename lands would break an +enabled, publish-passing source and drop its capability from the composed +index. Start T01 when `access-engine` serves the raw index. + +## Update source coordinates and verify federation + +```task +id: REUSE-WP-0023-T01 +status: wait +flavor: residual +priority: medium +``` + +Blocked until the forge rename lands (see above). + +Update `registry/federation/sources.yaml` and +`registry/federation/local-repo-roster.yaml` to the canonical access-engine +URL and path. Refresh that source's cache and recompose +`registry/indexes/federated.yaml` through the repository's federation tooling. + +Preserve the capability identifier published by flex-auth — a repository +rename alone does not redefine a capability, and runtime names are explicitly +unchanged by FLEX-DEC-2026-013. Source owner/URL/cache metadata should match +the newly published access-engine registry. + +Verify the capability entry remains discoverable with canonical source links, +confirm the composed row count does not drop, record commands and results, +commit, and hand evidence back to FLEX-WP-0020. Leave historical +workplan/completion provenance intact. No credential, runtime service, or +capability-semantic migration is authorized by this task. + +## Reconcile the hosted hub registration + +```task +id: REUSE-WP-0023-T02 +status: wait +flavor: residual +priority: medium +``` + +Blocked on T01. + +The production hub at `https://reuse.coulomb.social` carries its own repo +registrations independent of the checked-in manifest. Register the +access-engine coordinates there and retire the flex-auth registration the same +way commerce-canon was handled under REUSE-WP-0021: keep the superseded +registration disabled with a replacement note rather than deleting it, so the +rename stays auditable. Confirm the hub's composed index serves the capability +from the canonical URL with no target warnings. From 937763f210b68091af6389930bc5216ef590d548 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 20 Sep 2026 22:59:18 +0200 Subject: [PATCH 12/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-20: - update .custodian-brief.md for reuse-surface Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- .custodian-brief.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 0853813..3628f83 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,12 +2,17 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-20 20:39 UTC +**Last synced:** 2026-09-20 20:59 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -*(none — repo may need first-session setup)* +### Follow the access-engine repository rename in federation sources +Progress: 0/2 done | workplan_id: `65c03b24-4349-5a60-b7d6-79cf54931d06` + +**Open tasks:** +- ! Update source coordinates and verify federation `d97094d4` +- ! Reconcile the hosted hub registration `77b1eb56` ## Inbox Hygiene From 9f375af0eafe73a4c58b9d462330fc771c73b216 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Sun, 20 Sep 2026 23:01:30 +0200 Subject: [PATCH 13/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-20: - update .custodian-brief.md for reuse-surface Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- .custodian-brief.md | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 3628f83..ac2dc4b 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-20 20:59 UTC +**Last synced:** 2026-09-20 21:01 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -14,12 +14,6 @@ Progress: 0/2 done | workplan_id: `65c03b24-4349-5a60-b7d6-79cf54931d06` - ! Update source coordinates and verify federation `d97094d4` - ! Reconcile the hosted hub registration `77b1eb56` -## Inbox Hygiene - -**Stale unread:** 1 message(s) older than 3 day(s) — triage at session start. -**Missing thread_id:** 1 unread message(s) lack supersession chains. -- ! flex-auth: FLEX-WP-0020 handoff request (other) `08919217` - --- ## MCP Orientation (when available) From 2b866db2b493caee3a42211dafe6205e42519e10 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 20 Sep 2026 23:01:40 +0200 Subject: [PATCH 14/55] chore(consistency): write back REUSE-WP-0023 hub ids Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 4609@bnt-lap001 Assistant-Session: 085df492-f02a-4fe6-acad-2aa52789fe1b --- WORK-RECORDS.md | 3 +++ workplans/REUSE-WP-0023-access-engine-source-rename.md | 3 +++ 2 files changed, 6 insertions(+) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index b105c72..4d9c68a 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,3 +8,6 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | +| workplan | REUSE-WP-0023 | active | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | +| task | REUSE-WP-0023-T01 | wait | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | +| task | REUSE-WP-0023-T02 | wait | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | diff --git a/workplans/REUSE-WP-0023-access-engine-source-rename.md b/workplans/REUSE-WP-0023-access-engine-source-rename.md index 346c3e1..2a06b21 100644 --- a/workplans/REUSE-WP-0023-access-engine-source-rename.md +++ b/workplans/REUSE-WP-0023-access-engine-source-rename.md @@ -11,6 +11,7 @@ origin: residual origin_ref: FLEX-WP-0020 created: "2026-09-20" updated: "2026-09-20" +state_hub_workstream_id: "65c03b24-4349-5a60-b7d6-79cf54931d06" --- # access-engine source-coordinate handoff @@ -47,6 +48,7 @@ id: REUSE-WP-0023-T01 status: wait flavor: residual priority: medium +state_hub_task_id: "d97094d4-4cad-5b35-aa88-eb952215937a" ``` Blocked until the forge rename lands (see above). @@ -74,6 +76,7 @@ id: REUSE-WP-0023-T02 status: wait flavor: residual priority: medium +state_hub_task_id: "77b1eb56-bbf6-5454-892f-bf60e32b864a" ``` Blocked on T01. From 5594cfd6bd789c1a87a7165c082addbe53783410 Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 28 Sep 2026 10:38:16 +0200 Subject: [PATCH 15/55] docs: record rename blocker after loose-end review Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e727-aa41-7f30-9e9e-6a29dc61d998 --- WORK-RECORDS.md | 2 +- ...USE-WP-0023-access-engine-source-rename.md | 27 +++++++++++++++++-- 2 files changed, 26 insertions(+), 3 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 4d9c68a..40f86ad 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,6 +8,6 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | REUSE-WP-0023 | active | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | +| workplan | REUSE-WP-0023 | blocked | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | | task | REUSE-WP-0023-T01 | wait | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | | task | REUSE-WP-0023-T02 | wait | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | diff --git a/workplans/REUSE-WP-0023-access-engine-source-rename.md b/workplans/REUSE-WP-0023-access-engine-source-rename.md index 2a06b21..fc9e9d2 100644 --- a/workplans/REUSE-WP-0023-access-engine-source-rename.md +++ b/workplans/REUSE-WP-0023-access-engine-source-rename.md @@ -4,13 +4,13 @@ type: workplan title: "Follow the access-engine repository rename in federation sources" domain: infotech repo: reuse-surface -status: active +status: blocked flavor: residual owner: claude origin: residual origin_ref: FLEX-WP-0020 created: "2026-09-20" -updated: "2026-09-20" +updated: "2026-09-28" state_hub_workstream_id: "65c03b24-4349-5a60-b7d6-79cf54931d06" --- @@ -88,3 +88,26 @@ way commerce-canon was handled under REUSE-WP-0021: keep the superseded registration disabled with a replacement note rather than deleting it, so the rename stays auditable. Confirm the hub's composed index serves the capability from the canonical URL with no target warnings. + +## Loose-end review — 2026-09-28 + +Reviewed all 23 repository workplans, including archived files. The 22 closed +workplans have no unfinished task blocks; T01 and T02 here are the only open +tasks. Neither can complete before the upstream FLEX-WP-0020 rename lands. +This workplan is now `blocked`, with both tasks remaining `wait`; no new tasks +or workplans were opened. + +Fresh read-only probes used `curl -sS -L -o -w '%{http_code}'` +against the raw capability-index URLs listed above: + +- `access-engine/raw/main/registry/indexes/capabilities.yaml`: HTTP **404**. +- `flex-auth/raw/main/registry/indexes/capabilities.yaml`: HTTP **200** after + following redirects. + +The 2026-09-20 flex-auth inbox handoff also confirms T01 must follow +FLEX-WP-0020-T06, with the upstream owner responsible for announcing that the +new raw index is available. The checked-in source and local roster still use +`flex-auth`, correctly preserving the working source until that prerequisite +is met. T02 remains blocked on T01; the hosted registration must follow the +verified source migration. Resume these existing tasks when the canonical +access-engine raw index is available and validates successfully. From 71abb3cb896b9ffcb76d872378bde632c74c5a56 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 30 Sep 2026 18:53:02 +0200 Subject: [PATCH 16/55] REUSE-WP-0023-T01: federation source -> access-engine; T02 needs operator Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 101414@bnt-lap001 Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6 --- registry/federation/local-repo-roster.yaml | 4 ++-- registry/federation/sources.yaml | 4 ++-- registry/indexes/federated.yaml | 14 +++++++------- .../REUSE-WP-0023-access-engine-source-rename.md | 15 ++++++++++++++- 4 files changed, 25 insertions(+), 12 deletions(-) diff --git a/registry/federation/local-repo-roster.yaml b/registry/federation/local-repo-roster.yaml index 75d8ab1..d202475 100644 --- a/registry/federation/local-repo-roster.yaml +++ b/registry/federation/local-repo-roster.yaml @@ -206,8 +206,8 @@ repos: hub_registered: true publish_check: pass batch: null -- slug: flex-auth - path: /home/worsch/flex-auth +- slug: access-engine + path: /home/worsch/access-engine status: established capability_count: 1 capability_status: has diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml index dca17c1..045eace 100644 --- a/registry/federation/sources.yaml +++ b/registry/federation/sources.yaml @@ -121,8 +121,8 @@ sources: domain: helix_forge cache_ttl_seconds: 86400 auth_header: Authorization -- repo: flex-auth - url: https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml +- repo: access-engine + url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml enabled: true required: false domain: helix_forge diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml index 045e186..8aa4b52 100644 --- a/registry/indexes/federated.yaml +++ b/registry/indexes/federated.yaml @@ -1,7 +1,7 @@ # Composed federated capability index. Regenerate with: # reuse-surface federation compose version: 1 -updated: '2026-09-20' +updated: '2026-09-30' domain: helix_forge collision_policy: warn sources: @@ -73,10 +73,10 @@ sources: count: 3 url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml cache: registry/federation/cache/feature-control.yaml -- repo: flex-auth +- repo: access-engine count: 1 - url: https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml - cache: registry/federation/cache/flex-auth.yaml + url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml + cache: registry/federation/cache/access-engine.yaml - repo: guide-board count: 1 url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml @@ -408,9 +408,9 @@ capabilities: - flex-auth consumption_modes: - source module - source_repo: flex-auth - source_url: https://forgejo.coulomb.social/coulomb/flex-auth/raw/main/registry/indexes/capabilities.yaml - source_index: registry/federation/cache/flex-auth.yaml + source_repo: access-engine + source_url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml + source_index: registry/federation/cache/access-engine.yaml - id: capability.cmis.tck name: OpenCMIS Conformance-Preparation Extension summary: CMIS conformance-preparation extension for guide-board, keeping CMIS-specific diff --git a/workplans/REUSE-WP-0023-access-engine-source-rename.md b/workplans/REUSE-WP-0023-access-engine-source-rename.md index fc9e9d2..5000365 100644 --- a/workplans/REUSE-WP-0023-access-engine-source-rename.md +++ b/workplans/REUSE-WP-0023-access-engine-source-rename.md @@ -45,7 +45,7 @@ index. Start T01 when `access-engine` serves the raw index. ```task id: REUSE-WP-0023-T01 -status: wait +status: done flavor: residual priority: medium state_hub_task_id: "d97094d4-4cad-5b35-aa88-eb952215937a" @@ -74,6 +74,8 @@ capability-semantic migration is authorized by this task. ```task id: REUSE-WP-0023-T02 status: wait +needs_human: true +blocking_reason: "Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step." flavor: residual priority: medium state_hub_task_id: "77b1eb56-bbf6-5454-892f-bf60e32b864a" @@ -111,3 +113,14 @@ new raw index is available. The checked-in source and local roster still use is met. T02 remains blocked on T01; the hosted registration must follow the verified source migration. Resume these existing tasks when the canonical access-engine raw index is available and validates successfully. + +## T01 evidence — 2026-09-30 + +FLEX-WP-0020 rename landed (access-engine, head b943d9a). Probe: +`/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml` returns 303 then 200. +Changed `registry/federation/sources.yaml` (repo + URL) and +`local-repo-roster.yaml` (slug + path ~/access-engine). Ran +`reuse-surface federation compose --refresh`: 65 capabilities before and after; +only `source_repo`/`source_url`/`source_index` of the one entry changed, capability +identifier preserved. `reuse-surface validate` ok. Old `cache/flex-auth*` files are +ignored cache and were left. T02 (hosted hub) handed to an operator. From 28c299528850f8a2029630028917856c9106ea01 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Wed, 30 Sep 2026 18:55:22 +0200 Subject: [PATCH 17/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-30: - update .custodian-brief.md for reuse-surface Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 101414@bnt-lap001 Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6 --- .custodian-brief.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index ac2dc4b..376fde7 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,17 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-20 21:01 UTC +**Last synced:** 2026-09-30 16:54 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams ### Follow the access-engine repository rename in federation sources -Progress: 0/2 done | workplan_id: `65c03b24-4349-5a60-b7d6-79cf54931d06` +Progress: 1/2 done | workplan_id: `65c03b24-4349-5a60-b7d6-79cf54931d06` **Open tasks:** -- ! Update source coordinates and verify federation `d97094d4` - ! Reconcile the hosted hub registration `77b1eb56` + *(wait: Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step.)* --- ## MCP Orientation (when available) From 4cf8869d1e0ff883f53188525635bfdd678a31ea Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Wed, 30 Sep 2026 19:10:23 +0200 Subject: [PATCH 18/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-30: - update .custodian-brief.md for reuse-surface Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 101414@bnt-lap001 Assistant-Session: 60b5a221-d435-42b9-b778-983c90c7eed6 --- .custodian-brief.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 376fde7..239e1c4 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-30 16:54 UTC +**Last synced:** 2026-09-30 17:10 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -14,6 +14,10 @@ Progress: 1/2 done | workplan_id: `65c03b24-4349-5a60-b7d6-79cf54931d06` - ! Reconcile the hosted hub registration `77b1eb56` *(wait: Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step.)* +## Inbox Hygiene + +**Missing thread_id:** 1 unread message(s) lack supersession chains. + --- ## MCP Orientation (when available) From a07db530f59ebfdcce9cc05e2f05ec7027248f50 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 30 Sep 2026 20:11:32 +0200 Subject: [PATCH 19/55] chore: sync WORK-RECORDS REUSE-WP-0023-T01 done Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 264646@bnt-lap001 Assistant-Session: 997dba59-88a4-4920-8b8d-9daca684fbb9 --- WORK-RECORDS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 40f86ad..1e6905e 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -9,5 +9,5 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | | workplan | REUSE-WP-0023 | blocked | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | -| task | REUSE-WP-0023-T01 | wait | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | +| task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | | task | REUSE-WP-0023-T02 | wait | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | From 65a7e323ab8056ff8f6e89bed65ac83883a44340 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 30 Sep 2026 20:31:46 +0200 Subject: [PATCH 20/55] REUSE-WP-0023-T02: hosted hub registration reconciled; workplan finished Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 264646@bnt-lap001 Assistant-Session: 997dba59-88a4-4920-8b8d-9daca684fbb9 --- ...USE-WP-0023-access-engine-source-rename.md | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/workplans/REUSE-WP-0023-access-engine-source-rename.md b/workplans/REUSE-WP-0023-access-engine-source-rename.md index 5000365..4351dbd 100644 --- a/workplans/REUSE-WP-0023-access-engine-source-rename.md +++ b/workplans/REUSE-WP-0023-access-engine-source-rename.md @@ -4,13 +4,13 @@ type: workplan title: "Follow the access-engine repository rename in federation sources" domain: infotech repo: reuse-surface -status: blocked +status: finished flavor: residual owner: claude origin: residual origin_ref: FLEX-WP-0020 created: "2026-09-20" -updated: "2026-09-28" +updated: "2026-09-30" state_hub_workstream_id: "65c03b24-4349-5a60-b7d6-79cf54931d06" --- @@ -73,9 +73,7 @@ capability-semantic migration is authorized by this task. ```task id: REUSE-WP-0023-T02 -status: wait -needs_human: true -blocking_reason: "Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step." +status: done flavor: residual priority: medium state_hub_task_id: "77b1eb56-bbf6-5454-892f-bf60e32b864a" @@ -124,3 +122,19 @@ Changed `registry/federation/sources.yaml` (repo + URL) and only `source_repo`/`source_url`/`source_index` of the one entry changed, capability identifier preserved. `reuse-surface validate` ok. Old `cache/flex-auth*` files are ignored cache and were left. T02 (hosted hub) handed to an operator. + +## T02 evidence — 2026-09-30 + +Operator ran, with their own OpenBao login (`bao kv get -field=REUSE_SURFACE_TOKEN +platform/workloads/reuse/reuse-surface/runtime-secrets`): `hub register --repo +access-engine --domain helix_forge --url ` (ok) and +`hub update --repo flex-auth --no-enabled --description "Superseded by +access-engine ..."` (ok). The `warden access --exec` lane was refused by design +(WARDEN-WP-0039: resource.system=railiance-platform vs. ops-warden binding; no +delegated-read contract yet) — not rename breakage; the owner-native `bao` read +is the working route. + +Verified read-only against `https://reuse.coulomb.social`: `/v1/repos` shows +access-engine enabled and flex-auth disabled with the replacement note; +`/v1/federated` serves `capability.authorization.policy-evaluate` from the +access-engine URL, 65 capabilities (unchanged), `stale: false`. From d489cac83d2386bd3963a4fef8bddde737372bc2 Mon Sep 17 00:00:00 2001 From: custodian-sync Date: Wed, 30 Sep 2026 20:32:18 +0200 Subject: [PATCH 21/55] chore(consistency): sync task status from DB [auto] Updated by fix-consistency on 2026-09-30: - update .custodian-brief.md for reuse-surface Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 264646@bnt-lap001 Assistant-Session: 997dba59-88a4-4920-8b8d-9daca684fbb9 --- .custodian-brief.md | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.custodian-brief.md b/.custodian-brief.md index 239e1c4..c8d175c 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,17 +2,12 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-30 17:10 UTC +**Last synced:** 2026-09-30 18:32 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams -### Follow the access-engine repository rename in federation sources -Progress: 1/2 done | workplan_id: `65c03b24-4349-5a60-b7d6-79cf54931d06` - -**Open tasks:** -- ! Reconcile the hosted hub registration `77b1eb56` - *(wait: Production hub reuse.coulomb.social registration change (enable access-engine, disable flex-auth with replacement note) is an authenticated production write; needs an operator-run step.)* +*(none — repo may need first-session setup)* ## Inbox Hygiene From 309432778b8470a5a65d413337f13e7a9434b953 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 30 Sep 2026 20:32:25 +0200 Subject: [PATCH 22/55] chore: sync WORK-RECORDS after REUSE-WP-0023 finish Co-Authored-By: Claude Sonnet 5.5 Assistant: claude-code Assistant-Model: sonnet Assistant-Process: 264646@bnt-lap001 Assistant-Session: 997dba59-88a4-4920-8b8d-9daca684fbb9 --- WORK-RECORDS.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 1e6905e..996ba96 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,6 +8,6 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | -| workplan | REUSE-WP-0023 | blocked | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | +| workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | | task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | -| task | REUSE-WP-0023-T02 | wait | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | +| task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | From 64e167433d584e549cacd38923d884876d3742a6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 13:56:33 +0200 Subject: [PATCH 23/55] Register headless browser reuse guidance and consumer examples Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a13502-3de4-7af3-a6ae-3ef26de4adec --- .custodian-brief.md | 5 +- WORK-RECORDS.md | 2 + docs/CapabilityCatalog.md | 19 +- docs/catalog/index.html | 9 +- docs/catalog/registry.json | 32 ++- docs/graph/capability-graph.mmd | 1 + docs/graph/index.html | 2 +- registry/README.md | 13 +- .../capability.infotech.headless-browser.md | 182 ++++++++++++++++++ registry/federation/sources.yaml | 7 +- registry/indexes/capabilities.yaml | 18 +- registry/indexes/federated.yaml | 43 ++++- workplans/ADHOC-2026-10-13.md | 54 ++++++ 13 files changed, 365 insertions(+), 22 deletions(-) create mode 100644 registry/capabilities/capability.infotech.headless-browser.md create mode 100644 workplans/ADHOC-2026-10-13.md diff --git a/.custodian-brief.md b/.custodian-brief.md index c8d175c..6a1b056 100644 --- a/.custodian-brief.md +++ b/.custodian-brief.md @@ -2,7 +2,7 @@ # Custodian Brief — reuse-surface **Domain:** infotech -**Last synced:** 2026-09-30 18:32 UTC +**Last synced:** 2026-10-13 11:35 UTC **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)* ## Active Workstreams @@ -11,7 +11,8 @@ ## Inbox Hygiene -**Missing thread_id:** 1 unread message(s) lack supersession chains. +**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start. +**Missing thread_id:** 2 unread message(s) lack supersession chains. --- ## MCP Orientation (when available) diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 996ba96..bcccc6d 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -8,6 +8,8 @@ | Kind | ID | Status | Lane | Source | | --- | --- | --- | --- | --- | +| workplan | ADHOC-2026-10-13 | finished | — | workplans/ADHOC-2026-10-13.md | | workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | +| task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md | | task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | | task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md | diff --git a/docs/CapabilityCatalog.md b/docs/CapabilityCatalog.md index 2715743..0927d54 100644 --- a/docs/CapabilityCatalog.md +++ b/docs/CapabilityCatalog.md @@ -1,8 +1,8 @@ # Capability Catalog **Domain:** helix_forge -**Updated:** 2026-06-16 -**Entries:** 2 +**Updated:** 2026-10-13 +**Entries:** 3 Generated by `reuse-surface catalog`. Do not edit manually. @@ -30,3 +30,18 @@ Generated by `reuse-surface catalog`. Do not edit manually. **Known limitations:** - warnings do not fail CI unless --fail-on-warnings is set + +## infotech + +### Headless Browser Automation + +- **ID:** `capability.infotech.headless-browser` +- **Vector:** D3 / A2 / C2 / R2 +- **Owner:** reuse-surface +- **Path:** `registry/capabilities/capability.infotech.headless-browser.md` +- **Summary:** Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations. + +**Known limitations:** +- This is a dated source inspection; run the target-repo trial before claiming adoption success. +- Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection. +- Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here. diff --git a/docs/catalog/index.html b/docs/catalog/index.html index a7fe460..1e87c05 100644 --- a/docs/catalog/index.html +++ b/docs/catalog/index.html @@ -15,7 +15,7 @@

Capability Catalog

-

Updated 2026-06-16 · 2 entries

+

Updated 2026-10-13 · 3 entries

helix_forge

Capability Registration

@@ -29,5 +29,12 @@

Validate capability registry entries against schema, index consistency, and relation integrity.

registry/capabilities/capability.registry.validate.md

+

infotech

+
+

Headless Browser Automation

+

capability.infotech.headless-browser · D3 / A2 / C2 / R2

+

Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations.

+

registry/capabilities/capability.infotech.headless-browser.md

+
diff --git a/docs/catalog/registry.json b/docs/catalog/registry.json index be4ab35..457e86d 100644 --- a/docs/catalog/registry.json +++ b/docs/catalog/registry.json @@ -1,7 +1,37 @@ { "domain": "helix_forge", - "updated": "2026-06-16", + "updated": "2026-10-13", "capabilities": [ + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations.", + "vector": "D3 / A2 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library" + ] + }, { "id": "capability.registry.register", "name": "Capability Registration", diff --git a/docs/graph/capability-graph.mmd b/docs/graph/capability-graph.mmd index 1f2f92f..907f454 100644 --- a/docs/graph/capability-graph.mmd +++ b/docs/graph/capability-graph.mmd @@ -1,4 +1,5 @@ graph LR + capability_infotech_headless_browser["capability.infotech.headless-browser
D3 / A2 / C2 / R2"] capability_registry_register["capability.registry.register
D3 / A4 / C2 / R3"] capability_registry_validate["capability.registry.validate
D4 / A3 / C3 / R3"] capability_registry_register -->|supports| capability_feature_control_evaluate diff --git a/docs/graph/index.html b/docs/graph/index.html index 1b47bfd..fbf84b7 100644 --- a/docs/graph/index.html +++ b/docs/graph/index.html @@ -17,7 +17,7 @@

Generated from entry relations fields. Regenerate with reuse-surface graph.


   
 
 
diff --git a/registry/README.md b/registry/README.md
index 0e4dd4b..48b1976 100644
--- a/registry/README.md
+++ b/registry/README.md
@@ -114,6 +114,17 @@ Definitions live in `specs/CapabilityMaturityStandard.md`.
 
 ## Search and filter guidance
 
+For a headless browser trial, run `python3 -m reuse_surface.cli query --keyword browser`
+from this repository root and read
+[Headless Browser Automation](capabilities/capability.infotech.headless-browser.md).
+It records implemented consumers, the scoped Playwright/Chromium recommendation,
+and a practical trial procedure. Local federation reads this checkout's own index
+directly, so `federation compose` includes unpublished local entries. Other sources
+remain remote; the hosted hub still requires publication before it sees new entries.
+For this trial use the keyword query: the deterministic `plan-check` includes the
+browser entry but still returns `new` for the short intent `headless browser` due
+to its token-overlap thresholds and maturity tie-breaking.
+
 ### UC-RS-004 — Search by planning need
 
 1. Run `reuse-surface query --discovery-min D4` or read the index and scan
@@ -223,4 +234,4 @@ R4+ requires broader consumer evidence (incidents, adoption, SLO) per
 4. Update `availability.current_artifacts` when a new consumption mode appears.
 5. Refresh the index `vector` and run `reuse-surface validate --relations`.
 6. Run `reuse-surface federation compose` and `reuse-surface graph`.
-6. Set `status: reviewed` or `approved` when an assessor validates the entry.
\ No newline at end of file
+6. Set `status: reviewed` or `approved` when an assessor validates the entry.
diff --git a/registry/capabilities/capability.infotech.headless-browser.md b/registry/capabilities/capability.infotech.headless-browser.md
new file mode 100644
index 0000000..4ae030a
--- /dev/null
+++ b/registry/capabilities/capability.infotech.headless-browser.md
@@ -0,0 +1,182 @@
+---
+id: capability.infotech.headless-browser
+name: Headless Browser Automation
+summary: >-
+  Headless browser automation with Playwright and Chromium for UI testing,
+  screenshots and page extraction; recommended default based on existing
+  whynot-design, coulomb-social, core-hub and frontend-patterns implementations.
+owner: reuse-surface
+status: reviewed
+domain: infotech
+tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer]
+maturity:
+  discovery:
+    current: D3
+    target: D4
+    confidence: medium
+    rationale: >
+      Inspected four implemented Playwright consumers and separated optional
+      dependencies and plans from usage. No comprehensive alternatives benchmark.
+  availability:
+    current: A2
+    target: A2
+    confidence: medium
+    rationale: >
+      Existing JavaScript and Python source examples can be adapted in a consumer
+      repo. This entry does not deliver a shared wrapper or hosted browser service.
+external_evidence:
+  completeness:
+    level: C2
+    confidence: medium
+    basis: scope_vs_intent_and_consumer_expectations
+    satisfied_expectations:
+      - Identifies implemented consumers, browser engines and source entry points.
+      - Gives a scoped default recommendation and a practical trial procedure.
+    broken_expectations:
+      - No shared package, standard configuration or consumer-independent trial receipt.
+    out_of_scope_expectations:
+      - Exhaustive estate dependency inventory or comparative browser benchmark.
+      - Managed browser service or mandatory estate-wide technology policy.
+  reliability:
+    level: R2
+    confidence: medium
+    basis: consumer_quality_signals
+    known_reliability_risks:
+      - Browser binaries and system libraries must match the selected Playwright version.
+      - Existing examples contain application-specific fixtures and assumptions.
+      - Browser launch and target-repo compatibility have not been tested by this registration.
+    evidence:
+      satisfied_signals:
+        - frontend-patterns navigation-history records a completed Chromium/Firefox experiment.
+discovery:
+  intent: >
+    Help a worker select and reuse existing headless browser tooling instead of
+    independently introducing another automation stack.
+  includes:
+    - Playwright automation with headless Chromium as the default starting point.
+    - JavaScript UI tests, screenshots and page extraction examples.
+    - Python visual-check example and Firefox experiment evidence.
+  excludes:
+    - Browser hosting, credential provisioning and permission to automate external targets.
+    - Claims that a dependency declaration or a workplan proves executed browser usage.
+  assumptions:
+    - The consumer chooses a version compatible with its runtime and installs matching browsers.
+  use_cases:
+    - Find which working repos already use a headless browser and where to start reusing it.
+    - Run a local UI assertion and screenshot in a target repo before adopting the tooling.
+availability:
+  current_level: A2
+  target_level: A2
+  current_artifacts:
+    - ../whynot-design/playwright.config.mjs
+    - ../whynot-design/tests/visual/ui-kit.spec.mjs
+    - ../coulomb-social/scripts/test-usecase-browser.mjs
+    - ../core-hub/scripts/check_console_visual.py
+    - ../frontend-patterns/research/experiments/navigation-history/experiment.mjs
+  consumption_modes: [informational, source adaptation, JavaScript library, Python library]
+relations:
+  depends_on: []
+  supports: []
+  related_to: []
+evidence:
+  documentation:
+    - https://playwright.dev/docs/browsers
+    - ../frontend-patterns/research/experiments/navigation-history/README.md
+    - ../test-driver/SCOPE.md
+    - ../testdrive-jsui/pyproject.toml
+  tests:
+    - ../whynot-design/tests/visual/ui-kit.spec.mjs
+    - ../coulomb-social/scripts/test-usecase-browser.mjs
+    - ../core-hub/scripts/check_console_visual.py
+    - ../frontend-patterns/research/experiments/navigation-history/result.json
+  consumer_feedback: []
+consumer_guidance:
+  recommended_for:
+    - Use Playwright with headless Chromium for a new repo's general UI automation trial.
+    - Reuse whynot-design for JavaScript visual tests and core-hub for Python visual checks.
+    - Reuse coulomb-social for JavaScript browser scripts and frontend-patterns for multi-engine experiments.
+  not_recommended_for:
+    - Treating this recommendation as an approved mandatory estate standard.
+    - Selecting test-driver as an implemented JavaScript-capable browser engine.
+    - Introducing Selenium or Puppeteer merely because their names match a discovery query.
+  known_limitations:
+    - This is a dated source inspection; run the target-repo trial before claiming adoption success.
+    - Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection.
+    - Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here.
+promotion_history: []
+---
+
+# Headless Browser Automation
+
+## Recommendation
+
+Start with **Playwright controlling headless Chromium** for general browser
+automation, UI tests, screenshots and JavaScript-rendered page extraction.
+This follows implemented usage in four working repos. Playwright is the automation
+library; Chromium is the browser engine. Use `@playwright/test` for a JavaScript
+test suite, the `playwright` library for standalone JavaScript scripts, or Python
+`playwright` when the consumer is Python.
+
+This is a reuse recommendation reviewed against source on **2026-10-13**, not a
+mandatory estate standard or a benchmark verdict against Selenium/Puppeteer.
+reuse-surface maintains this discovery record; the example repos maintain their
+implementations and the upstream Playwright project maintains the library.
+
+## Existing implementations
+
+Paths in frontmatter are relative to the reuse-surface repository root. The links
+below work with sibling checkouts. The cited files were clean at these revisions.
+
+| Repo and inspected revision | What is implemented | Reuse starting point |
+| --- | --- | --- |
+| whynot-design — `a79a4d803e9aed13f66d072bf409b6f86000f01f` | Playwright Test, explicitly headless Chromium, screenshot comparisons | [Configuration](../../../whynot-design/playwright.config.mjs), [visual tests](../../../whynot-design/tests/visual/ui-kit.spec.mjs), [dependency/scripts](../../../whynot-design/package.json) |
+| coulomb-social — `5c32757b987ab1610cdb46a808d56c75f569f581` | JavaScript Playwright scripts launching headless Chromium for browser tests and extraction | [Use-case test](../../../coulomb-social/scripts/test-usecase-browser.mjs), [script dependency](../../../coulomb-social/scripts/package.json) |
+| core-hub — `a69ad325271485afe284a6db85673dfa30d9d4ad` | Python synchronous Playwright visual checks launching Chromium with the default headless mode | [Visual-check script](../../../core-hub/scripts/check_console_visual.py), [development dependency](../../../core-hub/pyproject.toml) |
+| frontend-patterns — `047a6a2d314ff5a9d2a87d5bc987d7d84835f682` | Playwright experiments using Chromium and Firefox, with retained execution receipts | [Runner](../../../frontend-patterns/research/experiments/navigation-history/experiment.mjs), [setup and limitations](../../../frontend-patterns/research/experiments/navigation-history/README.md), [result](../../../frontend-patterns/research/experiments/navigation-history/result.json) |
+
+These are source/retained-receipt observations, not newly executed test results.
+The frontend-patterns example uses an explicit Chromium binary override; do not
+copy its workstation paths as a portable browser installation recipe.
+
+## Alternatives and misleading matches
+
+- **Selenium:** [testdrive-jsui's optional development dependencies](../../../testdrive-jsui/pyproject.toml)
+  declare it at `701341d7fa520f860245e28eb16d44b767fd116b`. A declaration alone
+  does not establish an implemented or passing browser workflow.
+- **test-driver:** [SCOPE.md](../../../test-driver/SCOPE.md) at
+  `c3ad06e598057862cf500cbd46c7c8b6f83885ed` explicitly excludes a browser engine,
+  JavaScript execution, screenshots and DOM timing. Historical Playwright plans
+  are not an available implementation.
+- **Puppeteer:** no verified implementation was found in this inspection. This
+  is not a claim that every working repo has been exhaustively searched.
+- **Firefox/WebKit:** Playwright supports both upstream. Firefox has retained
+  experiment evidence here; WebKit has no verified local example in this record.
+
+## Practical trial for the consuming worker
+
+1. Query this checkout with `python3 -m reuse_surface.cli query --keyword browser`
+   from the reuse-surface root, then open this entry. If the CLI is installed,
+   `reuse-surface query --keyword browser` is equivalent.
+   `plan-check --intent "headless browser" --no-llm` also includes this candidate,
+   but its token-overlap thresholds and maturity tie-breaking currently return
+   `new` for this short query. That verdict does not establish absence of reuse;
+   use the explicit keyword query and read the evidence for this trial.
+2. Pick the example matching the target repo's language and task. Inspect its
+   fixture/server assumptions before adapting the smallest useful test or script.
+3. Use the target repo's package manager and lockfile. Select a compatible
+   Playwright version and install its matching Chromium binary. For an installed
+   Node dependency, use `npx playwright install chromium`; for an installed Python
+   dependency, use `python -m playwright install chromium` in its environment.
+   Follow the upstream [browser/system-dependency instructions](https://playwright.dev/docs/browsers)
+   if system libraries are missing. No common estate version is established here.
+4. Against a local fixture or the target repo's local development server, launch
+   headless Chromium, load one page, assert one meaningful rendered element or
+   interaction, save a screenshot if relevant, and close the browser. Exercise
+   a JavaScript-driven change if JavaScript rendering is the reason for adoption.
+5. Report the consumer repo, reference example, package/browser versions, exact
+   command, assertion outcome, artifact paths and any setup failure. The trial
+   remains unverified until this evidence exists; installation alone is not success.
+
+The hosted service reads published repository indexes. A local edit does not
+by itself make this entry available at `reuse.coulomb.social`; use the local query
+above for an unpublished trial and verify the hosted entry after publication.
diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml
index 045eace..457f4e6 100644
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -360,13 +360,12 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: reuse-surface
-  url: https://forgejo.coulomb.social/coulomb/reuse-surface/raw/main/registry/indexes/capabilities.yaml
+  # Include this checkout's entries in local plan-check before publication.
+  index: registry/indexes/capabilities.yaml
   enabled: true
-  required: false
+  required: true
   domain: helix_forge
   description: Capability registry for helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
 - repo: shard-wiki
   url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
   enabled: true
diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml
index 0cbda4e..e793299 100644
--- a/registry/indexes/capabilities.yaml
+++ b/registry/indexes/capabilities.yaml
@@ -1,8 +1,22 @@
 # Manually maintained capability index for humans and agents.
 version: 1
-updated: "2026-06-16"
+updated: "2026-10-13"
 domain: helix_forge
 capabilities:
+  - id: capability.infotech.headless-browser
+    name: Headless Browser Automation
+    summary: >-
+      Headless browser automation with Playwright and Chromium for UI testing,
+      screenshots and page extraction; recommended default based on existing
+      whynot-design, coulomb-social, core-hub and frontend-patterns implementations.
+    vector: D3 / A2 / C2 / R2
+    domain: infotech
+    status: reviewed
+    owner: reuse-surface
+    path: registry/capabilities/capability.infotech.headless-browser.md
+    tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer]
+    consumption_modes: [informational, source adaptation, JavaScript library, Python library]
+
   - id: capability.registry.register
     name: Capability Registration
     summary: Register a new capability so it becomes visible for planning and implementation reuse.
@@ -23,4 +37,4 @@ capabilities:
     owner: reuse-surface
     path: registry/capabilities/capability.registry.validate.md
     tags: [registry, validation, cli]
-    consumption_modes: [cli]
\ No newline at end of file
+    consumption_modes: [cli]
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 8aa4b52..ffa4d49 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-09-30'
+updated: '2026-10-13'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -210,9 +210,8 @@ sources:
   url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/repo-seed.yaml
 - repo: reuse-surface
-  count: 2
-  url: https://forgejo.coulomb.social/coulomb/reuse-surface/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/reuse-surface.yaml
+  count: 3
+  index: registry/indexes/capabilities.yaml
 - repo: shard-wiki
   count: 8
   url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
@@ -942,6 +941,36 @@ capabilities:
   source_repo: email-connect
   source_url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/email-connect.yaml
+- id: capability.infotech.headless-browser
+  name: Headless Browser Automation
+  summary: Headless browser automation with Playwright and Chromium for UI testing,
+    screenshots and page extraction; recommended default based on existing whynot-design,
+    coulomb-social, core-hub and frontend-patterns implementations.
+  vector: D3 / A2 / C2 / R2
+  domain: infotech
+  status: reviewed
+  owner: reuse-surface
+  path: registry/capabilities/capability.infotech.headless-browser.md
+  tags:
+  - headless
+  - browser
+  - automation
+  - playwright
+  - chromium
+  - testing
+  - screenshots
+  - extraction
+  - firefox
+  - webkit
+  - selenium
+  - puppeteer
+  consumption_modes:
+  - informational
+  - source adaptation
+  - JavaScript library
+  - Python library
+  source_repo: reuse-surface
+  source_index: registry/indexes/capabilities.yaml
 - id: capability.infotech.hub-core-library
   name: Reusable FOS Hub Core Primitives
   summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State
@@ -1285,8 +1314,7 @@ capabilities:
   - cli
   - service API
   source_repo: reuse-surface
-  source_url: https://forgejo.coulomb.social/coulomb/reuse-surface/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/reuse-surface.yaml
+  source_index: registry/indexes/capabilities.yaml
 - id: capability.registry.validate
   name: Registry Entry Validation
   summary: Validate capability registry entries against schema, index consistency,
@@ -1303,8 +1331,7 @@ capabilities:
   consumption_modes:
   - cli
   source_repo: reuse-surface
-  source_url: https://forgejo.coulomb.social/coulomb/reuse-surface/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/reuse-surface.yaml
+  source_index: registry/indexes/capabilities.yaml
 - id: capability.security.iam-tooling-suite
   name: NetKingdom Security/IAM Tooling Suite
   summary: Canonical security architecture and executable reference tooling for IAM,
diff --git a/workplans/ADHOC-2026-10-13.md b/workplans/ADHOC-2026-10-13.md
new file mode 100644
index 0000000..3584e08
--- /dev/null
+++ b/workplans/ADHOC-2026-10-13.md
@@ -0,0 +1,54 @@
+---
+id: ADHOC-2026-10-13
+type: workplan
+title: "Register existing headless browser tooling for a worker trial"
+domain: infotech
+repo: reuse-surface
+status: active
+owner: codex
+created: "2026-10-13"
+updated: "2026-10-13"
+state_hub_workstream_id: "052a02f6-25ae-54cd-a61e-49f9e5dc1120"
+---
+
+## Register browser automation and verify discovery
+
+```task
+id: ADHOC-2026-10-13-T01
+status: done
+priority: medium
+state_hub_task_id: "e35c0122-9afe-5007-b1f8-278d628b94ba"
+```
+
+User requested the evidence and recommendation from the browser-tooling assessment
+be included in reuse-surface for a subsequent worker trial. Add a capability entry
+and index metadata, distinguish implemented examples from optional dependencies
+and plans, give scoped Playwright/Chromium guidance, and validate discovery.
+The consuming worker performs the browser trial separately.
+
+Completed 2026-10-13:
+
+- Added `capability.infotech.headless-browser` at D3/A2/C2/R2, with four
+  revision-pinned implementation examples, scoped guidance and trial steps.
+- Added local index metadata and regenerated the catalog, graph and federation
+  (66 capabilities). Local federation now reads this checkout's own index;
+  hosted registration remains unchanged and needs publication of the new content.
+- `query --keyword browser` and `query --keyword playwright` each return the
+  browser entry. All cited local evidence paths and Markdown links resolve.
+- `validate --relations --fail-on-warnings` and graph checks pass. Existing
+  registry, federation, plan-check and hosted-plan-check suites: **76 passed**.
+- Documented the existing matcher limitation: short-intent `plan-check` includes
+  this candidate but still returns `new`; use the explicit keyword query for the
+  worker trial. No matcher behavior or browser execution was changed or claimed.
+
+## Publish and synchronize browser discovery
+
+```task
+id: ADHOC-2026-10-13-T02
+status: progress
+priority: medium
+```
+
+User explicitly authorized publication, sync and commit on 2026-10-13. Commit and
+push the registry content, refresh the hosted federation, verify that the hosted
+entry and published source document are accessible, and synchronize work records.

From 80e04c02fe5cf84606d9d60c0c4537e8d47e71fc Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Tue, 13 Oct 2026 14:01:00 +0200
Subject: [PATCH 24/55] Record hosted browser publication and synchronize work
 records

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13502-3de4-7af3-a6ae-3ef26de4adec
---
 .custodian-brief.md           |  2 +-
 WORK-RECORDS.md               |  1 +
 workplans/ADHOC-2026-10-13.md | 22 ++++++++++++++++++++--
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/.custodian-brief.md b/.custodian-brief.md
index 6a1b056..96418f7 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-13 11:35 UTC  
+**Last synced:** 2026-10-13 11:59 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index bcccc6d..26349ab 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -11,5 +11,6 @@
 | workplan | ADHOC-2026-10-13 | finished | — | workplans/ADHOC-2026-10-13.md |
 | workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md |
+| task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
diff --git a/workplans/ADHOC-2026-10-13.md b/workplans/ADHOC-2026-10-13.md
index 3584e08..6f3230b 100644
--- a/workplans/ADHOC-2026-10-13.md
+++ b/workplans/ADHOC-2026-10-13.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Register existing headless browser tooling for a worker trial"
 domain: infotech
 repo: reuse-surface
-status: active
+status: finished
 owner: codex
 created: "2026-10-13"
 updated: "2026-10-13"
@@ -45,10 +45,28 @@ Completed 2026-10-13:
 
 ```task
 id: ADHOC-2026-10-13-T02
-status: progress
+status: done
 priority: medium
+state_hub_task_id: "2a8633d9-5664-5df8-9fd5-16b1d4bef91f"
 ```
 
 User explicitly authorized publication, sync and commit on 2026-10-13. Commit and
 push the registry content, refresh the hosted federation, verify that the hosted
 entry and published source document are accessible, and synchronize work records.
+
+Publication verified 2026-10-13:
+
+- Content commit `64e1674` pushed to `origin/main`.
+- Published source document fetched from
+  `https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/capabilities/capability.infotech.headless-browser.md`
+  matches the committed local file byte for byte.
+- Refreshed `https://reuse.coulomb.social/v1/federated?refresh=true`;
+  `composed_at: 2026-10-13T11:56:56+00:00`, `stale: false`, 66 capabilities,
+  exactly one `capability.infotech.headless-browser`, no federation warnings.
+- Hosted `plan-check --intent "headless browser" --no-llm` includes the entry.
+  Its documented scoring limitation remains; publication does not change ranking.
+- Registry validation and graph checks passed again before publication; the
+  previously recorded 76-test result covers the unchanged implementation.
+- State Hub indexed both completed tasks. Its consistency tool required reopening
+  the finished workstream before indexing T02; the record is closed again after
+  that sync. Generated writeback files are committed with this publication record.

From ada122edbeced3f1615e06b23b79d891a875f249 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Tue, 13 Oct 2026 14:14:53 +0200
Subject: [PATCH 25/55] Record the content-explorer request for a runnable
 headless-browser answer.

CONTENT-WP-0000-T04 needed a browser on the workstation. The published capability is a discovery card at availability A2, and plan-check still returns new for "headless browser". REUSE-IN-0001 asks the query to name a verified trial or to report that availability gap.

Assistant: grok
Assistant-Session: 01a1346c-fdff-7741-b1af-b7283661554b
---
 ...N-0001-headless-browser-runnable-answer.md | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 intakes/REUSE-IN-0001-headless-browser-runnable-answer.md

diff --git a/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
new file mode 100644
index 0000000..2a50017
--- /dev/null
+++ b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
@@ -0,0 +1,66 @@
+# REUSE-IN-0001 — Answer a headless-browser request with a runnable trial
+
+```yaml
+id: REUSE-IN-0001
+kind: intake
+title: "Answer a headless-browser request with a runnable trial, or say the gap is availability"
+status: open
+lane: green
+flavor: implementation
+origin: cross-repo
+origin_ref: CONTENT-WP-0000-T04
+priority: medium
+owner: reuse-surface
+repo: reuse-surface
+requested_by: content-explorer
+created: "2026-10-13"
+updated: "2026-10-13"
+description: >
+  content-explorer asked the hosted reuse-surface index for a headless browser
+  while CONTENT-WP-0000-T04 was open. That task needs responsive screenshots
+  and a keyboard walkthrough. On 2026-10-12 the workstation had no Chrome,
+  Chromium, Firefox, or Playwright launcher.
+
+
+  GET https://reuse.coulomb.social/v1/federated (composed_at
+  2026-10-13T11:56:56Z, stale false) returns
+  capability.infotech.headless-browser at D3 / A2 / C2 / R2. The card
+  recommends adapting Playwright plus Chromium from whynot-design,
+  coulomb-social, core-hub, and frontend-patterns. The entry states that it
+  does not deliver a shared wrapper or a hosted browser. A keyword filter for
+  "headless" also returns four unrelated engines (kontextual-engine,
+  user-engine, email-connect, evidence-source). Hosted plan-check for the
+  intent "headless browser" includes the entry and still returns verdict
+  new. The publication note on ADHOC-2026-10-13-T02 already records that
+  scoring limitation.
+
+
+  What the consumer needed from the service:
+
+
+  1. A response that answers whether a browser can be launched on this
+  workstation now.
+
+  2. When it can, one verified command path in the query response itself:
+  install the matching Playwright Chromium, open one page, save a screenshot,
+  and record a short keyboard interaction. Learning that next step should
+  not require opening a sibling checkout and copying another repo's fixtures.
+
+  3. When it cannot, the same response should say the record is
+  discovery-only, availability is A2, nothing is installed for the caller,
+  and nothing is hosted. The verdict should be an availability gap on
+  capability.infotech.headless-browser, so the worker extends that entry
+  instead of starting a second browser stack.
+
+  4. The phrase "headless browser" should rank apart from unrelated headless
+  services.
+
+
+  A hosted browser farm, credential handling, and permission to automate
+  arbitrary external sites are outside this request. The current entry is
+  right to keep those excluded. The useful increment is a
+  workstation-verified trial helper with a pinned Playwright and Chromium
+  version, plus a query result that names that helper or names the
+  availability gap. This intake does not ask reuse-surface to mark
+  CONTENT-WP-0000-T04 done or to import OnCo.
+```

From 82a34da494efe8c8b16828b7893840958305157f Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Tue, 13 Oct 2026 14:15:55 +0200
Subject: [PATCH 26/55] Write back the State Hub id for REUSE-IN-0001.

Assistant: grok
Assistant-Session: 01a1346c-fdff-7741-b1af-b7283661554b
---
 WORK-RECORDS.md                                           | 1 +
 intakes/REUSE-IN-0001-headless-browser-runnable-answer.md | 1 +
 2 files changed, 2 insertions(+)

diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 26349ab..2746b8e 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -14,3 +14,4 @@
 | task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
+| intake | REUSE-IN-0001 | open | green | intakes/REUSE-IN-0001-headless-browser-runnable-answer.md |
diff --git a/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
index 2a50017..3150925 100644
--- a/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
+++ b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
@@ -63,4 +63,5 @@ description: >
   version, plus a query result that names that helper or names the
   availability gap. This intake does not ask reuse-surface to mark
   CONTENT-WP-0000-T04 done or to import OnCo.
+state_hub_intake_id: "01a13530-89a8-77b0-bb95-ef16d74bb29b"
 ```

From 9042dec5ed0d5538831676dc284747206493478a Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Tue, 13 Oct 2026 16:02:38 +0200
Subject: [PATCH 27/55] Record forthcoming rapp-playwright service and clarify
 delivery ownership

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13502-3de4-7af3-a6ae-3ef26de4adec
---
 docs/CapabilityCatalog.md                     |  3 +-
 docs/catalog/index.html                       |  2 +-
 docs/catalog/registry.json                    |  2 +-
 ...N-0001-headless-browser-runnable-answer.md | 16 ++++++
 .../capability.infotech.headless-browser.md   | 50 +++++++++++++++++--
 registry/indexes/capabilities.yaml            |  2 +
 registry/indexes/federated.yaml               |  4 +-
 7 files changed, 72 insertions(+), 7 deletions(-)

diff --git a/docs/CapabilityCatalog.md b/docs/CapabilityCatalog.md
index 0927d54..504b0b2 100644
--- a/docs/CapabilityCatalog.md
+++ b/docs/CapabilityCatalog.md
@@ -39,9 +39,10 @@ Generated by `reuse-surface catalog`. Do not edit manually.
 - **Vector:** D3 / A2 / C2 / R2
 - **Owner:** reuse-surface
 - **Path:** `registry/capabilities/capability.infotech.headless-browser.md`
-- **Summary:** Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations.
+- **Summary:** Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided service will be available shortly (announced 2026-10-13; planned, not yet verified available).
 
 **Known limitations:**
 - This is a dated source inspection; run the target-repo trial before claiming adoption success.
 - Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection.
 - Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here.
+- The forthcoming rapp-playwright service has no verified endpoint or launch receipt in this record yet.
diff --git a/docs/catalog/index.html b/docs/catalog/index.html
index 1e87c05..386e802 100644
--- a/docs/catalog/index.html
+++ b/docs/catalog/index.html
@@ -33,7 +33,7 @@
 

   
Headless Browser Automation

   
capability.infotech.headless-browser · D3 / A2 / C2 / R2

-  
Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations.

+  
Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided service will be available shortly (announced 2026-10-13; planned, not yet verified available).

   
registry/capabilities/capability.infotech.headless-browser.md

 

 
diff --git a/docs/catalog/registry.json b/docs/catalog/registry.json
index 457e86d..895f28f 100644
--- a/docs/catalog/registry.json
+++ b/docs/catalog/registry.json
@@ -5,7 +5,7 @@
     {
       "id": "capability.infotech.headless-browser",
       "name": "Headless Browser Automation",
-      "summary": "Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations.",
+      "summary": "Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided service will be available shortly (announced 2026-10-13; planned, not yet verified available).",
       "vector": "D3 / A2 / C2 / R2",
       "domain": "infotech",
       "status": "reviewed",
diff --git a/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
index 3150925..15cd89f 100644
--- a/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
+++ b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
@@ -63,5 +63,21 @@ description: >
   version, plus a query result that names that helper or names the
   availability gap. This intake does not ask reuse-surface to mark
   CONTENT-WP-0000-T04 done or to import OnCo.
+
+
+  Owner response, 2026-10-13, following founder direction: browser service
+  implementation, operation and consumer workstation setup are not reuse-surface
+  responsibilities. A rapp-playwright-provided service will be available shortly.
+  Record this as announced/planned, not verified availability; no endpoint,
+  consumption contract or launch receipt has been verified here. Existing A2
+  source reuse remains available and the current maturity vector is unchanged.
+
+
+  reuse-surface retains responsibility for discovery, accurate availability
+  guidance, consumption references and the reported false-new/relevance defects.
+  This intake remains open for those registry concerns; its browser-delivery
+  request belongs to rapp-playwright. A2 means source/library reuse, not
+  discovery-only or already installed for a caller. CONTENT-WP-0000-T04 remains
+  the consumer's task and is not completed by this announcement.
 state_hub_intake_id: "01a13530-89a8-77b0-bb95-ef16d74bb29b"
 ```
diff --git a/registry/capabilities/capability.infotech.headless-browser.md b/registry/capabilities/capability.infotech.headless-browser.md
index 4ae030a..f13af73 100644
--- a/registry/capabilities/capability.infotech.headless-browser.md
+++ b/registry/capabilities/capability.infotech.headless-browser.md
@@ -5,6 +5,8 @@ summary: >-
   Headless browser automation with Playwright and Chromium for UI testing,
   screenshots and page extraction; recommended default based on existing
   whynot-design, coulomb-social, core-hub and frontend-patterns implementations.
+  A rapp-playwright-provided service will be available shortly (announced
+  2026-10-13; planned, not yet verified available).
 owner: reuse-surface
 status: reviewed
 domain: infotech
@@ -24,6 +26,8 @@ maturity:
     rationale: >
       Existing JavaScript and Python source examples can be adapted in a consumer
       repo. This entry does not deliver a shared wrapper or hosted browser service.
+      The founder announced a forthcoming rapp-playwright service on 2026-10-13;
+      that planned delivery does not change the evidenced current A2 level.
 external_evidence:
   completeness:
     level: C2
@@ -36,7 +40,8 @@ external_evidence:
       - No shared package, standard configuration or consumer-independent trial receipt.
     out_of_scope_expectations:
       - Exhaustive estate dependency inventory or comparative browser benchmark.
-      - Managed browser service or mandatory estate-wide technology policy.
+      - Browser service implementation or operation by reuse-surface.
+      - Mandatory estate-wide technology policy.
   reliability:
     level: R2
     confidence: medium
@@ -57,7 +62,8 @@ discovery:
     - JavaScript UI tests, screenshots and page extraction examples.
     - Python visual-check example and Firefox experiment evidence.
   excludes:
-    - Browser hosting, credential provisioning and permission to automate external targets.
+    - Browser hosting or workstation provisioning by reuse-surface.
+    - Credential provisioning and permission to automate external targets.
     - Claims that a dependency declaration or a workplan proves executed browser usage.
   assumptions:
     - The consumer chooses a version compatible with its runtime and installs matching browsers.
@@ -73,6 +79,11 @@ availability:
     - ../coulomb-social/scripts/test-usecase-browser.mjs
     - ../core-hub/scripts/check_console_visual.py
     - ../frontend-patterns/research/experiments/navigation-history/experiment.mjs
+  target_artifacts:
+    - >-
+      Planned rapp-playwright-provided service, announced by the founder on
+      2026-10-13 as available shortly; endpoint, consumption contract and readiness
+      evidence have not yet been verified by reuse-surface.
   consumption_modes: [informational, source adaptation, JavaScript library, Python library]
 relations:
   depends_on: []
@@ -84,17 +95,28 @@ evidence:
     - ../frontend-patterns/research/experiments/navigation-history/README.md
     - ../test-driver/SCOPE.md
     - ../testdrive-jsui/pyproject.toml
+    - ../rapp-playwright/README.md
+    - intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
   tests:
     - ../whynot-design/tests/visual/ui-kit.spec.mjs
     - ../coulomb-social/scripts/test-usecase-browser.mjs
     - ../core-hub/scripts/check_console_visual.py
     - ../frontend-patterns/research/experiments/navigation-history/result.json
-  consumer_feedback: []
+  consumer_feedback:
+    - >-
+      2026-10-13 content-explorer, REUSE-IN-0001: published source examples did not
+      provide a verified runnable path for screenshots and keyboard interaction.
+      The false-new plan-check verdict is a registry discovery issue, not evidence
+      that a new browser stack is needed. Browser delivery belongs to the provider.
 consumer_guidance:
   recommended_for:
     - Use Playwright with headless Chromium for a new repo's general UI automation trial.
     - Reuse whynot-design for JavaScript visual tests and core-hub for Python visual checks.
     - Reuse coulomb-social for JavaScript browser scripts and frontend-patterns for multi-engine experiments.
+    - >-
+      For service consumption, rapp-playwright is the announced provider and its
+      service will be available shortly. Use its published contract and readiness
+      evidence when delivered; current availability remains source reuse only.
   not_recommended_for:
     - Treating this recommendation as an approved mandatory estate standard.
     - Selecting test-driver as an implemented JavaScript-capable browser engine.
@@ -103,6 +125,7 @@ consumer_guidance:
     - This is a dated source inspection; run the target-repo trial before claiming adoption success.
     - Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection.
     - Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here.
+    - The forthcoming rapp-playwright service has no verified endpoint or launch receipt in this record yet.
 promotion_history: []
 ---
 
@@ -122,6 +145,27 @@ mandatory estate standard or a benchmark verdict against Selenium/Puppeteer.
 reuse-surface maintains this discovery record; the example repos maintain their
 implementations and the upstream Playwright project maintains the library.
 
+## Service provider and delivery status
+
+**A `rapp-playwright`-provided service will be available shortly**, as announced by
+the founder on 2026-10-13. Its [repository description](../../../rapp-playwright/README.md)
+identifies a Railiance wrapper for a Playwright and headless Chromium environment
+supporting use-case testing. Service availability is **planned**, not verified:
+this record has no confirmed endpoint, consumption contract or launch receipt yet.
+The current **D3 / A2 / C2 / R2** vector continues to describe evidenced source reuse.
+
+`rapp-playwright` owns the forthcoming browser service. `reuse-surface` owns
+discovery, consumption guidance, maturity assessment and evidence references; it
+does not implement or operate the browser service or install browsers on behalf
+of consumers. Its `owner` field here denotes the maintainer of this registry record.
+
+The [content-explorer feedback](../../intakes/REUSE-IN-0001-headless-browser-runnable-answer.md)
+is retained as consumer evidence. Browser delivery is assigned to the provider;
+the reported relevance, false-`new` verdict and availability-clarity issues remain
+reuse-surface concerns. A2 means source/library reuse, not proof of a locally
+installed browser. The service announcement does not complete the consumer's
+screenshot and keyboard-walkthrough task.
+
 ## Existing implementations
 
 Paths in frontmatter are relative to the reuse-surface repository root. The links
diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml
index e793299..23698cb 100644
--- a/registry/indexes/capabilities.yaml
+++ b/registry/indexes/capabilities.yaml
@@ -9,6 +9,8 @@ capabilities:
       Headless browser automation with Playwright and Chromium for UI testing,
       screenshots and page extraction; recommended default based on existing
       whynot-design, coulomb-social, core-hub and frontend-patterns implementations.
+      A rapp-playwright-provided service will be available shortly (announced
+      2026-10-13; planned, not yet verified available).
     vector: D3 / A2 / C2 / R2
     domain: infotech
     status: reviewed
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index ffa4d49..8672c50 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -945,7 +945,9 @@ capabilities:
   name: Headless Browser Automation
   summary: Headless browser automation with Playwright and Chromium for UI testing,
     screenshots and page extraction; recommended default based on existing whynot-design,
-    coulomb-social, core-hub and frontend-patterns implementations.
+    coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided
+    service will be available shortly (announced 2026-10-13; planned, not yet verified
+    available).
   vector: D3 / A2 / C2 / R2
   domain: infotech
   status: reviewed

From 50077c9bea01fa43a4676af69d1995134b2f6cd2 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Tue, 13 Oct 2026 20:48:05 +0200
Subject: [PATCH 28/55] Fix short-intent discovery and publish verified browser
 provider guidance

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13690-1c84-77a2-aeee-7f517ec60f5d
---
 .custodian-brief.md                           |  10 +-
 WORK-RECORDS.md                               |   4 +
 docs/CapabilityCatalog.md                     |   7 +-
 docs/catalog/index.html                       |   4 +-
 docs/catalog/registry.json                    |   9 +-
 docs/evidence/2026-10-13-browser-discovery.md |  84 ++++++++
 .../artifact-checks.json                      |  30 +++
 .../desktop-final.png                         | Bin 0 -> 26622 bytes
 .../narrow-final.png                          | Bin 0 -> 24280 bytes
 .../preflight.json                            |  22 ++
 .../2026-10-13-browser-discovery/receipt.json | 184 ++++++++++++++++
 docs/graph/capability-graph.mmd               |   2 +-
 docs/graph/index.html                         |   2 +-
 .../capability.infotech.headless-browser.md   | 202 ++++++++++++++----
 registry/indexes/capabilities.yaml            |  21 +-
 registry/indexes/federated.yaml               |  20 +-
 reuse_surface/plan_check.py                   |  11 +-
 specs/PlanCheck.md                            |  16 +-
 tests/test_hosted_plan_check.py               |  25 +++
 tests/test_plan_check.py                      |  57 +++++
 tests/test_stats.py                           |  37 +++-
 ...browser-discovery-and-provider-evidence.md |  76 +++++++
 22 files changed, 736 insertions(+), 87 deletions(-)
 create mode 100644 docs/evidence/2026-10-13-browser-discovery.md
 create mode 100644 docs/evidence/2026-10-13-browser-discovery/artifact-checks.json
 create mode 100644 docs/evidence/2026-10-13-browser-discovery/desktop-final.png
 create mode 100644 docs/evidence/2026-10-13-browser-discovery/narrow-final.png
 create mode 100644 docs/evidence/2026-10-13-browser-discovery/preflight.json
 create mode 100644 docs/evidence/2026-10-13-browser-discovery/receipt.json
 create mode 100644 workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md

diff --git a/.custodian-brief.md b/.custodian-brief.md
index 96418f7..acae414 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,18 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-13 11:59 UTC  
+**Last synced:** 2026-10-13 18:43 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Resolve browser discovery relevance and publish verified provider consumption
+Progress: 0/3 done  |  workplan_id: `3d62d0af-5deb-55b5-b570-e62f05a43666`
+
+**Open tasks:**
+- ► Publish the verified provider path  `dd75f033`
+- · Fix short-intent relevance  `a689bc2a`
+- · Validate, publish and synchronize  `0be283ba`
 
 ## Inbox Hygiene
 
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 2746b8e..2b2c7aa 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -10,8 +10,12 @@
 | --- | --- | --- | --- | --- |
 | workplan | ADHOC-2026-10-13 | finished | — | workplans/ADHOC-2026-10-13.md |
 | workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
+| workplan | REUSE-WP-0024 | active | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
 | task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
+| task | REUSE-WP-0024-T01 | progress | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| task | REUSE-WP-0024-T02 | todo | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| task | REUSE-WP-0024-T03 | todo | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
 | intake | REUSE-IN-0001 | open | green | intakes/REUSE-IN-0001-headless-browser-runnable-answer.md |
diff --git a/docs/CapabilityCatalog.md b/docs/CapabilityCatalog.md
index 504b0b2..fbc72ee 100644
--- a/docs/CapabilityCatalog.md
+++ b/docs/CapabilityCatalog.md
@@ -36,13 +36,14 @@ Generated by `reuse-surface catalog`. Do not edit manually.
 ### Headless Browser Automation
 
 - **ID:** `capability.infotech.headless-browser`
-- **Vector:** D3 / A2 / C2 / R2
+- **Vector:** D3 / A5 / C2 / R2
 - **Owner:** reuse-surface
 - **Path:** `registry/capabilities/capability.infotech.headless-browser.md`
-- **Summary:** Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided service will be available shortly (announced 2026-10-13; planned, not yet verified available).
+- **Summary:** Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
 
 **Known limitations:**
 - This is a dated source inspection; run the target-repo trial before claiming adoption success.
 - Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection.
 - Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here.
-- The forthcoming rapp-playwright service has no verified endpoint or launch receipt in this record yet.
+- Local provider availability is verified but ephemeral; managed admission and platform operation remain pending.
+- Provider fixture success does not establish consumer target reachability or application acceptance.
diff --git a/docs/catalog/index.html b/docs/catalog/index.html
index 386e802..99328ac 100644
--- a/docs/catalog/index.html
+++ b/docs/catalog/index.html
@@ -32,8 +32,8 @@
 
infotech

 

   
Headless Browser Automation

-  
capability.infotech.headless-browser · D3 / A2 / C2 / R2

-  
Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided service will be available shortly (announced 2026-10-13; planned, not yet verified available).

+  
capability.infotech.headless-browser · D3 / A5 / C2 / R2

+  
Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.

   
registry/capabilities/capability.infotech.headless-browser.md

 

 
diff --git a/docs/catalog/registry.json b/docs/catalog/registry.json
index 895f28f..f9642fb 100644
--- a/docs/catalog/registry.json
+++ b/docs/catalog/registry.json
@@ -5,8 +5,8 @@
     {
       "id": "capability.infotech.headless-browser",
       "name": "Headless Browser Automation",
-      "summary": "Headless browser automation with Playwright and Chromium for UI testing, screenshots and page extraction; recommended default based on existing whynot-design, coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided service will be available shortly (announced 2026-10-13; planned, not yet verified available).",
-      "vector": "D3 / A2 / C2 / R2",
+      "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.",
+      "vector": "D3 / A5 / C2 / R2",
       "domain": "infotech",
       "status": "reviewed",
       "owner": "reuse-surface",
@@ -29,7 +29,10 @@
         "informational",
         "source adaptation",
         "JavaScript library",
-        "Python library"
+        "Python library",
+        "cli",
+        "service API",
+        "container"
       ]
     },
     {
diff --git a/docs/evidence/2026-10-13-browser-discovery.md b/docs/evidence/2026-10-13-browser-discovery.md
new file mode 100644
index 0000000..d2c3287
--- /dev/null
+++ b/docs/evidence/2026-10-13-browser-discovery.md
@@ -0,0 +1,84 @@
+# Browser discovery review — 2026-10-13
+
+REUSE-WP-0024 resolves the registry-owned portion of REUSE-IN-0001 on the
+existing `capability.infotech.headless-browser` record. Provider implementation
+and managed lifecycle remain with rapp-playwright and railiance-platform;
+CONTENT-WP-0000-T04 remains the consumer's acceptance task.
+
+## Published provider evidence
+
+Fetched the raw client, consumer contract, independent-consumer report and
+release manifest at provider commit
+`8831a05aeba5ce588f3b395ade676dde2a151c5d`. All four matched `git show` at that
+revision byte for byte. The single-file Python client SHA-256 is
+`9967a0831ed04e27fde419098af707722d5c81c993e4c294b3677ffb75729c12`.
+Pinned public links are retained in the
+[capability card](../../registry/capabilities/capability.infotech.headless-browser.md).
+
+The published image is
+`forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441`
+for linux/amd64. Provider publication evidence includes immutable registry
+verification and railiance01 pull. This review did not redeploy the provider.
+
+## Fresh client-only local trial
+
+Executed the downloaded client, without installing Playwright or Chromium:
+
+```sh
+python3 /tmp/reuse-browser-review/rapp_playwright.py --url http://127.0.0.1:18083 preflight
+python3 /tmp/reuse-browser-review/rapp_playwright.py --url http://127.0.0.1:18083 trial --out /tmp/reuse-browser-review/trial-01
+```
+
+Both exited 0. Run `6c710b36-319b-45b8-b062-ac2065f5e81b` completed at
+**18:42:58 UTC** with **14 passed steps**: visibility, counter checks, Tab,
+focused-button assertion, Enter and screenshot in two viewports. The provider
+reported service 0.1.0, Playwright 1.64.0, Chromium 156.0.8078.4,
+`workstation-release-check`, and the published digest above. Preflight permitted
+no external origins; only the synthetic fixture was exercised.
+
+Independently parsed all four PNG headers and recomputed hashes against the
+client receipt. Desktop screenshots are 1280×800 and narrow screenshots are
+390×844. This validates dimensions and integrity, not visual-baseline quality.
+
+- [Preflight](2026-10-13-browser-discovery/preflight.json)
+- [Receipt](2026-10-13-browser-discovery/receipt.json)
+- [Independent artifact checks](2026-10-13-browser-discovery/artifact-checks.json)
+- [Desktop fixture](2026-10-13-browser-discovery/desktop-final.png)
+- [Narrow fixture](2026-10-13-browser-discovery/narrow-final.png)
+
+Private run handles are excluded. The endpoint is ephemeral and was available
+on this workstation at trial time; it is not a managed service or a promise of
+future availability. The source examples remain a fallback when a provider is
+unavailable. No consumer app, remote target or managed browser was tested.
+
+## Assessment and matching
+
+Promoted availability **A2 → A5** under the standard's deployable-container
+definition. **A6 managed platform capability remains pending**. D3/C2/R2 stay
+conservative; fixture execution does not prove broader target compatibility or
+platform operation. Decision recorded in State Hub as
+`b8ef28c1-9164-4678-8a61-1652e0f07407`.
+
+Before this fix, `plan-check --intent "headless browser" --no-llm` returned
+`new`, with an unrelated context engine first at 0.0476 and the browser third.
+After scoring names independently from summaries/tags, the same query returns
+`reuse`, with the browser first at **0.6667** and unrelated matches at **0.2 or
+less**. Long command/evidence summaries no longer dilute direct name matches.
+The output includes the standalone client link, preflight/trial commands,
+ephemeral endpoint warning, managed-admission condition and availability-gap
+fallback. Reuse advice now describes relevance rather than asserting readiness.
+
+Regressions cover short-name relevance despite long summaries and higher-maturity
+unrelated services, summary-only matching, equal-relevance maturity ties, and
+hosted CLI output carrying conditional provider instructions. Stats tests now
+use a fixed temporary registry rather than assuming the live repo always has
+two capabilities.
+
+## Validation
+
+- `.venv/bin/python -m pytest -q`: **212 passed**. One existing Starlette
+  TestClient/httpx deprecation warning remains.
+- `validate --relations --fail-on-warnings`: **3 entries valid**.
+- `catalog`, `graph --check`, and `federation compose`: generated successfully;
+  **66 federated capabilities**, preserving one browser capability.
+- `git diff --check`: clean.
diff --git a/docs/evidence/2026-10-13-browser-discovery/artifact-checks.json b/docs/evidence/2026-10-13-browser-discovery/artifact-checks.json
new file mode 100644
index 0000000..c7e6c95
--- /dev/null
+++ b/docs/evidence/2026-10-13-browser-discovery/artifact-checks.json
@@ -0,0 +1,30 @@
+[
+  {
+    "name": "desktop-6-keyboard-result.png",
+    "bytes": 26622,
+    "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad",
+    "width": 1280,
+    "height": 800
+  },
+  {
+    "name": "desktop-final.png",
+    "bytes": 26622,
+    "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad",
+    "width": 1280,
+    "height": 800
+  },
+  {
+    "name": "narrow-6-keyboard-result.png",
+    "bytes": 24280,
+    "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8",
+    "width": 390,
+    "height": 844
+  },
+  {
+    "name": "narrow-final.png",
+    "bytes": 24280,
+    "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8",
+    "width": 390,
+    "height": 844
+  }
+]
diff --git a/docs/evidence/2026-10-13-browser-discovery/desktop-final.png b/docs/evidence/2026-10-13-browser-discovery/desktop-final.png
new file mode 100644
index 0000000000000000000000000000000000000000..91a204048b0770305733f1a80622eaeace4f4d74
GIT binary patch
literal 26622
zcmeFZX*ip0*e;sZs{=(xisIFYR?$|?)B94i)Kp_lp=zjkC_#|6O4_QS18PiFRn2N1
z6GP2YjWMT&2qJpHLVJg?`Ck%0~u
zhX4lz0^z!U@9skggdP0L_V=;F;16ZjvH$`(3AumwU(=wp)oJ$fvv}Om^~}2WYuv~G
zJ#~(~mG=zA8wQiOjt;bc43m(Pdn+z_{?0u;n4W(PO>L@aTQ~R``yxdVzM~?etgI}f
zOwHKu^Il9&^XL7p1-_spt6TUG1oF?}V~ybI@=M4GaB=bfT>Sra4K(_W1uAq8ncuKQ
zKc;V<>rTvxY_yLhm~lsg
zVwp=nO4{N@ea$AJH$mAY_88Hi3vGx-M
z^nmLL?;wyd4mXP%r^3CoO7_n@A7AU;3o~vCtx2PwfRrShz4kfhpBWnp?~Pb{Wid!u
zm^J!w>mdGVNW)>sSYBSDWbKpX&GjLPm!xD!&yMGE={YH#Ll7F@LeG28@!N+!lTsHN
zcO)e}wO)kQT!cU>OAiP8OB;f(K_74Qz$HoZad4Big^Z#@4
z|9TBN_zxkl%URM_^^NlUffJr*=?usLFIk&Sc`%3
zY{x_8gx7y?n|OKE8P+#F*VUPFhYxJ)=F{BMAtXR)W5Vl5cO-Pi!e86rG
zw_*JhJ=%+m*<3QX60Osy9$aWb5XHo%D0?%P#e^!bYx);Ke7%R9AXd1P*%qN`?_{;5
z?CQ%|f1vQ4Wi0GZ@$&MrL(dOf8!B)hhK%0wX*x{5WFIj@p2D}IBQ)kq*sMX&v7`>2
zAI%RMXclEFRt;yF!)@Tp<7dPS8}MuGnB7X3PrfyOQpsTT*pHybT+*BiM7=9hIs|#{nP~FG
zq0Drz?68W<8Y8Z5
z+*yh4w{i4}=969?$RYo@HQ#QSaywwR;6rP)`3n|Qic`T3X<#F^du~bR@GfC$*806(r*Uu
zzI&tQRo^LKSqB;=A{_&kG1#d3&zVw#?17Cq!mT2Cr`iR^HCmjcWVVX(DEj!7Jc!sJRM*mXDI;O;o(0jd`J2M(8j`d*n_BKK1#7
zhCAbDZ1obQ1aAh>zGPn7<+2JWgy*K~4i}n{sxR^M)gxVOX{YO+?TLCBCd7
zY$e_FX1+8;ugC>XeGA4&e`f8ybm|_`C7XT?9Us&e7@2Ok-x5mS)Q0@?_*i4fBj=v9
zbMh-AMQClgrJ21Xy`nmqJ8L!gE*U0lE5{a%Szp;bIE^esqZ5du~$
zLCWp0m<=9v`sPzH;eZxAp+F|cV^w=khc)uHCqt%~w48)&dylLPuWj+1byuBRh}Nu+
zg9@nz&J|Ks)Sl6neyi=gW)s19Yx0!_F3|?v)0L3gNmNuE+j^Y{Ecnlc8Ei>0m*l`R
z9lWoE+oofuTh`7tQ*b&Mvzo^>+%TJ}7i&o^qv5;RRU#pq`1lvtplhpdE$n=(Xm(#?
zwur9>HV(V&Y!GZsNIqx(_J^S7zQdb+<4?LD-KL3u!_D{A&$X-fmmHf^J2=k;!+74}aLdkYT~L&hcerNPC0Ycn^~EPm44Eoo7#`Tn9_mj$Gx;&U5#w
zkv_LDdQ$fjb}EF$>T9@afDyfi&3#mOKPx2HD_e8Cr1uS9l$+-wtYXF`u6m%b-H@0@
zqN+1a%cDs%F6n39T~L+!hWkBMrBycEq0Xeu7a=o_cPgF}XnDN)(>klRA}{AVeW|QS
zC&RCEwT6OKoIFYCtKC}km&RP-j)~+vr^5JR&WEC4TDU#XWvfarv2z^<}$`3rJ6g5#z~Z9K0UeWgx({zQ*npQ;m^$;@5{g@S-4
z@N2wNTChP1}W2T22aT?0upXkr;~~edF&Pe?fYgKgn7j
zdj6X`VZ?|rvSk-ATSSF1;C#QCifO|o|NLdCom$}OwK1Pw9TD(ux?Qj-jLOJd-4CsH>O1hQWbE8d7^xV&AEo!u`1-esu$`&x7#A`R`|M4HK*l$B@4bA}
z1Zn6@19eQ+tJrp)OMTyDWI4VRO1E@ycwF@BaIwjy
zfX=190QZ?^_+S{$&q?LHhOK3>>>_`2=mmk6T{T~p=Yb`(E$iTgwxC{l{A1{IQX9(=yDotrchJ1M#>G*#O=;mtEL980a}
z{sye3>f<+kMZ;89e#
zkXYNF*7mgmtD5EsO0jkRZXwq8LKOno0rR*P;p
zFKB@Phf%zzyy?wWPd`J*XA{`nfL_D5{1~dl^gPIpmIk`Nh6H)r>D8
z32$v@5NNzzooA4m$@ktdc-(g}VgIEG>HRU7QJ%pb#*xPwcOgag>B+^DRk)?C`)-VX
z_ekgDL$;Ueo^%fOcpujjbh4qI&r3JfexvX$x97|&#+l8B<<}wP41r`-c%_lzyU7NG
z@X5mVd1?g_WU0*8wc793BeA%+;;IwugZ>7}fnna>M#ZCcb>!1duhs(+zh`lIfz$on
z{M+517fHpKC#0lUmGXczRFWh#BX7%j$F>+X|FMxr-4!R!8NQ}|Sq-bCK(B7WD(a8j
z$V?Hck`dtz-oYFA&Vvl^K2gowRhuh66Z={jzK6#4yKk3NL`Fs&#zQupSo
zj{=z?PB8OBJ;3F1H<7%(7DxZAH6ZTC+%U;|GM`R-)i&tVEfdGnxl@;sAJWEgWp01R
zF2S2m$|`NQz;Y^JG%q|eWj|oqac6ZLHtn>%A8$t-4qh+5loc~TY!CN!#5AO~4|s)X
z+>R4Og^qiM4HbB2Ikn1FTto{0E_Hpc;T|U)ua0|x5N=*#;9>5DCpnnL+T%Ox5oNs3
z_qbvOXMeOG>B`U%8Qoo&pLq2E4gVOm@%d!gQEs7ARVF%Sqt`sfx)8jM@;-|@i4O~P
zBe__%9+tGS>wAWLCz2$}++HeD7NzYhP6gtCU>FJuJQ3;_VG)IeJoXb{g{=y>nQN`x0tvQK4M!2X^p2`?P3NFjb&ITW<;
z**7yWRY^j@w07<*v`ScAxE!}46M*2qd57_ZC#E4)Uh>h`F~@$iu#=5YZGT37F+aCI
zt+G9@J4%zT1S_&hR{wFoB_y+&&nfLlsQsjWGlOTwo19J@DX`9;5HKln009owdG}^A
z6C#L$HmFHhFi*)JDHKcbvd?lFkSo2|bZD;#rWLF51f!scz!7tTDSS`*Iy3*;r(^RE
z``mku?@oMM`getLq494!O@$jDl!DddXxLM^fePlOvu0AJUm8*5iRu=P)W1WW1`6D_vp2BRzC9u_^wy%@;}R*oN$ao6gr<$!C%TV6Y%7!4@_
zbziq1?^+`YsZW{q?MWK*(M77{2G8y6W?xpnXnfU_KNjHjC?!kUmm(b1Af0<+k8o(?
z%~auzTV>nPbohiXZhJSE^~GW1k34QWwobV#Sw?3>_naH{$Dk`gNis$L>6CphQ7`8~
z>M4|oP~pn+m8|vGrS@U+!{d$G-CsSQXuT9LlPDx-vr(t>eKKFpHi!lw7_C(~C>mDl
zkHf45ij`Ke>3uS``&SItv(8F`k2!t!DvG^vqS0gy{@W8>Zl?KXJ)?ZS5DKa4tR+fO
z?uT&aS?P_i%s3a(d
zDE~LvJ;G7!fo_FnxJ1G&)=6KJb2ZhQHSi&AI)%U)i9h)v>)n}3omhSm!;@6jg~IDc
z8rZ_i0G`Z#&g1DoIH?n$<4Xb5gk(hTcD5m?Rs3w{iGdwQ_bj{@h6zZ1}Mx*fBi
zakPOmj>uW@dR~$^?dfCN{O{XKtolQP0xoCU3F^q|@P&}I`0`4A#Ee_DQB#a^V98Sp
z3X>DYCS_I{RG!<6^#xED3ZG<49`dF||FA?qhzO~$y5n6-70wrCmt!7wgxK$8A3l+q
z9nh^RFj6c8Rj2P9g?=j^W~c&Ard{rrnhw$8&oL{eaCCyYG=*iZD0`s`
zbjWD7BRoX;bu2RinO)0#8(EH6iNqpk6Z5UnymX2!!ikoIs#XqA+xdR5U7_ZQAEq5F6NXPONn@pihN>n5zC(cK5Feu0ZnxqfrUiYecXAo8wNIrvVs_REhn~*2J
zKAQ6PR%rsLb`E~60{j#<)MsUjA|oaA?wkxRXy*mU>xhBnxjV<{T0O(BKGZWGINNe1p|!wpd&nHQg0?M`G$Knyc#FHM~kS8Erw
z3K0FLg--Ekt6rFqqQlfwAxr4ucTD_9TaFMa>#65k1LT>vOoqai%h=d<&
z>ILX-<00*BY_;31g~>3PwSZ5))GU#C!M{nk6>n9Z_Ns8(pBGinzL;mCG~3)qzx`Xj
zkwTtWiWQXBeGI>h2Vzrt}}V3da}51-ggXkercdCP6iuIGSf(diQ7bz9&^};D~;PlH>R$
ze&G9rk2k@(%K}%#-MA5xg3TdPStX^QifcondT#^XgNLQ!89=C&{TlOZ>CoP{(|wa<
z1RC9$c*B+#dP=~FLoXS$$J@4^pq`o74Cqd8hzB;Jf@$;8Xs&=i;#sWO;f7BSGeVY0
zAN%Vn$C>Rp9InK(FU?ywo#uAtS`h*4X|?{|9TaHjkRzLa5UtZ^wcy%JEHM$Tz8ZuyBNA?N{3CYu}
z78sFx=8|QB>wL(E0}p?|HdZ|w-{dStt8Oc+1?0~Za5{~hygR>hrXN!ir276(Q>=6w
z>Y-cCX|W3c{+;^6{9H1PvhtD+$r|#ooRBNnv$^G!@ba
zOi70*4_{;O%UHk^Y-%3UhiOKy4e*^h8Q}q8-mF~QpQIVa&AYk(YU-@oR5_QQ^MFbC
z^~{3ipQ^^Zj^6hM>=l)@Hyy$<9!uv|wBL^L7YSb(3E0uywb{S%cNmeI2{$xq&tXk>O5)FPqWEd`939E^(^;;uj6`&@xbV**wt@qXDVN?9THuk
zGK1|wV7`Hz5ET2?e&6JK~D4@u&&KnfIbc|D2N3>Ty!i8Fq%XBa=Fl{8+E)2rpHv^oxR#JQ-)}X^!JCfdc
z)LWHMYOT>k@1?5k7j(mrtC)V_I@vss#Aa!
zVWx}4|EeK}FoyxTuenDlu47Fh?%kWE!Lc;q-OZ({wCgp+n
zr**gBvRT!KSQ&a-2I~UneI{U_tLIh(azg$*kh6SQ(5idbp1G5AoSn-h7`}u
z=}hh^SbvZ=inZ6AWzetyC{9k)ZFpZj;6yx{70(j=TiJ6kRNthMD=lwDe0mgfgb_5+
zqpP5U*jQJMBCCdmY2IGx7h0>Ax;$Hb8NEHI04X7zeC|;8YV{ez_$buBGx-X$zSQ@O
zjb9(@szHVT@}p6HD9{jwg=`*+zOeCadP+d~HXm^wtaYLoRYXq`RT^r1BWgwSdOND?
z{n_@_kscI)ifn@^4Vh>8FLq6egbEA08}jllXV!TsRBtOi{LRLKd2T$`(%9vo`+(Z-
z-M|{RcGveGb}00&-K;MR!Hkoy|@Co`lVppe?y3j0Rn5Imo#`ZUyn$SeX
zp#gn6`q{qUx$adKoBNc$QrD6`X_`+2y|Al1-+HY5ShHiyQ;lGHn#qJ+$jr5Y?|CL=
zRtldec5MM25mB)WTn)B>xm6z=PGkj?N1BRT>>kiBvNIs0c?1;~zblIzj|0soW(v7h
zueN$Q9b*}`u`?kCg+P>r51p5@DzZ@o;)N;ba#BXFqkOhRQxT`VUti>z3iq708nFwR
zZy9hDdlG)_a=uYP9estf%ca(Ys3e;QRqm^bVnf0On&$@k8+7q4iAPwi}semeXM*;
zFNMpwhi>{J$(7xG1EW=8g&lyIMlZ+eJjCNF>cqRho+NppR~U)#wcS1>G;|XW%N0)b
zU+ftO#kT1Pm*N1a^$2RwAu%Cj_
z=|d3ZS`UBT+Lbq?vDdyssaRCFhxZr6-%7|R{GAidZUk~veQ
z&#oh57@og>p8^f4IEa3Z>U5WnRazguIawtn4Pk?Ll>KF22@82~
z1OoZ{)L-_%;c)t2AkY4vi~ns6L|y)3EYIj<5apM!!}cK7B`n0@4<}plOs|W03eE&k
zhvG0xwP*|F2Aa>7p;rT8qrAKv?$vO8;%i1&wh2`vJa|8OFAFgc!=nEF?0W_)49$D;
zCYD+iO{)u{h7)U!9
zbHew>5J2dJlhAs-ZVA|+z2~AWNQROdfZ+}jBgNL209BKlw9Cb)@R@xnn`fS)>M{d>
z1dpHtSvAEu!`?B{a9P>j)iMg42oZpF$ngEC>VMO}$E>tN^)2@Sd_rCp(OvQ-)eiIp
za4hs!&Eg*z8nS+pzf8#HMM>@uU*Ez7lKnet#ELg+9A0*s-gG
zSuN6-7?fq9U#qje;8|&_1rh9HK({!+nQ~r_nGE`MiyK(Ke%mq^)?~7>gV0fy(rwW6
zJ49_9f#UKaV@{%rr&Hx@YCVF1RI8VC{ZWH%Yfsqk?&05j0NhiYk(dxD%C-A!^CuE#^!N!`?h}}u@hAY`6hKt=vIbMY;xwinL
za$eonZ>Vj%1+^XpE8+40Q4x3(V()*fah)d+kj-5*E}@J)F531mXR*lee3riy2A>li
z!Q(Z3@vlGpGA__(B%xWpoxT9KSEzwm>XxsL@YYy^e9q#@mGY|T$y-o#{YbuP^*&Q9
z@VYT$+ht8}KaYC|3IIYw_$ps`N`E>PPW$3-sJyl#C`E5aZ4=Kp2M|@`kkEcn7``7R
z&v?!Aey@#Z+*yl&fr#)3xK$tAjQ^fDGaer@h$Fn@tKEJ0@Mv4DYZ2)z}q=%>r!{YrUdf
z^WFVk$qQa%Vc017>5Y5$1{@w_b2veRH#1B_rYuG8A+@-=Prlrx6gN3ENq{
zRE1=xF^FqbQ~Q=GPW9TL6gC4D#w$os^Vx|r>eMBnS@D0`2{Xse6r>yW)h;ahe7W3J
zEv2L~abfKC1Cb*w#u5HfbypU?YHz#q@T)1k3*OF!Qzzk6u7YL>Z^YE>nz$E8po4-cI-P1>mXyrhG_kw6$kz*ISmtUlc++kieT(jYW!gX@f-y*hW
zD7nIt>Vp;$kltlr}fl
zRKixjIjox7$gf7+6eQc#Ke->{mcSx2#ac4c`n=U1p;uSflpIh6b`_5oyXa!jKu$z+
zSX~3(_o;R6N;FpmUHLquMA3%r1k1khi^FV<)px7$eDbrt_m|)~d?Mj%@6DPP^Q_l+
zw#yB1;Va$L3?g-U4|r78U7#?;Qm4h-8%;A(ULbWksI`Wz4nb?mj{_vUaYw+c{2Bwt
z*LG&gXHQdfmNB(G-9Hmvi{D<5k`Z?TvWUg=P7N+_k~
zsOE*Rt!3;(kj<3lmy?wDxAb#L8gYnCH*p8sko|N~$`dE1X!Zl4QPn3Uzqu(qB-35n
zn$0+(7yM5$asp{7yPG7PD*M!@oy{=vurp&tMjFPUzDxFkX_1R(RyLUw^)QOT4`wO)dsX&T3lbHIXYN?UG3e3KGhuSyJ`pEjujTrIorX7-y`Ivn>3B4h0tB>ex>Msk
zz{73GR&GuNK<~&+Th~`Q7aB`T(^|COG5>rlMy>f+k9D{s9(O3Jhti#0r~JDU94dWx
zxtbPNyC?9yAK@K5s8_ve-z*5Kf$pJAW+Zu^PNFnh)RYe#>GR5o7KaMk9W_x^L#V!*
zgsCy+^1b1$XX=4h=^jS(G=ef44R|@mAjRN#UGE<1*&|$D_A5sThsw-G!LE|r_oAPo
z@)nteJ10n~*i@_dKA}&f=>FniV45?}Tp=J8bmbdtB;b2$d@7J2PTZRaB
z_p!#)QPnh1y|?MR=_PEhF6jfY_5|n0ka_Je-IL}wzu|zcA9<~Xdwoe&9!N`ndSPm(
zF#_D;X^4P5O`a(NRt**T7jr+SIP$~lQ$9Np=IgIFta1O_8T-rLvKX*lQM$|NLK#wk
zk+{S?BQ47Wtzy__)8x)f*3-T;MU8|T5B%|wIr1|#1`N08MSVl{*$y$gAQ>sgo#nc`
zr0>=5E}WIHqM>)NQ+~aXxwtyj5Z3AI22Q#O?{0tSyyeLqw6G=!Q1fZe4=2mLs^{vF
zQSjz
ze=+9*;@4Jk*}OrXb6*O@zMW6Ag3|Lb?u{6C)1SqBX&MlslHo#oPL02H)@pA36=g)@
zn56t@+2L{80r=Vbk0zm)wNEQ6>R~JadOca}*r}x&9j0{XBhgUdQr1iz5ag~e5L2yr
zlVmDVxphhMCFvT4|+J!T(IdpHWmW9yC;Y-OAviUQBE8YdQVRu&FBBKiU&+Oni{=B?m
zN^`%>_9*aljBX5_K_s{A96yImkgyOAvn2ZXhz-N%lYqI)=kcWGfxhIHK}?%eXP$dv
z`x-BAIlT9yI@v1ms$+=mY-1=O=5VmG-{*oD|KN1>T`F
z^hMR4n`)#Q^X)Ftq^LW4Ywb|2N0l+F_K<&g0a*I}mTN~6&=Kpdzvntkq^i{}*UF>d
zU+&Gm%spcqIkb^=<-Ko}
z$ZV-DE_|+Z-Hrz+DY+>=KbD=)Ha=OeLIb)skVxo=aT~t+Qu{mdKBaM8CIq<0a-X`H
z7M@KMl@0PC@`|c?I>WktRw6~>-7NBLL{*S;fkE7vk2?pQkisR4=5NhyZ|z|TQMdm9
zaA3d%B=sOSZsM7|UjXf;(T(MX*gKmXj#j?QVy*-y-uU@~-`Q6Y2I~HZUGLYJ0a)Yj
z^^tPLA7*Y3Xt4tFKPW(JGcULYC0IAZp6y)o^v8Gc$0odTyan28CO}1{PJtl>U5Aa)(&%6ZYM6}$j$q^pG8uCmXwu5%W(ItIw
z2Puu?Xg{mb$8*$X$GbvjQDTf|s#q(Cndjaw-d*`#=mezWA{Nq;QdG0h<1ub7B*@|P
zBN0xj3`{cRS{X5@XxFz1IQ=wQbJRC|=H0t5r}I<+5?BT08V1PCS0Y^j?q)nc2_2eN
z@&!3A&29J~^_EP1c^@p&Z3pD~TcCH1PkDH$+vTrH+A1C(-ENir-NiBkovLvbv)%6e
z%^*v_@2e9x!xVH&y`x9?E=yZhFQr(E(6U+avO90L&E{Df#eWkYChfJ&opucg*}WR7
zJ4Ou`l>Zq#q@Aq8D{XZdeO?U~KU@1>TtFyRRMBO|F=AbZFIM@%=d|qZLysprxQ{@d
z02iryErT(1yS=r-Nln_9zFEGmGMCeDlCD@ticOVLCjGj!$FmzS_3BzgxDdUkJKZjr
zm=$M7J`bf@=4&U+*v_nNJ7SC-+v0=;IV#!Ib_?7)goVi7e4h2U=C2APM$Ld9w05J5
zvNFP5k-e#$aASsvHcMao_MPrnXx+5fpHyr)u;ofw=u7YqoAjh_n%SOgVEmds>SQ`L
zDrQh`Z5|tw?82Mmf5zZJZ-NB&-6Q|e^T}wx5jiLn`WqEUXTHq$=E48o^Tt$yt|#*y
zzZx}uzAqXYLuS>Z{Xdk=Ewz}l|LKE1i)LE~k;O5xC_aB<_kgNr{c*6ceWoqm0azfZ
zZ@;9b!xbnWQb*b4
zSv&T~l|~$bJh}{NaegClZ(hvcDX=XZxtjl|&~GKr?{D)Z-7vl}aWB(Z!GAO@zDNdjSM~95bO413uPfCaBy3H9i%`_I2(kx1n<#tRoGI)pzzMD97FK|V3T~L}^kDyB0
z<~{lRw<%TzqZGEdy7BS*Dw??R)pu>Gruj3bA*`p`RmMXaaST$z=FfH0BN1?>;wqS}
zMP#zh%=T}Y!dQhcKt5-NG0jLkN;_#i*kI7X%3q$Tp5R?+(6_4K@|E9q6aN}zc{)Q=
zQFbC|qXM0~SACZsrlo5eej!yB?p2k6h&hg50tD&>hRc1o*{`kYjA3<^QK_>zzou_T
z((gVh!>RS^kxb_*U`p+T(ze<_@{kWXYmQTyCBe>lmbOogjAp601n5b+94nd)9!&Sd+%p6;1M_7jk&$6t-GCPn`x7LP#Wij{0aNQ
zamU?#JGWusv}G*OrXoOTE`I;J0V;S>HI7f({PGCdDm2r3(XhsV;z|?ncR}We1TiAlseH`CJmUz|$tW2r4|P={y&1J~
zTu0w>#WCemDwV1P;h)eW{$>L$@Wau{Bp`fPWpd)%L(PF<;ksWUtpCPwDD<6o9=cp73_^E0VePz)IxVEVVRqx8LLDb47{WrlMdK|XzzMNpA#vt$iy)zDj=)(d=*;}%K04A&d+|7-q9Nepr`ES>TntKdA;FbzSr+8QC*cr|;F6Ev=
zs+#c1N4|`J!CmK4VA|1eVvfRvMdTeef6r!lS2wf(*Y(asL+4xdGLt=`G_VD((JiKV
z2M0joQ&$v*yh->tAzayKW=+t!5a3Gm7%x2-0=Uu;!uvn#+Z68G>3W1yo(1Z+|`z*BGVl{UznI
z#j8Ye_<@yaKGg%~Lst}~Lqn(2p<$CUJ?rmtpj<~ICWOQ7%dY14N4eHml*OCIsZ+Z8
zYeNyZtbSD3a&PXQmCL|?9*Xq_5!hmai=ChUUl0#DU>9Cg+WS;_C7LgcSwWrOdq0}{
zh*YCPcBQyLD>73)sls_O2ah30c-zi0>ZbbMH#LGI!2D+~UJ+9ZLYLdxk=_^_JnzSfO!FlJMH^jcm4w
zjP%6Hi^EM)iqwVfes#$S6$dSi3s!K(wf2fPrGGCZ`yBf-n`3u8F3kE49CUtF9ez=s
zFo6G&L8F`NX5R1m?;(JH&;>eLv>#?T1*%8)Cc;54g>_QdU-}5tA_Q50c=KY>)HWfXS>2O#jUE$
zw_PW1y6;Q@zB57GyxcE)GkJb#QQC#|Z;M8SoX1R0&KYE}GwsJur|#8H!3$A*-h;!-
z+wR!c{mIZA03D(tgxp~kXtY`P+x7j}R0YMJ%7>Aq#J%7AGK5c(wzmuH7h}K3ty`2-
z>f1HP?0y1OeQsICIkK_7Z(eD(*c%uuWb-Xz`)#3`V`rKz%)gtyp{+d@bPp4Bv)%Xr)Yhs72jvWXE1}}~bLv?O$AY~AusE#aLM&%$*pbkA&6!WgAT9Lc%|26(g#UR+&HG!VG6S{d?j
zrvBdUe(|^7RF#biN>oKL=GkWaF)-aGaOm^hR2(_t6!i{N&e8N2!gGA<{iU_>Fy`~P
zOJLAWDb44eUoVL=LE|&Dc6>6ct+P;E@6OcK-?Z>bDZ7{ay3oFr@ie-fYO9jz9mEW?
zCk)fTvk31k7@JA&{EJGdrM-_n^EL&#|EgZ@B__qm&3rh%uRS$>hw^#qN}jnQ
zxsYK7i=**L3Jk%g{KdZaCdUhWRE52mAcccdZ2)qdb~7Y~W*w@d9Oj^sgJz>HLQvjfqzwAMcihs9~NwW)0hSn)4-0Q9rz9
z8RW7RUH{q7p4-&wxYx5r*8n3=)}P#;-_KAtH(<@p3>&Sb=Oy)SYO
za@w8JI%WOu@?-XtVJVmqCB@Tv#4zRtVk!c|L%-i&so0Mm$L8m1Qa(s0P|1UJ4PXcu%BA|NtgSres;
zVSO*DkcQLBhV5V1B}=#TG4#R1FP?dRKkdqy-RueWJXymE+_DlaY1ZT-(^j1)^+IK+
zTggA$st-v$xU=BLsvY|L>yetv8!z{5
zj?X_Ny{xeMKB0+7J+%StsK?7#JeR>;0K<%OD9D33#{0_4BYlrbp5&>zGw1%}Ca8SN
zNK@so&iaEBcOmD$Ey6tb;c`E=)@;Rut8jf_zO_XE^mB)9apTJf%I-OdRZ|7scaByg
zL{?X;KJimD1Y!@5mpMFkS^1o#QRzMA!H+p}_@>9X1YN#dYo{DxwsvW|l)!tG6j_Nx
z#x7x?rLEV-u{5#H^r>l<$Hd#M8O^IF&dW*)Crh~O?5CIuZce`IltJJMz3BU}{P6z#
z>G>ou-&*6+qN{xF+RZ1cTOvq<6jg-p;-lWrb>gAF*0!&&PFHu8k8`T6sCmqOz|Urf
znCS`C!+W3l^M()aV@p($`Rv(bJS-cY4QSA7dCn)v!}_wUN4t~6ur3WzhNwF6ded^F
zne}UC-MpM6Tek$xTR~gj6dkYjzX4AtcoouOe(Ln95P^iC1r)PziiNOTGr4y)I}5zU
z2-)@TIdzPU_LZkfHX$7wg{)dfo|;s2hWtwG0KNFnkwSWoTunR_8es{lQL#9|E
zyuXacd%~sTR~-BVr*wL-<;VDN%#zFsy${2X3+^)$BLz68Ud8AqQ#J|v^VHG8`k_qt
zaP3B}6pDHC;)%+MY_~cYt1uj5>RJ^>@QCI>MT-+s1=eD$V@KVseoC3EdgbR!tN!ky
z@*eo_2wp1JKgDV)P1jg0+xCa}(cf+f8hQrL-sa%rLJ@$Xj2$X;1cKsYe?mQ~*
zMqQQ9biFVmc*I-L9Y>E&v}Ja(6PPzoI3=7N!
zzJbQTd+cC0s2IT%rCG&S{dCSGUdhk$<@ui^dA}~^L$~@vwbsny!qvQI2Z#TxZM1_=#^+
zQ$CdYUPVr?-N}q-zR`_y;2c~zI0w1>Z*E-yr>;KOFH(DZv$cg%5F8B}R=>H`o(K@M
z_bP~{GuKo^O02ivh}hP(>AZTK>LzVje}kg;RATU8Ha)m!^PGe~q38WJzZCSnTEOVb
z2QoJN85EZS@J0p?7?^y03kJ7s2(&3h3)?WG#}U+%R`m+R=!f&fy|F?p!>fQ~sl@Z@JxNOV@0cJmeiKsiq0?_s;Rg
zb&>OmzB|>q{yeVcs^|tIqjLM1Jt?K7j
zU_xpWF_pP1R`($77K<(zr&RJN=Csx(>e)Xn2C%fxGCDi3I<7Zzos0cGTi?w1BvB*Z
z?`IEc1@6PKk3cr%^5eS6kVh}6ZnErF0$Y#6)!;404nC`&Y6v*0aS}?q*n8LLmKu6`
z62vRn(W2s7ygYUgFM%ej7fs7R4O7c*PFzk^Z$X8p54-<<)gWNLvfUHBEW!HW*AsE@
z^IQIJu)y1fy_^ZXtKe)CEhNtU$0zs^uA1Q1OTFFN7#1
z5qf*J7?PHMZ~Q-sC@9vQ7P(LJ(rXTf`cP6NVY#O_$Orpdf;WjsX7gd@)q!_^l;Dpw
zUN#u8jn%Cn@X&$)w99SUaUmyx*E+mL=rQYS)>OP%!+%Pbvle-F@5ov{OZt!X@blA-
zzsc@i)zx4UgO|}k?ubYv#)jp2k^;lZ@I69D+)c%AEjHx;KOrNAW9#NmLm?sb`=FbK
z$x7^Q<*)y*CCKm??-mYdrx6U^A`=bxZ{zog-Kce+mF@Vh+ec-XLLYGrAvU*4C0GfK?86X
znN{nu_UeXa<#ht)W0gkB!S<8`XVrJDl4*fkULllSe3rf}qOpBGgM}06=F{fZ1uNfxk@|3|jg|JF+tB`axDP6MR5D|{Efz2oZN#g4^nwH=M-m3~tx0c^3V%mRr$9syqPx(vkW
z=d<2XCjGapN{+K$t!IaI+Pw~;}fvAwY9Z`+uVk!-{aV%xJH?03gqNED`ix34{OEo33H&}3O&0ZfyF
zp)L}>O0D)!&lw4e8%Y8px&;n%z|*r<+ua8o7!P7litc^j#STFFsIz~;$bApyge-yO
z9gN^a?tqC0(9<}4)ZW&ZVQx-lfc{<82iNeH_u5%ItMZ`EM$wk`cd6$m*pTl&|4-vi
zg&)4_Ci13V%($~0Frmtc*(wCDYyl?|wAvMj0}zP&$>+1u2lgu!C~SG${T*iWtIS(I
z2?35WUkLZD?Li`$F_$V_;bxkwz$w}?{K`$b^zt!ANC852Yu2VU{}y|d+<
z-U=(fN2$1QeOL88znpkyRM4M9O0kMMe>
zSM6$=Nt|s)90_SrrGy&A@vls49%r7Q=?qr5gtfs#EWWY`ufwRxm2QvL0a_*>tdd
z1F}`*p?nJPe;5EufZB4cH6e*OT)^w}DALbK4M9i-iqTyNq_GxEz?r8ix*LdpO_cl}
z?VWi%)ce23b*j^fI!G!UN2N%#NcI~?b&f)H5Dr6S$sSq84AUl^WNAURaiqvP_T7w<
z-7(2B8M|Qy!wiGj818#Izx()|d;j^}`?$Zy{p0@nGk?hVe!lO|=ktC)Ur%;!_0N}9
zkzb4%*ZS)X`J(qL{U)k-+1vJX=lDZ64$!Kes3MS!gaSs4#Wc=Ow7%FH4TyMBT-g{T
zKYBGohIA{9)WxEgVlnAYju%0zL1ZsPV%<~#Q`4n2&x>Ou35)Xkux8rSkKHdp=}Qf`xX_zD+M}
zS$wu^#)Tvqa;$Q0wjfGI=h(sq0C_hPOWiF+iIsjdG2#j54%1p~=YbFE{lcee
z1}C5Rbn$+IWu!7kpS3c8BxIglJ??P6i8j1>w2YT83YicHpJG!nv$fE?X_RQk>Z}R-
z+&z@76Ri*4LGLP@wtD|z1MXpqS0%mE_4+~OWV)5}S8HKNnR68n8Gpia#dB=sSmhcLFGtIdrs-v_NsqXc_jAMC
z%8UxLH~*4Jt}iFjs
zU{I0O&+tk6MnMD@vVLfe9h2%pOdx>(V8^xe$QQ8c;mIt}+V*C@0{{+AI%VrZ9-8Lc
zy}7-iUlp86{k_}jL_~7Wh&ZD%C64^xZY+NRVgI>gun?=wS{5hVMz2Qt;}=_>bKnUo
zkzWO~r}UM;X|3r)F&qx@*rT0
znm!~o^y#(3T~KFzkhr5@0?;be;V@a}Kd86ag%M>6&F1`J?yKWZB?Ju>KYt5?mby4qt8Rx7_X%~cj46gSkKLkFg
z;e1NRAW#qAY-IIhS*tF%F+Tn7g-0VP$6)&wc&@y5zPRVZeaEulwK)?T8yndA-uE`g
zsoGNC*i`yDafS#m?8=8!>cu_1Io7qlU-HZ1^1Obp>XXe0Cz^!W5fF<&g~31@|C({|
z@Lgb4WbD&zChYc-#ETy{g>OvK^$&IhQIJ-y$!BaUlD&{*7N=&bd|_=o
z!drCJzuRoMMuHGhH!|v|0ZdvyBov~WbYYq&*d$J09IJQS_CN~Fjx|*Xp#G6Wo3>>P
z7h6*xM_7G+v}c{h4G1RJrW4iH2j*W<+&^1zv`H5E@j7Q{AA#&$hsy+d<99jv6hEFS
zj6Tu8(a^WoDa0TGD0Z+Tz)YPwmx-{eaGg)*3`m+Gdk<)aOUmwXlzE>nJS~uRe%oZ0
z>lJmBq7wJ&M@IF!0VdG!q_K;X9O
z@xW2>EM~5Sq#(}*Xi%Noc1Hn9q&N7b9$sCVvNaPGj6N6GGH#K>G%uuT>0nnM_RDXT
zYEG@jFZcDEark4AN^%tk##_R%=mQJ7uy|wFvj>YgR^Cg?48e|U1if3UJz#yCy3_QN
zOax=GOEU$JW>zu{kfk83f@7r1=DS&2;*Q$(f=U2hShm_Qo)kpW2HTPD+B7>{u7ZdQ
z(O>4@m&UIxmhO0BRz1fzzb`7mEDu~Teecu_L@>7)SB)zy!r{BL
z&PB~Am>O`JW!-T$Hsr@Uo*BuYeQ+J}HTk`~K=0PNt
zp@hZIfoZ#-*HO(X>ozf~&C)t=Iv(lVFcylO3J=8
zk&)9OUOEAR#EWwfs7$-Dhblt~@~)zcE=o-a<6vmAU*2>qz?}^^#m1WDc`HXBSPBnl
zz@o3vzTtp~;OgdD%*y<^-N`4N$N&|w2T`1lt69tubFQa3!BW?WJLw`#C?dbrJv^r{-pF&5hDx?jfFsS!p>Dr8xs
z0GU2~VVmEMkYUvcY#z{XRqX9V7-JTi)K?8Vy+BK=*|V+?&XDYbd%^bhK08cEQs`VT
z#|11MQk?GqTN;LDuM<4;AV^=8L!NzGZ<%^n)(kUwSM`LN+fsJydtE5TPxtu2f%!xD
z`ra(JiN}?`6E$mvG(<4vzPYH_bwgJJTKDxFi>v~C`3)krc6M|V1H@E^D0{cW&ZY82
z#qJukp1xerQGVmkH3vDC9A_E{)W7!pOC!owm)vW-;|asIZ_VGu*rYG1tk5*d5BKC)Zg-+}
zJESD`Tn_m)5;lwRDwfk)?}8ayoI{GDF5Jpn;dUI^gYtlV6?OU$PWiUN*`eRg5g`0cH>GAPW
z>7d5kzN`Rvgzz(5t{8#Bc-y~v*{f>d=^ARJMY}XxGaKPf2uYN$VA}5uA_*^Ml}mRK
zeDRi=o$!xcI6wZ8qso8F!Wp8eeja^*exctbC=CP*Hqevwf4PVXMCv?f{DOAr;5o!E
zY}X?}pGpQ$T
zu)L~dryoMkGUwQ13pLKJEF!bJsQ#@r>qt|R^=$7#)boNg2>Y@i^pT3@4SvDwqv)%F
z9!dVD1jv*99r0=e)-wNc*01N6LBr!iJ)oJ#R4n?kIR`=8_Q#16Ualu^u}VbEcD3dy
zI5yUvgu7a3?;FkVkDpih5hihmc6mPA@;t*?ZaebyhfWBN2
zOEQ|UA$m7PAa{)Bp2-{gVF9jJa9x!06h@*9fF2rS!&#ouMeUXz<~oF|t62LTfngYo
zH>wb;XKJooRy6u?xNfCbr)=`v$6vOL>Il=eb!m!l
zG)>yW1MJ99(f~@t*gJEUp6hU}(18XFScAZBwsiUE#%<#SW+#pFIqw$QXatU>rLao(
zdNE^=)X|_~921vH_c^YVS$8^R4lC{LMUR4!!;K&<+OLs|pm!vxVdw&)oDlLloZe(A46(?jq9|NN@hHXHmNTSloUm=uvVl}7
zX6TB=qe%$*1g-Ruz;@9^C5q*|ZwhMyL6k%hUkEo@if)o*P5dFDf5@XB4yWivYZ8T6
zGX`Rf2+N*+s}Ia$;v>f5#|}{
z6@G(>L_HR!uNcR1u?_e=05TD|s3GuMl9Ckyp~i+4hV!Pj5HZ9xcHc4Ph(k-!c`8x3k}t$8&Y4
zkM*!8-?|hIt5`Ta#t-^f1wA;nMDGq_kM>`g*O$z}K|d
zt2vqH3WjVC8W^%SI0YylN57vDep?4Fx6dh1`MY;)wf^KV?H$+76n$N_rOnq3{5)j-BMI?{6NGF
z;!#1-{T+AuI@=KiK`liST174@F`9v!>v;>*))WVo8;1|NNq%J!Jux+f8E=cP
zK7WQJC^Fi4r*EAqqVQT@kVA4gN@
z=#WHNa|U!PmocIuA}cAyysz%+|FygNzwr&e|3>8dE&m|g?oq>lvarcr_;&=pM&Q3{
z0RC0?h=0+o@$1L_2ler5P5fFD|EV=`RUZEC!rJd)tPDu))vMPbuU;W2ynh26SwPE{
zef0|Cl`Ke1!#nF_?cEm~Ju<{|Rq?mDxbJWga6to5DD>uGX`$WI3$g(1_Vn^HH3^Cc
z3rqU?mF`PZAZt_%WBqq5ByTV}`oszFXaA>T|7qeRW^X0-GZtn%!L%F*)N4$I8UGJ~
zEQkt23JdeYk9ZL1jmdxaA+F-L*u+?$2#7xs6Mw=X{vJMA$BKnXt(@`6#$(#1WM+DL
ze!l-li>0`vbjDkO*p-gk+&EB%&CF5B!t~74^xV|+{A^qpozF+K50AtIFnYGP@TpFj
zR3$-q8Uy;*{a~u#;DC#(i_x-5hXl?>5QsiLv2?7(xi
zk71C4?;#b1T-zk3?;fn=A4de#=)05t0V}HffUD`XQgKYP@G!MdK~K_mu2zvlEo%Ne
z?S?%UtXaI7AW(UT4=KXQo!V14Ln9^1
z?)BwSWk?dW+WY#`_{UcqGT``|Ao1<4b0yGlaEVk#9(gY~3GSG3d=a>;d%NbiP}sRkxqzdL9>fHkn4$$_ttb3UYHltrTTSMTMz_p%ZU$LU`0lBo=q|HvI|x%s
ztyAU$38b#BE;2>S;2~P4$0HX68cuJmrqYbGiXKa))h
zCZ}I>dRWiNP!#OY`+(Fg3W6hW*(13c<$|XT1e@+)yQ43KR#tzEp64gXIB6$z)@vk#
znrw7hO5a*(k>{3X7lSSsmd@H`a$~BAlnFWi>ArjElkV7O1?EDInvC5W=E5t1!=1wp
z^jsNGk`Q%l%nGZ?WVP{2r}7Cg+w<}$?Q}D`eGVexI~!YDEjo2#d6ph+ovX9h4+S)Z6
zzub2J453zNmD@M*M$IJN$dic#>bAOGmSiJI
zNc0sLW{#1M9=%hq&}Lzzen8;&e1LURma<11JiqKB+}(xSASh+`2v{rJ*>RaY8B-_h
zq>@7Q7c+gq$ppiNh7Ied7jO@H>gZ1S*js;M$TS|(I(SB@blAXfzGkA5BE
zwr>URut}Pta1UC7Rz|@JGHQ70M%27iNx1
zrOF&vQX3na`7$*}mE3WMOx`%NgPpcY54~q*C$*1>Sh}(V?tOZSIi!=7*q$e8DgMv{
z*hWl{T0eBH+oI65m}#>A_eB@N7W8nM2aQPH3`WVzc!^jI|=%6SlRl1Id$NTws_LQ8NR;FFqfW`ZM
zDX_0J@cBVA!unQ`aLwp&Ef3#$XJ_E_F{S|jD>-!9=})+@T>)un=(E_1MyMsK?RciZ
zG`XGSJ%v`s{$#nVTZ$R@OM|5y={9lpGEZ{gG4NS-3Iv2IySVxU+i+>p#2#(bDQUJb
zhx>^JTrAfh&^oSvh&^Ff$G4oHnC&#F?)N9RkjLd5%e@Uwti*XCbZ&FKPncTABcsKy
z4FTKd(c_QSel*SwkXA^A(@
ztk$XLkn&b3Z#bULlrF@xng+Le_O(1)d!rExZ$E7+E(X%SlU=W-YU+#4ZF|x_i!Wu>
z?;GG5J5v61ADgl31@cELRCPPuL8BUnFLU>mrl{ddBO8rV`iJDMHfjx1(id2cbTObs@FPsrvV)R#8Mu
zMp+zQ?@W~v0{3Mfi-CIb`;CJ6pFFRZN${y2kH$lbHT9+$c>f{zz-QQPk98&O4!uZo
z#uxTxNXe*oNTLZcK*U7HM}W=zX)fOMb?w^Zh1-sht$yu8LmT#vPy(dQacty~hgs6(
zJw61=U-4l0eRScB&gX}6cm8ubgAbLYkj(-AmQSC%vC8@Rhs%QQ-Gt^HOxbNqCaFHd
z>spu4z}@2(R+W;#jZJmchveQKa}B49lX_d**WTb0VgFAqZq_TVT=|p+ktu8=!mz7{
z;+aPCaU2iSHMni~O(V`lNTR5d#ewwiYL}wE0HPHcNPE?Erkfks;dYgM`VBs%ufyh<
zMlx&v;&M+M?a@NTch3$SNwGvB&OvlB)xsgTE^if4TX%=|9G(U{TfAWE)Lyb%VRdK0
zHYMZ`Bh1=PW=a)aG!Syy=!9Nm+J+@Hh3j7LP>H87=-Fbc3-N;7#EXB%Bz?~?274<(8c}(FhJxCP4L8D7-Y_=f7YheezHY6RSZ+i0>xObsEYqt-87EVQ4ndn$7bTKNcPOlHj2{iI#-7Xn?9VLzD8zn|M)*;67VE$0j~kS`z2
zBdE=#mr$@fm@BRp`o`eYgj@!mHkI%pN3Y5qL5(hp!|`H;8Z|mIh?51Cjy(1IkeA`6
zuo@`jNEHemImElC)&_%XW-E308v~{2@mj#F(iFWr^C}t#rK8v|qJKQ0FvXkL>oZj!8tEm#TeIkkJy6!9;x)u4TVa7WaR
zAbHQ4z1PS`4`z;+cGyX%uCh#aJy6ecirpg`bWAeytXY50N|hfNFQ^@pp*d0*8*<6$j&>uQSV`f!e(-L{(-*S;_UqN&chyyN6ka9FaQKo
zy1P4ci|j2?#Sc4_jVx9h_!B<>V}U&MtQ`n@*lZA2V+q9>k)|bDqrb(aKq)e%yqNxr
zYxCsxlr4lWQWw0ZIfK|-^yQxpf@Uk9Z!>SF1-duu}Ej`PVQ?0j=-DnHMT8WWRNINzQ2ohM47p~
z?V;7fygT?}S~5NSjrmvw?zmw)i{#asia@f4t{QhmN@}m3S~7<0-JOqY|S*Fa
z*<&!PBs~V#WodKxrP&CX9yjd%_Euvrx6ND8af{nY
zLob5FDHj5Ji%7Wrfa*-0utimZqZFg|duqkH>GpK}7efJ7RLC$g?SeJ>{A5i2OLheV
zTKIpl0QSDviT$rX|B+=bp2s*`3z_iod6V7zHx47ogV||4@=KdxvFoO^lj%9>HdCy9
zu2EYcQZ{(j<)WTxLC#jQ8sj=fWtn&tg8af(@qPKn^|lo{nXn{jIm_krz2<}%_RSNd
zOuw8=&_4vl7X~Wdl2kg=qkSekT@09$=mHkCt%-rLKG=L$7?LTz&5o+bhz_O0a!&RN
z9VhnXw>)(o%Vi3bKbz!ySn;nqYN@7t3MG)l0KiX+i*sdIW
z9}adn^ur~tM&K9TH6*Hu_I)a1=vRd2fUEU{PRD}-cqdLWL<4XJU6MRZnacg(7bCxp
z;~0k^aw#i}=(1D?1Ma7jrc-~|Q)3(heUJN>B{wDPD-hJMEtxgZ2I8=8frpsC^5fJZ
z>=RcRLBOH2m-eHRYHF~8&lC3{DK{ZmResAT6xxJd2#yuwkne)jp!!lHVdc3Sk9=!9
zp>kCGQpCS2Lq>1cBt+Oi$sEuScC*-p^$81qXESl&n~#xHSgz>(^GW3T+HiI%l)Jn%DYlJY@Wokh3T?
zq0WlMP&-9-2dRLVGhBOULbTJ{|KWS_s+}F?v0>)b<;w7qqCr{+SdZwpFc3XCjNYPtnGX(yaRAba3iM~tz
zYL_jT))TE($gr{v9|yy*xIaZ>B)q8FFNSW0+Vl<;gF9*Y*F|IM99K(hPB)b@xlV;v
zlz$vD;v+jTjbxUgBq@`GtbDUbw5NVyn9;QN-nkloTkv#?THfHS-@#7CSjU)dlU4*_
zJC;WeKA%XrJ!i)v<|ykjzTI75TaX$$2mYrr1?j$~xGD(jH1Dzb%&kCXWm2
zLL_PEI*yO1g+#>-pRO;pcBNZtrUq#G64c^wuw)6oEuTN@zp{J>lYB(}eAMi;q>^*)
zbLm+)k}9dO8PH>L9O&cwb0fRpIUTc@foh@Awt_3(yt#+fS*XA`eu&R1pUy!*QBl!f
zq;SLQYF6^PnfdvR}5+S
z*OYcgVBNEUQKx5%#9Zky?E7zY8?YYNZD>oE^tQl!iS^ov9vQ}Ve#IR7JCU2DMs2z?
zVfq5mm7*8OS(W{Y8_0v{3vT<7`W{m%g}7+&Gf0*rhU)5u-PY}>lUnN84>hOkYIq3c
zlzD(ecX^~{2)-c(H~bYhzW=C!3UjHJncUnpFM
z9ni&qDO&$M#pm|*_T*kfJBluL(BPkho_fOdyNbt|sQ?16p@SSDVbkfJuofBKAv7W9
zD}{R*r6`POqIqe#S9kUVi^pKtl_+J2K_ryO{C!d~k!Q`ujRRc6Q$~kE6az)&cP_?a
z1$8Av4pWB}exsL#!^8M>q)X^|;`bqIAd5?NX}}=H>UZrzeu^RUZ2lRh%$P_q|k2*jUbEVIEPRsR^=x4~8ghR{wBv*@=4
zlY9^)5HOY5Oc?mn%*9>*j26QJ=utYOU{<4c0uDNxf9u!vPGjT1p*)qUBEi&IK{2j~
z#^iMQOoMc+QnfrTYZQB+(2k-Y`p8Pu%ir&Wg~^7QD4M;8+lZgR#bLSM#UT)vu1{qj
z{#GAs9tKQ2d{|zPb1>Qa@yoW`Hix)4%P1Li>Cyic8oxg2@}1|hh5NGoiinczPqcDr
z8JWu6Pkpw4CRpKjRTF&i1%;RTB!D4FX6k#`X(dp8*u>>-EILEqKZwzk7#x$z#aTnr
zNZm1uEc`TEdii5Bpm3a*cNA>B0()I(HL}sy>hkyv_DnBXLmX0wcztsBjGXo1b9T$k
z9;Ibhxb560Y2Vz+-wEQFa!
zqDrt#X7jp}cTbr}r_Gu$bTV9p13Dywya`+M!3+g0sT5C>;%~Su2YEY^h93SLcaqmi_d%ch5xa#q@
zzn(MoOb>oHhr_iolFDKTkt!z5)_uOwelkO^9sTn`qP@wf+hPJU3S}$N=vr4O*P8fw
z=CXE>9bC`DPWJv2{oUWT%fIzFs;L_AZ0T!^6589UweGXU^}f=iZ@Tmp{~XU%3FT?i
zavSmf3S}Hr_9Wr+Iq3H(=4T2flTUwL=&DFG3-V$OZjLp#Sr0^se@W|V)TWNyxMwFZ
z85R{h+uRLW7rUScX7jF1J@2UTCD;kH-~W5G7vD$s6!$KQK}ydk_Ctj+9cST!N>!Lm
z+w_3hy+`#AjF(l4RN|~jrh!+~q%v6{lt9ztvbDAM%_YEzY$IY<4v#x_CHB5B`+8?7
za=}pKx1*4OX->)H$o$%Bzs!SK6ct4T(gm)p5F^w7l+*G5N3}ufawPMP>yP~87}x+O
ztu$<_!l@nC?|fN)M5U?FVsZdTFbLGc*bJHmXqHfyKO1|IQ>u4t(O3tX&U$BPxP==n
zTSC~&kIDF^fQ@=uWs>##d#|(E3fln=EX-neap~z_X8VpC;2+^7sJ3#Tq>n`@F)Klg
zNYoTqq|&QlGUUJjV1+r8K!7^C&$5wJDs1@p8@rU%(91oLTG?u(Y@x$W(BdA6M;RgL
zI~O-MV-kH#OlBXO-nvj5LkhiWLt0x%NC*h@LAF)K*A{O2D*{e2Cggimz>zI#
zTwCYdNT}I~f
zSND~*dTXhs#t94F);%@gW*Z7j)$g*ZyQlx6Ngo{A(s8{T5)p1DCWY=V)4iQ><+8vx
zuT%qV@k9g2ecIv4k%<3RXWZmu4T&zm)7gGRQgN9iX(?2)1nq?BbXeO0h+?nc+Q~?I0ZLOIvHZh
zywh(6`B76RGS8=%#vXz|K=E)r@0l4-Bg`6jWFGDII+6sDDs
zE0mC5x0bI->GSZbuoQ6CqHw0=9!+zBeq-mSg
zBXuhXctx3BRcpdsA^{)ot_aUX^Av^)U{0A|LuvJ7K_94hK?yeBI;Y9b1NM77ZsYrC
z$9tSzqkT_{?I6iEZHY3V51)ZkOj@d@&tL(^3l*bzGA2a;
z{x@uNvL#teN$6A%oOHd%uPO5W9t?Pf-`EqVcJ;a?9z4V8V}CA<836Bt#+@pEiGsQg
zuqd2X1Id*u;mm8J47iRIa^&LDYV%AFFi;;`&(IXSvEas%IzGa0PI1fZ;M0
z2j_$M1up8dgOb=_yTio_|ADnRepeA9Yq_1|(qX&4}p5DaXN9ZOiC+KnAWn;2V
zkj@eDI`o}=CoV4j7@JZ5_;;8AS8mwt%^PfU`7jwQp@dJfH5AHsJ@Cbf<2(T4$zTp)
z2nRmsN6^~Ll#uY3l?nwsoh0}8#tH@Q!S*L!%lvFitwGP_tF_PelvXz2`d!dtxj75C
zL`CNaNxk1C!~v7@mH0x!$4p%7g@Rw-%=X!yf8X50AEFZWDL)yC2(b<%&MO|@KZ4WR
zteF!Ij-os6BAZ^ptoK8LLzYlo2`s!^Kft>TCKg00ghePKSPS5M!=2@n*qhqKeowX6
z;cJzZnhcf2*XmMcziSPvM;;+efJ+n;DYXG^TKP34`R~NvJ00>q2wD{M(`*P^sl^!>
zCfe}wA{Fvg*8Y@iQD|;@7Ua^UanVc1BMZ7>)M|n5
z(MU~`$&&)c^!LbGnJu6HTFBm0hKIfFm7$>c1}uvIxwidxAEI*kAG`GbcIROwR5|!c
zHQ1Icsw}p4HiY|J4C)Qm9eAi*TwGMIh5XHVy$&DJYO*Q{pxc3-
zBjgY3ou9j$J}ye!nh@-{eU?%F1ar1Z*Vx9!nUdf`OS@hX$dWP<79%LZU&Km
zq{<0!joG%A
zQMZ5m%h%FWd7_$j3AnHRXzs|?E|5(#jkEkE4-RTE+2O=
zeR(pAs`*BV(`jpfv=Tars23n#nKNgTv9yhiC*7n|Sxvx6b{7`EqEv&&KFaj$0z_dK
zn=Wwko<31bSx!KeOc!vAgio1@@BTiF%$z+V(OY2hCTQfJwYZPpMQS^d@CBm9#^I!u_;#;x+G?P(PzVZ*S)h$$a_1>^T(&~H8)W>x>N|_t{m>@zlQNU5&tK1
zpUa%svyPEnxs1%+*y{*tAp~fSVVbk6#}LmpW;spoLah;*s7LGN-*{jd#T`wFnickk
zZ*I?J-k$5H@32e7@`al4>@v7BuJ^#h(t)~c#bSW|{=L0Qhppvv)HIn&qms}jk8%#b
zK!?flUikBh*9(nLwA(J*)2^pLNBiS_536S9`%mMc%2~XO)@t4E>~n$x$kEO3-XZk_
z?1%0n8N5VT$kQ!sIRveH8LOx)so@PorVW&k=e-oWy8;hCfyhj5kGL)bEJ)FZ`R@?l
ziPqI8m!9dZn9BP1me+jb{pBmCn>LC+mD6i?dcTZx=GoZ~>m{x2x$)U`T$8bcV+vuzQkQhs=s5#E?m
zvM@F5l;8(VxK88i3<#DqQTIVT*h9(XI~zPj@*c|D`+lpE>v&okOZ0<#6#4I-`hK-S
zu3>4OEEEs~7QDaP&DMG(KjJ0@BDZs@@73^m-6KZOm)u`&jfHyssfk8ThJ5OD1+SG)
zlmQx~)7ka$iQm|Hg9SU}HhT8~PReyrohwQ+@3a=$19)g#A5?3yo2^gRB}!3H8ic@`
zQMVUMK|~nGFipUMMp>=l*6^=HCBk*W4BotOp(!&`kM<^wv5u_`CO<2y*DmV;rFEwVUqZP>B>#3#*>(=UQX@{EH4o2jh3fC`aTdcfDA
zG^)~U?w#j$GxN0;aq?$3%31F`KA)PwCo>W)`ScJZHPOFMtrc^U)8$Pfu;+am$9IFq
z8nAKCn#Eq?_Gk$xDW#l7eM7_U)XUJ9M8>qE+cy`~nV7ttLU-n)K%hW<5Cujo_=q1G
zlWWvrebiSO>U@!NorszEQmtM2aova3v$np=r_*q3WbGmL5_XZCO2!+&E>aFPTm`#M
zEEAP_nW8V%Il#B(^mgqo(!(=j$>xU!Vdwb{jP^{iJ7d|{tS#`z*lDM9KEEZvV&X*N
zF%Cw8uypv_Ba7?~DjAfu|4Fk!hE!$v-TWLB#J}OL(GD1RAn~poaDDbp16W{h|LSnx
z6sF1;<*43m9lnkpX`8SAN{q+ll;J;gzqL0vuSf-S)Frkz=lX`cY6lyCWcysr1~1wq
zXBK+%I$!;Pf}7jH_pe@TH7nVSXWjj=WWeMl9;U3lgOql4C^-}gqdqv9r%AnuUL=OQ
zZb-Z@0M;z>>&O1yyvsfwj>b)sB=qs@rFON`dGG*;7OaZ&c&%;Ogtbhm3q1SkB}~HV*zprG;o;@Q0*Y0U#9CEK>t6jRrk>9z!W%S#}U8P=At$;MRoAHd|!sPn~krpPE3?Lg-*`UJn>n=6vpjl%7OV^Pda2Op3y?@p2ObIw0D60IkMhHuw2Njlku$
z+-#k<>@dhxAvy9$>ZE`5NHb;_QqlG#b+*`E-@wM8eg~fjvjN=4IBmT$W05D>o_9{S
zEn`Guu>s3Il3;(g8+&9_9I$h(zs_#=wvQdK&|s{o#zBn9oOJ|I{-(>uu087J%y
z$OAg{A)F*9Q6_+R=E(<*R5Uh9MSyj2H_2{S)t`%PZiBwPZ)7{6_f~IP2D#rRyM9SY
zBfc(jWEe}{bHb?LncLM^xfp_mYNx%{c{zEAoD%#|iqrRcG!<6AcDX#qSRhflx^u?j
z0JojN`9Sgfk@UT9t==uM$L-bNKJ{LffLF6-VmoY4vs^{j5M@ApwLBG4yQ+B`c*(Qe
zJYdO+k=q*oVvqmx{pFj150v82I;osHo0qgtruj#uexyOB7NK2O*W)=iL;IJTM`;&qRSxS
z+!{5Eg_A)eksL;x1y_-INwY`G^=%oLkk%Sbo)vn@oje@;vZ_rmRG(kN3Xg+3o#144gxpW-NTo@qZV!+zTRfFP{G#)TP>d((6;kH%w3H#iv-vh*IwwKC
zcAyxwc`Q8q9**?Rt_b${$=$A
zAqM;`;y)kx`H3_PmAU$y&j0cz`$&Pm*35T#t|zIL`Ne-@;IxcOGkGK##J+i#J{nfE
zZN+Lvu1xqf^X7~JML#b#Ty^gW$X?YTy!rl7+a7DC!n6@TjCCohwcLuBJqtc+rdL;6
zP)p^NI!O!nJMRw~nouMXWXlx8^LgF)=Kh>kc_ZMiXaJ6Q!tZW7-=D8W{CUCo@}ln%
z?QjL~B~1!tB2E0Yn=LkXwqls?FJ;syouK-TwL<4hq@^!PTk?6Qf6RzQTw^Jcjues-
zi_ZhwWt(_a;c5l@!JGal?Un0q9oV@%Gk7bi_Zr2%iF}faAmEcqe=-NvD&~+8V>S3J
ze4fSFdDDhc7-y@6JKFV+GyRUBV;L8Bg&t~Oll21wrz%NbnV6ZGHu&hgwo
zzIkvc4^xRmLD;7=f4Cp=X3Em%2)jzJCABRkkP&e{sp3E?Ce$cQyuq+)JNd5L%t71T
z!fA$RFgI6l7=1LcnTX$|DU~;GzZ`w5+$S(sV9>{EBQ6eLPQK&9H@mP;
zB_b;J1^e}&DeL<<
zjLv$}B@w4J4>rdbbgQTy6jDJV=1rPw@V+GD$kKX{72<$YA<@-a%^cYw9QP&(F%x~98?&!
zx+2%U@l--ZjlQ3e`W*X!mK!0*2DRJSxwrO>BAJ&ay$Cx3B-7t+1C^{#T$Xr<%Ffc>
zLD@a7jc$*7uHgbl5|JO1Uw3-2%Y<&?L?MoFqBdGcieZzq1K67)8$eNKt4{904b*kI
zos~VJPHn2whHWnRITZXMvuE#y#Xlal%3|i40sV1ym$gCd=fw5TfiIY&BZa?<~myGLKw8$%{0404R~v=mFXx^6o$w@C^$~CdPfvo6qdZd
z*kVZvMI#D|1loi&kw9k_N{Q8G4*lpW9dgZUWG3IAebU1ULui|@vRsAv+JpVDkPfmGNS
zM8WxtfV$tBGUua^A!I0Z+fMND`XKD^lN>+&mjs4Byb#V`w-P9jL{Gi2d!
zIJOmYAK7&2qfzyF%v#fS-bAL8q7ceE$Hf-#a7OiAr9pLX4Jz{7zvGz!A(JQ)wLCk~
z9Pa&sg&<(0d`fa*gMB(4<)VSoS|FS&YQ$Bjd+@Wv&wI14&N=@L_=P0EUx2@(ZCf#y
z*Gq{za&v}g%*j7X>WE69t@DW69Cj~3GzVULoqLmSV&W6!R_4iKiZFo{QSMTWL5m@z
z?L{UsuUH$jFLwPN@h}!LGqp6fvhSc&Xzv}Nkt-XT%3{6u7ixOhoWIzaM38?A3k-U%
zCEWXu+T*Ly7U%R3YGSJPFF&y&AfomwK7-}Cp0)|A&iy8Zsc*y7mH(Uj`B9*01d
z9`ON(4t2IxQ<4J9&|gw*d1nJD`HZ}Hoa;ZmJjy57TW`l?>4qmz6{*O@DCs40bodhX
zV_0CZ)Y$Rjt+i_vqK$PpE>d-syim)LGVNxybea8cK&m-%x7rUdwyj3e@)g1hEZ<#9
zKI~?c73A>hTclGz8{WATyq|AqUI8lchi640ihBjBFK{3f$7wlv%<10X?`WOw>S+CAeAb5%
z(CCv?wd{C)Pgg!bk~b7m8wb8Up4opj(}1d}Eco&SwF#F&xw!U|?e$nS6##}8Qvl%X
z5P_cCtC#E88j`8m*(^T4bk{!2P0<2-Khuc}p!E@Ib#;dCQPWQ7RpexGB&3aJG8r8o
zoXk7zG|`~i3N;IaD|Gsr3T7|^%~tdwj_%a5$6u-pPCvL_)U}f?`^r(ybwpUMTkPTL
zoIQF$ugijgUGE34q0Q%{Fb4vM0xh+O%O#kMzL}K
zUjBW_A64N~KGl)LtUygQdZOVS%kTcCrdE)1b#!ezV#T(F$7rY7bl~w$c8+40ILGhR
zhX|NSnv(U`gp0l;61jgwjc&4i2xwJ*BIC9Yd7&`az1$np`Kh4{%vTsysf--{Wt&70
zrPR#nSysd@A^B`Bua4lB!sl+M=Yn+xyS+c`)tppRuz$Wia7Kc#h=~m?HX3Y|6!!U&
z>U*T<^*-K#A$L9Z`;90QhMhH9k4tNc4D9SobFEqFeY8d(&*!v7V%>PK>GDoNqSI$vt0k7F5p?zg`Zf8zi_7}hL(
z+A+fx*S>KyW};%{TI^FrU?_Z6C)afv573D@k57t^zidu7ue3l#rdxc1K3YVK^497!
zziB9xnAoJ9FnIP_8Z-=|-O{CJp~xosB;jX=uP8BkeD*8xgd}UyVYTVf`0R6H1TGJ=
zL4k|{qmQ}WM)&@CP7sY8i2i$Cb5WTU-pj6{uZK-0v)vw$(;69~z~y1AGgQy|FtebE1mVeL+@})@|HBF
zuRcfmBl}Wd)EpWvU;B$*bVgUl^rwfV{a@_sGD-H_44^wM|O&=eabN2*^6<^NR
z%&@l!rada+pmM_hM*1BV*3ql6fjqjUMoWsanrYDY
z9fK9aI#rMlb2wdjIF77IzEh2ZcYv#9ndpQ?3PIfUuWqHg$E&UO+qQSQ>CtXnxwb0B
zrA6^sN_=wkQFJ7bpW3k}C3peNcCRk!%75IobvT^a@s3eUK8J&nKtIB$dXPd-_O(!8
zo^f>L?|g(Ixq81g9?C#TI0@b1Q22S><#J2Br6t3XIIj`^TBn8kW%AtY#Anqv@2|nn
zOS>;t3y*j3^}RF>xSjLYnIo-xB;qO7IW-D7eOdqMqOaPqITO`)+&e@34b6?ayoVjy
z3q_rv@Pou{#eLLl@%45Fw`uD`oD65)E*JK2Iy|*r*~IR^4{o|MQrxj96}QYnrynlq
zE)H?4)Xdwf#jZt0h&x%vj|KgK^gV?fNS08xJLUL$0C95Uk}c}*84m+p2ZQhg@nv^H
zn7e_K$~KvWQe5fU$}tgj0Vv75xv1_ZdX6*=1AcQO{_nZK_@g&SwTn5;uHMFHo7d1p
z(1)LNk%okq`lyWQ&D9q9fBwt`Za&hMCXr?hZGO;Ua97HV$;D2RNvKNR0mJ`UwCZuf
zpDtoQ>|m`uXiL_^on#}
zfW2iXmW0_`*n2jT{w8
z&x=AqQQpI!W86DT+59sjc~Cg@@W@I&S!ePgO0X@%ObcrlwcN*wiB4Na`u^N_P&n-{
z#i9IpYb8P^{%%#KxN5?axZZf76N;^
zR6a%(_1-t6vMEaL>x|?wj#ghkBeqo2VN!#I=3E;}GnE)2CN$AaCqe3RalMqX+R~N2
z!~UM*A~l9D#eZC9>GjUPbq#6SmCBU9Y548*r5V(Xa@c&f*wuc$$bB*jsf^s?{gXle
z>_Lksk|HKe>9jCA)VY^9r)wFC^js0le$Ixs2oPfhAILjO&
zO0@tlfhL9}RBKGR*cn0Y08a(3#Lm*_j+e(~GlxI7e+(@JPLrN>^NqvCA6D{|bq5g<;AYO8G{
z4#{v_e<^ho(RSo0k-t`DR5l7Y(C_j8HCL$jmt`INF{AAsM#zZN^m{(WfxpTunZ&AE
z)E{lIH!_qGHVm!d90!uXEf8;xE|Ay*CDETa?yuBLW}i
z`lsNPA#lpnT#*3Ar)5Q2=$VjNkO)o&1MJOUNP2_iG)e0@AM8E8^mFZ}nok`MRbKr|
zS#N?Q@S*L{gBMSg6}gJruyr!nd+hx)0SdmjPqm%T@zQBQexjaZXlv~WmYa$>EzL}I
z>~N9})_u&Z7FRy^ffl>%=>t**#wTJ7A#2q;p1XkeAY^2N(F$r9PrROy5OKnyT%QdnFwXvG!`S&}RJkHHHsIsu9$9T?%F>0TOwOdfo-$}NoTg`h5J0GRxrp@GPf2qxZL-ojZ
zNrQY7%Pum#-N()S&~r)JtUQDjG4K-6=HU^osLQhjSamidYt(qG_63j!@RA
z2C(fBUQ(gma?d^(roQh%^a>RsY43!|YrV+aEGCKsunTpCGn3;(>kGt@*h0mmqQelC
zI^!}$30_je!Zuv`RCHgmbZk?Z^ZukycJ0O8B#XX7lfo7MaoGGNOM;<{D+Mv5T&&V;yo@Or=k9GhUG!P;_I;_51R`
zOy|eC9$*G4t>E-sSo3|z&xx7e7#lSuK=ayx)6?z})P7EbO+pX8!j`02tBp55J(GcN|8{qD
zVTiR$Kw&w^MDWmS6YBpY;^CzBi9|}@{TfErcyt22j5YOfE7}h!^un|q+VlD~0OdqC
zY=;9PAZNPsnSkP%-Os944sXz|B~O@!x$Gv`Vcu}#i*l-MIoQv;IGbAst)>&%L%p{Nn
zM;UcIBbvd1T^Ms6cKa*?jD8Ee(`W6L+Y~@Od3xacKWNYYw=MVyObOGr@H^ave+wxW
z_?EUDD1jBVGJvX}D(Fuzk1t9;97+vASglI7iF_0Ci<=JPzgPek^}9K%m&O$d3tdii
z27yd|YW~j@hmCSn9yVX({-YKnwZ4Q=F+XQvshY|*$V`uEE2V2WP;*z9Yc)27gTgDt
z-l+>+j!4b{|1vWCPnD29+N4_YTpjz?_nA-g1X$UdD92aC!X>n&?X)(0M+V4Qk>Jvz
zN;jEpS57Zgd{a&`4Y|%UoR#q`R`KM@f(l?%R9C~9lF1?@8}7adWYdh5pBF#Fg0$@?
zboqtqZqFa?ne1_lq8bj8*(c`e5_DE{@kaiz=KoTv)Z4_3XDt~usj<=p#Pq+4#b&x>
zY{@j_vi$}&@DIA)M37muAd4#A&%lEAN|mkiMNy8)%W_wC?PDJ-RSG%4`M4Twl9Z5b
zJ8*L;Uuh9B`o2gb_sQsuXshGt^&U*lB1Q>{^-v7tn8NAkDd`n6xM;e(il-i29Q`(q
ziB3y!UhcL+K;g%Q&&j2UV;k#tE_g@KxO_;K#Hu@SMZc=a5iA
z5yi-YqeoOEe)K-8!8}!M+pgKxQS10Nkru|2w^TUWImZ}=|g*{}Ex781$Sm~(?
zhz|aD#%q9{gQ2|D^Y{hGl%B0Dnzox{R{+}_>D4*-vj=IZsN7eh1_TbL$8xwdC#w)3tNt$L?-0Rt4NcF_PJ-~
z4z!L|A3FKYduDEf47&bZ&Un%bnJ9DOEaG*X}bN<2O~R#j7#R
zm(5MRWJzawJuPdY6tlqQRaKq97Z{v4dzDGqai|F(ctE_q-PiPShkumGX+062;6KyT
zGexqOw|U`C&rj@D01mjbo6p+|vEX#UB&pv$_TsA0bGRJgXLo>K;*SGyYT{`~WhXTV
z$BzQaIgVMKe3U#Y*#%fQWFA`q(&J3}Z9ag}3?wxZcpR3^N?EUo*d4BB-^uSsrJ6cC
zMGXL93?+d(<=2TqcD!c>t*+|3uwsA+S^FKgCXQAzM8EKQ!OltHcFY3{;{5h>m2Udh&{h$#bmXD|mM
z@x;SW04qsdeLG|hfqOKTY<*#7Tul-CLz*-)LdWVFfgf1LFL^?>7DpCaLp#(z7yq@cwnL8imuCvye
zwdTY5nh(j^d%rvT|L))OdjKR%;BCl8XJuvCUk3ICh`j3Ixik?w`_^&eE#l5uEx{4l
zO6OekZ^!6WQnQ5-_E73dc2d#ff#`ryDy$KjgY2VHx8V-dl0{07!3;Nwa
zoYBfJRvg-!s#8z(c1Z?pNHtg^{n$QWh2OgqD=fY0zc9<&X8w`V*B~L()FnoXD|?1-
zDfl`tTinrboZL}yBm=oG;W&(@p88Eg01@(zRBA%9L`>zw$dOZyFICEr&;C%6E$NRX
zN5ETd2KNje45|r|T^%m9+WNZX@w~m)d8B;gKv)L#0Fyd`#rn~9LGKj)k^O+bgn{AV
zfxZMF{#~R~
zTSEjM>SD{G!4$zV-E^4yrOR1*BNVCTjYgYRDZ99i)out3GuHzCZDM_fx
zQt@8`2~8%e+l|f5%^*hjSQ!ME+5Z0i(|m||0)$8XX8{q^KRbO4zs=8b*Y}r~%YVGN
z50&DQLc2`$=tSizBvCeQStm^0IX(@VK}EF;iS7UjDDjNo0wgZONeIiIA0qxYBK6G(W{NLydB}$+hcp~z(+%Gj
z*PY_qYXGTylk%NP-Rv)9F9!0T$R3JepRl_!S3nKG)N7(~)iz(^E0z-i_V+t*i?=vt
zd=k47C1tvZUC|_xW$8B?x)UVsfO9H;q!oz6-X@zbbe+sV+5iGCfmp5^JoD47
z{NTwlGOQDe1aDEnl7gnoUl)xlvlOI2i+&C@Q$Xy^7v0r&b4#I95siEWfX|NY)|M84
z?mu!(odLIF!Cp+V2!?cbnRPG+u;y)sk@tAg^(J}1T=HspYn&x^J$j?Qzh7TImSB-Zxb8LGxwGsA4mkaGpt1LJ
zwA{$CMXtW$uvDLUrT0dbAt|X@dXwA7b#e>K3^N%3pf
z9>O0;u|#OI%6pFhe1$wE)w-Zfm3m_)pgYdW^aO{U7;7LipV0u>(JL-yA3Do1f2
zoEzc=fIU{F;Mr4aFJCpnpmL9nTtIQQ4Vik&qJC|zps#CDSD*ahIX3ic3^(eo=OqO4yP-f9EbpaURO7(i{c4p2?SC9c43nh$K+QdA~
zr~D`EMp@EA1hkv*y$>Q+uDI=e^P1RWZ+jW~p~45geAo+sKZ&#n8RRk_ZsppOkZ0A&7ILrP`#usJTg*{VyCW2LNpE!*oZ6`r+{1&8?{tD2!c=Br3h`
z!Wu1NHY|2kRh!^*RDN4JDU1ec@z55*16zMHCgXP3?nP4ddTkBD^uL(3II||Z3<8wt
zI&?P4*rShq4F0{P5yUBFrcGxKt+ZJpkN|M3aX+R`YQHaEi=e!ojQ&!G-*mDxuC}*3
zYI566@^AGU(Ys*ESY|F*qU4e9oOjLf%Zrc@?=^)g7Y$^)Ow4SBe1mTxNMb>i`N`bg
z8AOMd#U5wuqBgVl%Bt(+ZW@K(fb_DQztDJ4=lJUC16J9mPuH@GY7mt)(81p4;28ik
zH$4ls762^?qpAwn%kC@hs44at^-lLrVl$TlD?^xXlRu1N{Zb$p0IJ`~BHUK4m2CTg
zp-$HIBNtGlNKBE?TrAUiZ*J@YV`~qXebG8Nj3M3-<9HBZApC^8;~47$^e!bQY4!eh
z8#@8{^*#uYU-V+;=NOYQQ;W+BKvMzt51q?SO5)q|w!{LK41p*)l-_?(_Xu)elhmDZ
zk|ynpD?BOo6D0rPXbP-J)^)DYnrF4$GaBJK#|%{fUSqrS3tnTYGh(S)GbxR(L{+bk
zTk{i3poRy0j+)x6TQsEvpD(JF5&h4B1Z5QW@%};8C}!Q^`ln~?(Ni930L1cJbEX%6
zc-Z~h-H;`<pG5%0sSLnxdp)(+6>^-c*k=kHX6Id^tQQ}Fy
z7ENu^BeZ~C|B^|hTT`9(+h-!mVV$xkNw&hIu4oUK{@zBw7Fz-&V(O}(d_4Qk@(B9?
z;=p{LG^Zn!&a|f(yo^+Mz`nY@oeZ07*p53|+EmWE{EV_qvh!}u4BzhKVpoUeBg7Wb
zTls32X0m{}unkl~k(5)9IO?!N!Eb`l?I~WckiwKK@_~CfNiG(CE}Xtndxr2rA$S@#
zty(Yt!_t&gFV%VL+#p;K5*;sqrK?U#ka~9#{@avo9Rshk-T1%({ST>|$f58$rpSEY
z;>jKkO7jM5Kg~C`<1c_j*(HJ@dVSe>0ZaX#1_Fmy19
zRnyDJ`TA_S8SrHb*`%M2GjBlF@WG|7`!OM(klx%_E}?~R_2K-KH@-{w*+4L}_kU58
z>m|0TMPak_!df~NxC?A~Xq$QXV<@9h&h%ZAb&sRdIC`?@97^{lau&)YrV**DS$}_y9>IR82K3A(v*g<0f;;S)mO*oDQbb_bC^vsW7
zzo*|V0Lm+&=7-rAYS0T8_CS<6r0u>*WD<-d
zrv1N;nb}cCiU@>()`ME(80TbI17GtloNfMDMT
z61TSTx|e^r!h1ayB#n~V+W@a$T*~=br(fE|sG7NR518WwyE5P2t9aTDwz^sg=6NCN
zKZf%}Qz>8Ci>dXUuD@73&ZMrIcTgrh6QiXhx{O-e9=T7JQyZ)dUthWgUv=?h8C_tX0G%vk-KB0X}k9?t*L&
zbBF?iNR{`1B*0w%NRq`*#m*j0-{qqh1{wn_6H9oDdmb|D`VGf!5y=|;Fx4FQ)k+mm
z8yPJ$u(BfEz1IEUC-mj^C=xW>;6d$umLI1$oh59>YG;a@p7E
zUV_b+wN}iVI@3niFyijzg>Q?E4s%Mwr5w!E0Oq`NpOWnkBF0jw*cjXJmeLo|?v43a
zdi&Ajs(jny
zCZ0qRy(QDk>^?`-4ThsN^aVI86=4lFMwoCM%_+fa6sTLC{c6=xo^8)XLDc
z&@#+bebMNF$
z3TSLb=qr$)Bkw@zC_u;IC#32}YVqB~*6%@?)*wjT@vNlPtCKY!H)jSHP_LQuVd3Qf
zav}va#bN60_f=0r;UyeJnuY4mzV`QLX7+>5@b8)WBto%tS2Pn|1X{7f3L4UzrNy#XHK0W64Pd<_ko|D^ylXC%qg`OwU^+}E>eL{PHCv

literal 0
HcmV?d00001

diff --git a/docs/evidence/2026-10-13-browser-discovery/preflight.json b/docs/evidence/2026-10-13-browser-discovery/preflight.json
new file mode 100644
index 0000000..0a0f4fd
--- /dev/null
+++ b/docs/evidence/2026-10-13-browser-discovery/preflight.json
@@ -0,0 +1,22 @@
+{
+  "available": true,
+  "error": null,
+  "checked_at": "2026-10-13T18:42:18.136Z",
+  "browser_version": "156.0.8078.4",
+  "api_version": "1",
+  "service_version": "0.1.0",
+  "playwright_version": "1.64.0",
+  "execution_location": "workstation-release-check",
+  "release": "sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
+  "allowed_origins": [],
+  "fixture": true,
+  "active": 0,
+  "queued": 0,
+  "limits": {
+    "concurrency": 1,
+    "max_queue": 4,
+    "max_timeout_ms": 120000,
+    "retention_ms": 3600000,
+    "max_runs": 64
+  }
+}
diff --git a/docs/evidence/2026-10-13-browser-discovery/receipt.json b/docs/evidence/2026-10-13-browser-discovery/receipt.json
new file mode 100644
index 0000000..c30efdf
--- /dev/null
+++ b/docs/evidence/2026-10-13-browser-discovery/receipt.json
@@ -0,0 +1,184 @@
+{
+  "id": "6c710b36-319b-45b8-b062-ac2065f5e81b",
+  "api_version": "1",
+  "status": "passed",
+  "error": null,
+  "label": "independent-browser-trial",
+  "target": "fixture",
+  "viewports": [
+    {
+      "name": "desktop",
+      "width": 1280,
+      "height": 800
+    },
+    {
+      "name": "narrow",
+      "width": 390,
+      "height": 844
+    }
+  ],
+  "timeout_ms": 60000,
+  "created_at": "2026-10-13T18:42:41.545Z",
+  "expires_at": "2026-10-13T19:42:41.545Z",
+  "service_version": "0.1.0",
+  "playwright_version": "1.64.0",
+  "release": "sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
+  "execution_location": "workstation-release-check",
+  "browser_version": "156.0.8078.4",
+  "completed_steps": 14,
+  "steps": [
+    {
+      "viewport": "desktop",
+      "index": 0,
+      "action": "visible",
+      "status": "passed",
+      "at": "2026-10-13T18:42:52.067Z",
+      "selector": "h1"
+    },
+    {
+      "viewport": "desktop",
+      "index": 1,
+      "action": "text",
+      "status": "passed",
+      "at": "2026-10-13T18:42:52.461Z",
+      "selector": "#count"
+    },
+    {
+      "viewport": "desktop",
+      "index": 2,
+      "action": "press",
+      "status": "passed",
+      "at": "2026-10-13T18:42:52.576Z",
+      "key": "Tab"
+    },
+    {
+      "viewport": "desktop",
+      "index": 3,
+      "action": "focused",
+      "status": "passed",
+      "at": "2026-10-13T18:42:52.660Z",
+      "selector": "#increment"
+    },
+    {
+      "viewport": "desktop",
+      "index": 4,
+      "action": "press",
+      "status": "passed",
+      "at": "2026-10-13T18:42:52.674Z",
+      "key": "Enter"
+    },
+    {
+      "viewport": "desktop",
+      "index": 5,
+      "action": "text",
+      "status": "passed",
+      "at": "2026-10-13T18:42:52.754Z",
+      "selector": "#count"
+    },
+    {
+      "viewport": "desktop",
+      "index": 6,
+      "action": "screenshot",
+      "status": "passed",
+      "at": "2026-10-13T18:42:52.764Z"
+    },
+    {
+      "viewport": "narrow",
+      "index": 0,
+      "action": "visible",
+      "status": "passed",
+      "at": "2026-10-13T18:42:55.566Z",
+      "selector": "h1"
+    },
+    {
+      "viewport": "narrow",
+      "index": 1,
+      "action": "text",
+      "status": "passed",
+      "at": "2026-10-13T18:42:55.959Z",
+      "selector": "#count"
+    },
+    {
+      "viewport": "narrow",
+      "index": 2,
+      "action": "press",
+      "status": "passed",
+      "at": "2026-10-13T18:42:56.177Z",
+      "key": "Tab"
+    },
+    {
+      "viewport": "narrow",
+      "index": 3,
+      "action": "focused",
+      "status": "passed",
+      "at": "2026-10-13T18:42:56.253Z",
+      "selector": "#increment"
+    },
+    {
+      "viewport": "narrow",
+      "index": 4,
+      "action": "press",
+      "status": "passed",
+      "at": "2026-10-13T18:42:56.265Z",
+      "key": "Enter"
+    },
+    {
+      "viewport": "narrow",
+      "index": 5,
+      "action": "text",
+      "status": "passed",
+      "at": "2026-10-13T18:42:56.275Z",
+      "selector": "#count"
+    },
+    {
+      "viewport": "narrow",
+      "index": 6,
+      "action": "screenshot",
+      "status": "passed",
+      "at": "2026-10-13T18:42:56.359Z"
+    }
+  ],
+  "artifacts": [
+    {
+      "name": "desktop-6-keyboard-result.png",
+      "bytes": 26622
+    },
+    {
+      "name": "desktop-final.png",
+      "bytes": 26622
+    },
+    {
+      "name": "narrow-6-keyboard-result.png",
+      "bytes": 24280
+    },
+    {
+      "name": "narrow-final.png",
+      "bytes": 24280
+    }
+  ],
+  "started_at": "2026-10-13T18:42:41.550Z",
+  "blocked_requests": 13,
+  "finished_at": "2026-10-13T18:42:58.107Z",
+  "downloads": [
+    {
+      "name": "desktop-6-keyboard-result.png",
+      "bytes": 26622,
+      "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad"
+    },
+    {
+      "name": "desktop-final.png",
+      "bytes": 26622,
+      "sha256": "b15998824256b86c74f2bbb75f061061be65db0b4f3bb5444529ac69a723cdad"
+    },
+    {
+      "name": "narrow-6-keyboard-result.png",
+      "bytes": 24280,
+      "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8"
+    },
+    {
+      "name": "narrow-final.png",
+      "bytes": 24280,
+      "sha256": "49d27cb169b8e180ce93969c6d2b8619a7684cf035bb9dcae9cd91d8bd9952e8"
+    }
+  ]
+}
diff --git a/docs/graph/capability-graph.mmd b/docs/graph/capability-graph.mmd
index 907f454..b66c008 100644
--- a/docs/graph/capability-graph.mmd
+++ b/docs/graph/capability-graph.mmd
@@ -1,5 +1,5 @@
 graph LR
-  capability_infotech_headless_browser["capability.infotech.headless-browser
D3 / A2 / C2 / R2"]
+  capability_infotech_headless_browser["capability.infotech.headless-browser
D3 / A5 / C2 / R2"]
   capability_registry_register["capability.registry.register
D3 / A4 / C2 / R3"]
   capability_registry_validate["capability.registry.validate
D4 / A3 / C3 / R3"]
   capability_registry_register -->|supports| capability_feature_control_evaluate
diff --git a/docs/graph/index.html b/docs/graph/index.html
index fbf84b7..19366f8 100644
--- a/docs/graph/index.html
+++ b/docs/graph/index.html
@@ -17,7 +17,7 @@
   
Generated from entry relations fields. Regenerate with reuse-surface graph.

   

   
 
 
diff --git a/registry/capabilities/capability.infotech.headless-browser.md b/registry/capabilities/capability.infotech.headless-browser.md
index f13af73..3adb61d 100644
--- a/registry/capabilities/capability.infotech.headless-browser.md
+++ b/registry/capabilities/capability.infotech.headless-browser.md
@@ -2,11 +2,18 @@
 id: capability.infotech.headless-browser
 name: Headless Browser Automation
 summary: >-
-  Headless browser automation with Playwright and Chromium for UI testing,
-  screenshots and page extraction; recommended default based on existing
-  whynot-design, coulomb-social, core-hub and frontend-patterns implementations.
-  A rapp-playwright-provided service will be available shortly (announced
-  2026-10-13; planned, not yet verified available).
+  Headless browser automation, screenshots and keyboard trials through
+  rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4).
+  Published A5 local container; managed Railiance admission is pending.
+  Download the Python 3.10+ standalone client from
+  https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
+  and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`,
+  then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
+  with a fresh output directory. This endpoint was verified locally on 2026-10-13
+  and is ephemeral; it installs no browser for the caller. If unreachable,
+  follow the local container setup in the capability card or adapt its A2 source
+  examples; this is an availability gap on the existing capability.
+  Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
 owner: reuse-surface
 status: reviewed
 domain: infotech
@@ -20,14 +27,15 @@ maturity:
       Inspected four implemented Playwright consumers and separated optional
       dependencies and plans from usage. No comprehensive alternatives benchmark.
   availability:
-    current: A2
-    target: A2
+    current: A5
+    target: A6
     confidence: medium
     rationale: >
-      Existing JavaScript and Python source examples can be adapted in a consumer
-      repo. This entry does not deliver a shared wrapper or hosted browser service.
-      The founder announced a forthcoming rapp-playwright service on 2026-10-13;
-      that planned delivery does not change the evidenced current A2 level.
+      rapp-playwright 0.1.0 is a published immutable container with a versioned
+      HTTP contract and standalone Python client, independently trialled locally.
+      A5 describes deployable container availability, not managed operation (A6).
+      Railiance admission is pending. Existing A2 source adaptation remains usable;
+      no endpoint uptime or caller browser installation is implied.
 external_evidence:
   completeness:
     level: C2
@@ -36,8 +44,10 @@ external_evidence:
     satisfied_expectations:
       - Identifies implemented consumers, browser engines and source entry points.
       - Gives a scoped default recommendation and a practical trial procedure.
+      - Published provider client and container have independent fixture screenshots and keyboard receipts.
     broken_expectations:
-      - No shared package, standard configuration or consumer-independent trial receipt.
+      - Managed admission and persistent platform endpoint are still pending.
+      - Consumer application acceptance remains the consuming repo's responsibility.
     out_of_scope_expectations:
       - Exhaustive estate dependency inventory or comparative browser benchmark.
       - Browser service implementation or operation by reuse-surface.
@@ -49,10 +59,13 @@ external_evidence:
     known_reliability_risks:
       - Browser binaries and system libraries must match the selected Playwright version.
       - Existing examples contain application-specific fixtures and assumptions.
-      - Browser launch and target-repo compatibility have not been tested by this registration.
+      - Local fixture receipts do not prove managed operation or arbitrary target compatibility.
+      - Local provider endpoints are ephemeral; check preflight for each trial.
     evidence:
       satisfied_signals:
         - frontend-patterns navigation-history records a completed Chromium/Firefox experiment.
+        - rapp-playwright independent final-release trial passed 14 steps across desktop and narrow viewports.
+        - Independent provider evidence includes wrong-token, failed assertion and unavailable-service checks.
 discovery:
   intent: >
     Help a worker select and reuse existing headless browser tooling instead of
@@ -61,19 +74,24 @@ discovery:
     - Playwright automation with headless Chromium as the default starting point.
     - JavaScript UI tests, screenshots and page extraction examples.
     - Python visual-check example and Firefox experiment evidence.
+    - Published rapp-playwright container, Python client and bounded HTTP fixture trials.
   excludes:
     - Browser hosting or workstation provisioning by reuse-surface.
     - Credential provisioning and permission to automate external targets.
     - Claims that a dependency declaration or a workplan proves executed browser usage.
   assumptions:
-    - The consumer chooses a version compatible with its runtime and installs matching browsers.
+    - Source-adaptation consumers install matching browsers; provider clients need only Python 3.10+.
+    - Provider consumers establish an available endpoint and run preflight before a trial.
   use_cases:
     - Find which working repos already use a headless browser and where to start reusing it.
     - Run a local UI assertion and screenshot in a target repo before adopting the tooling.
 availability:
-  current_level: A2
-  target_level: A2
+  current_level: A5
+  target_level: A6
   current_artifacts:
+    - forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441
+    - https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
+    - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json
     - ../whynot-design/playwright.config.mjs
     - ../whynot-design/tests/visual/ui-kit.spec.mjs
     - ../coulomb-social/scripts/test-usecase-browser.mjs
@@ -81,10 +99,9 @@ availability:
     - ../frontend-patterns/research/experiments/navigation-history/experiment.mjs
   target_artifacts:
     - >-
-      Planned rapp-playwright-provided service, announced by the founder on
-      2026-10-13 as available shortly; endpoint, consumption contract and readiness
-      evidence have not yet been verified by reuse-surface.
-  consumption_modes: [informational, source adaptation, JavaScript library, Python library]
+      Managed Railiance deployment after platform admission, with consumer
+      access and live recovery/rollback evidence; not currently available.
+  consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container]
 relations:
   depends_on: []
   supports: []
@@ -95,9 +112,12 @@ evidence:
     - ../frontend-patterns/research/experiments/navigation-history/README.md
     - ../test-driver/SCOPE.md
     - ../testdrive-jsui/pyproject.toml
-    - ../rapp-playwright/README.md
+    - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md
+    - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md
     - intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
   tests:
+    - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md
+    - docs/evidence/2026-10-13-browser-discovery.md
     - ../whynot-design/tests/visual/ui-kit.spec.mjs
     - ../coulomb-social/scripts/test-usecase-browser.mjs
     - ../core-hub/scripts/check_console_visual.py
@@ -114,9 +134,10 @@ consumer_guidance:
     - Reuse whynot-design for JavaScript visual tests and core-hub for Python visual checks.
     - Reuse coulomb-social for JavaScript browser scripts and frontend-patterns for multi-engine experiments.
     - >-
-      For service consumption, rapp-playwright is the announced provider and its
-      service will be available shortly. Use its published contract and readiness
-      evidence when delivered; current availability remains source reuse only.
+      For bounded screenshot and keyboard jobs, use the published rapp-playwright
+      Python client against an available local provider and run preflight first.
+      Use the immutable container to reproduce the provider; managed Railiance
+      access requires admission and a working tunnel before consumption.
   not_recommended_for:
     - Treating this recommendation as an approved mandatory estate standard.
     - Selecting test-driver as an implemented JavaScript-capable browser engine.
@@ -125,8 +146,19 @@ consumer_guidance:
     - This is a dated source inspection; run the target-repo trial before claiming adoption success.
     - Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection.
     - Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here.
-    - The forthcoming rapp-playwright service has no verified endpoint or launch receipt in this record yet.
-promotion_history: []
+    - Local provider availability is verified but ephemeral; managed admission and platform operation remain pending.
+    - Provider fixture success does not establish consumer target reachability or application acceptance.
+promotion_history:
+  - date: "2026-10-13"
+    dimension: availability
+    from: A2
+    to: A5
+    rationale: >-
+      Published immutable rapp-playwright 0.1.0 container, versioned client/contract
+      and independent local release receipts satisfy deployable-container availability.
+      This is not an A6 managed-platform claim. D3, C2 and R2 remain conservative
+      assessments pending broader target and operational evidence.
+    author: codex
 ---
 
 # Headless Browser Automation
@@ -147,24 +179,101 @@ implementations and the upstream Playwright project maintains the library.
 
 ## Service provider and delivery status
 
-**A `rapp-playwright`-provided service will be available shortly**, as announced by
-the founder on 2026-10-13. Its [repository description](../../../rapp-playwright/README.md)
-identifies a Railiance wrapper for a Playwright and headless Chromium environment
-supporting use-case testing. Service availability is **planned**, not verified:
-this record has no confirmed endpoint, consumption contract or launch receipt yet.
-The current **D3 / A2 / C2 / R2** vector continues to describe evidenced source reuse.
+**rapp-playwright 0.1.0 is published and verified as a local container provider.**
+The current vector is **D3 / A5 / C2 / R2**. A5 means a deployable container under
+[the maturity standard](../../specs/CapabilityMaturityStandard.md); managed
+platform operation is A6 and remains **pending Railiance admission**. Source
+examples remain available at A2. No browser is installed on the caller's machine
+by discovery or by running the Python client.
 
-`rapp-playwright` owns the forthcoming browser service. `reuse-surface` owns
-discovery, consumption guidance, maturity assessment and evidence references; it
-does not implement or operate the browser service or install browsers on behalf
-of consumers. Its `owner` field here denotes the maintainer of this registry record.
+`rapp-playwright` owns the browser service; `railiance-platform` owns managed
+lifecycle admission. `reuse-surface` owns this record, discovery, consumption
+guidance and evidence assessment. The
+[content-explorer intake](../../intakes/REUSE-IN-0001-headless-browser-runnable-answer.md)
+concerns registry relevance and availability clarity; CONTENT-WP-0000-T04
+acceptance remains with the consumer.
 
-The [content-explorer feedback](../../intakes/REUSE-IN-0001-headless-browser-runnable-answer.md)
-is retained as consumer evidence. Browser delivery is assigned to the provider;
-the reported relevance, false-`new` verdict and availability-clarity issues remain
-reuse-surface concerns. A2 means source/library reuse, not proof of a locally
-installed browser. The service announcement does not complete the consumer's
-screenshot and keyboard-walkthrough task.
+### Verified client path
+
+Only Python 3.10+ is needed by the consumer. Download the single revision-pinned
+client into a working directory; a sibling checkout is not required:
+
+```sh
+curl -fL --output rapp_playwright.py https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
+python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight
+python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01
+```
+
+Use a fresh output directory for each run. Port **18083** was verified on this
+workstation on **2026-10-13**; it is an ephemeral local provider, not a permanent
+or remotely reachable endpoint. Preflight must report `available: true`, API 1,
+service 0.1.0, Playwright **1.64.0**, Chromium **156.0.8078.4**, and the expected
+release/location. Connection failure means the provider or tunnel is unavailable,
+not that another browser capability is needed. Use the local setup below or the
+source-adaptation fallback. Repeat `--url` on later status/download commands.
+
+The fixture trial checks Tab focus, Enter activation and the counter assertion
+across **1280×800** and **390×844** viewports, then downloads screenshots and a
+receipt. It does not inspect or accept the consumer's own UI. `run.json` is a
+private run handle and must not be published. For `trial`/`run`, exit 0 means
+passed, 2 means UI assertion failed, and 3 means infrastructure/setup or another
+unsuccessful result; `status` exit 0 only means retrieval succeeded.
+
+### Reproduce the local provider
+
+The published release targets **linux/amd64**. With Docker and image pull access,
+start the immutable container in one terminal, then point the client at port
+**18081** in another:
+
+```sh
+docker run --rm --name rapp-playwright-local --read-only \
+  --tmpfs /tmp:rw,size=512m --shm-size=256m --memory=1g --cpus=1 \
+  --cap-drop ALL --security-opt no-new-privileges \
+  --mount type=volume,src=rapp-playwright-local-data,dst=/data \
+  -p 127.0.0.1:18081:8080 -e HOST=0.0.0.0 \
+  -e EXECUTION_LOCATION=workstation-container \
+  -e RELEASE_ID=sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 \
+  forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441
+python3 rapp_playwright.py --url http://127.0.0.1:18081 preflight
+python3 rapp_playwright.py --url http://127.0.0.1:18081 trial --out trial-local-01
+```
+
+This is the provider's documented local setup with the published digest pinned;
+it was not redeployed by this registry review. Existing independent final-release
+receipts and the fresh discovery trial use the same digest. The default fixture
+requires no external target grant. The provider supports trusted/synthetic pages,
+not hostile-page or mutually untrusted tenant execution.
+
+### Conditional managed path
+
+Only **after platform admission, deployment and caller access are confirmed**:
+
+```sh
+kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1
+# In another terminal, while the tunnel remains running:
+python3 rapp_playwright.py preflight
+python3 rapp_playwright.py trial --out trial-managed-01
+```
+
+No managed deployment or successful managed invocation is claimed here. A remote
+browser's localhost belongs to the provider. Consumer applications need a
+provider-reachable, explicitly allowed origin; the browser API tunnel does not
+forward a workstation app. See the provider contract before running a target
+scenario.
+
+### Pinned delivery evidence
+
+All provider links below are pinned to published commit
+`8831a05aeba5ce588f3b395ade676dde2a151c5d`:
+
+- [Consumer contract](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md).
+- [Release manifest](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json)
+  and [publication/pull evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md).
+- [Independent consumer evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md),
+  including final-release screenshots, keyboard assertions, wrong-token rejection,
+  UI failure and unavailable-service results. These are retained provider-side
+  reports; this review separately verified the fixture path.
+- [Fresh registry review and trial](../../docs/evidence/2026-10-13-browser-discovery.md).
 
 ## Existing implementations
 
@@ -196,15 +305,14 @@ copy its workstation paths as a portable browser installation recipe.
 - **Firefox/WebKit:** Playwright supports both upstream. Firefox has retained
   experiment evidence here; WebKit has no verified local example in this record.
 
-## Practical trial for the consuming worker
+## Source-adaptation fallback for the consuming worker
 
 1. Query this checkout with `python3 -m reuse_surface.cli query --keyword browser`
    from the reuse-surface root, then open this entry. If the CLI is installed,
    `reuse-surface query --keyword browser` is equivalent.
-   `plan-check --intent "headless browser" --no-llm` also includes this candidate,
-   but its token-overlap thresholds and maturity tie-breaking currently return
-   `new` for this short query. That verdict does not establish absence of reuse;
-   use the explicit keyword query and read the evidence for this trial.
+   `plan-check --intent "headless browser" --no-llm` ranks this entry first.
+   Its reuse verdict describes relevance; provider preflight determines current
+   runtime availability. Use source adaptation when the provider path is unsuitable.
 2. Pick the example matching the target repo's language and task. Inspect its
    fixture/server assumptions before adapting the smallest useful test or script.
 3. Use the target repo's package manager and lockfile. Select a compatible
diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml
index 23698cb..21ca35a 100644
--- a/registry/indexes/capabilities.yaml
+++ b/registry/indexes/capabilities.yaml
@@ -6,18 +6,25 @@ capabilities:
   - id: capability.infotech.headless-browser
     name: Headless Browser Automation
     summary: >-
-      Headless browser automation with Playwright and Chromium for UI testing,
-      screenshots and page extraction; recommended default based on existing
-      whynot-design, coulomb-social, core-hub and frontend-patterns implementations.
-      A rapp-playwright-provided service will be available shortly (announced
-      2026-10-13; planned, not yet verified available).
-    vector: D3 / A2 / C2 / R2
+      Headless browser automation, screenshots and keyboard trials through
+      rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4).
+      Published A5 local container; managed Railiance admission is pending.
+      Download the Python 3.10+ standalone client from
+      https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
+      and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`,
+      then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
+      with a fresh output directory. This endpoint was verified locally on 2026-10-13
+      and is ephemeral; it installs no browser for the caller. If unreachable,
+      follow the local container setup in the capability card or adapt its A2 source
+      examples; this is an availability gap on the existing capability.
+      Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
+    vector: D3 / A5 / C2 / R2
     domain: infotech
     status: reviewed
     owner: reuse-surface
     path: registry/capabilities/capability.infotech.headless-browser.md
     tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer]
-    consumption_modes: [informational, source adaptation, JavaScript library, Python library]
+    consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container]
 
   - id: capability.registry.register
     name: Capability Registration
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 8672c50..ba26a8e 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -943,12 +943,17 @@ capabilities:
   source_index: registry/federation/cache/email-connect.yaml
 - id: capability.infotech.headless-browser
   name: Headless Browser Automation
-  summary: Headless browser automation with Playwright and Chromium for UI testing,
-    screenshots and page extraction; recommended default based on existing whynot-design,
-    coulomb-social, core-hub and frontend-patterns implementations. A rapp-playwright-provided
-    service will be available shortly (announced 2026-10-13; planned, not yet verified
-    available).
-  vector: D3 / A2 / C2 / R2
+  summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright
+    0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container;
+    managed Railiance admission is pending. Download the Python 3.10+ standalone client
+    from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
+    and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then
+    `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
+    with a fresh output directory. This endpoint was verified locally on 2026-10-13
+    and is ephemeral; it installs no browser for the caller. If unreachable, follow
+    the local container setup in the capability card or adapt its A2 source examples;
+    this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.'
+  vector: D3 / A5 / C2 / R2
   domain: infotech
   status: reviewed
   owner: reuse-surface
@@ -971,6 +976,9 @@ capabilities:
   - source adaptation
   - JavaScript library
   - Python library
+  - cli
+  - service API
+  - container
   source_repo: reuse-surface
   source_index: registry/indexes/capabilities.yaml
 - id: capability.infotech.hub-core-library
diff --git a/reuse_surface/plan_check.py b/reuse_surface/plan_check.py
index 9118bba..7d424b6 100644
--- a/reuse_surface/plan_check.py
+++ b/reuse_surface/plan_check.py
@@ -147,7 +147,14 @@ def match_query(
         tokens = _tokens(blob)
         if not tokens:
             continue
-        score = len(query.tokens & tokens) / len(query.tokens | tokens)
+        # Score the name independently: descriptive summaries must not dilute
+        # a direct short-intent match (e.g. "headless browser"). Keep the full
+        # blob score for longer intents and summary/tag-only matches.
+        name_tokens = _tokens(item.get("name", ""))
+        score = max(
+            len(query.tokens & tokens) / len(query.tokens | tokens),
+            len(query.tokens & name_tokens) / len(query.tokens | name_tokens),
+        )
         if score <= 0:
             continue
         scored.append(
@@ -340,7 +347,7 @@ def format_plan_check_markdown(result: dict[str, Any]) -> str:
 
     verdict = result["verdict"]
     if verdict == "reuse":
-        lines.append("**Verdict: REUSE** — an existing capability already covers this; link it instead of building new.")
+        lines.append("**Verdict: REUSE** — a close lexical match exists; review its consumption contract and availability before adopting it.")
     elif verdict == "extend":
         lines.append("**Verdict: EXTEND** — scope overlaps closely enough that extending the top match is likely cheaper than a new capability.")
     else:
diff --git a/specs/PlanCheck.md b/specs/PlanCheck.md
index 61b71f1..224f01c 100644
--- a/specs/PlanCheck.md
+++ b/specs/PlanCheck.md
@@ -61,9 +61,11 @@ Reuses the token-Jaccard approach already proven in `overlaps.py`
 same codebase:
 
 1. **Tokenize** the query blob with the existing `TOKEN_RE`.
-2. **Score** against every federated capability's blob (`name` + `summary` +
-   `tags` + `discovery.intent` + `discovery.includes`, mirroring
-   `overlaps._entry_blob`) via Jaccard similarity.
+2. **Score** with the maximum of two token-Jaccard similarities: query versus
+   capability `name`, and query versus `name` + `summary` + `tags`.
+   Scoring the name separately prevents detailed summaries and consumption
+   instructions from diluting a short direct query such as "headless browser".
+   Summary/tag matches and longer intents retain the full-blob signal.
 3. **Rank signal, not just tie-break:** among candidates within
    `--tie-window` (default 0.05) of the top score, prefer the entry with the
    higher discovery/availability vector (a more mature capability is a safer
@@ -76,7 +78,7 @@ same codebase:
 
 | Verdict | Condition | Meaning |
 |---|---|---|
-| `reuse` | top score ≥ `--reuse-threshold` (default 0.45) | An existing capability already covers this need — link it, don't rebuild it. |
+| `reuse` | top score ≥ `--reuse-threshold` (default 0.45) | A close lexical match exists; review its consumption contract and availability before adoption. |
 | `extend` | top score in `[--extend-threshold, --reuse-threshold)` (default 0.22–0.45) | Scope overlaps a capability closely enough that extending it is very likely cheaper than a new one — surfaced with an explicit "consider extending" framing. |
 | `new` | top score < `--extend-threshold`, or no federated capabilities exist | No good match. Proceed; optionally file a capability request (T04). |
 
@@ -86,6 +88,12 @@ the same threshold reasoning as `overlaps.py`'s `--threshold 0.28` default,
 shifted since plan-check matches short intent text against short summaries
 rather than long entry-to-entry blobs.
 
+Verdicts describe relevance, not runtime readiness. A source-only candidate or
+an unavailable endpoint is an availability gap on the existing capability, not
+evidence that a second capability should be built. The match summary carries
+provider consumption guidance where published; callers must run its preflight
+and respect any local-only or managed-admission conditions.
+
 ## 6. Output
 
 ### Markdown (TTY default)
diff --git a/tests/test_hosted_plan_check.py b/tests/test_hosted_plan_check.py
index df687a6..35256fc 100644
--- a/tests/test_hosted_plan_check.py
+++ b/tests/test_hosted_plan_check.py
@@ -58,6 +58,31 @@ def test_hosted_only_capability_and_provenance_without_local_fallback(monkeypatc
     assert result["index_source"]["capability_count"] == 1
 
 
+def test_hosted_browser_discovery_includes_conditional_trial_guidance(monkeypatch, capsys):
+    from reuse_surface.registry import load_index
+
+    browser = next(item for item in load_index()["capabilities"]
+                   if item["id"] == "capability.infotech.headless-browser")
+    payload = snapshot()
+    payload["capabilities"] = [
+        {"id": "capability.example.headless", "name": "Headless Knowledge Engine",
+         "summary": "Headless information management", "tags": [],
+         "vector": "D7 / A7 / C6 / R6"},
+        browser,
+    ]
+    serve(monkeypatch, payload)
+    assert main(["plan-check", "--intent", "headless browser", "--hub-url",
+                 "https://registry.example", "--no-llm", "--format", "json"]) == 0
+    result = json.loads(capsys.readouterr().out)
+    assert result["verdict"] == "reuse"
+    assert result["matches"][0]["id"] == browser["id"]
+    summary = result["matches"][0]["summary"]
+    assert "rapp_playwright.py" in summary
+    assert "preflight" in summary and "trial --out" in summary
+    assert "ephemeral" in summary and "admission is pending" in summary
+    assert "availability gap" in summary
+
+
 @pytest.mark.parametrize("change", [
     {"stale": True}, {"stale": None}, {"composed_at": None},
     {"composed_at": "2020-01-01T00:00:00Z"},
diff --git a/tests/test_plan_check.py b/tests/test_plan_check.py
index fd9fccb..6cdaba5 100644
--- a/tests/test_plan_check.py
+++ b/tests/test_plan_check.py
@@ -80,6 +80,63 @@ def test_match_query_no_capabilities():
     assert match_query(query, []) == []
 
 
+def test_short_browser_intent_outranks_mature_headless_services(monkeypatch):
+    browser = {
+        "id": "capability.infotech.headless-browser",
+        "name": "Headless Browser Automation",
+        "summary": "Playwright Chromium screenshots keyboard " + " ".join(
+            f"detail{i}" for i in range(100)
+        ),
+        "vector": "D3 / A2 / C2 / R2",
+        "tags": ["headless", "browser"],
+    }
+    other = {
+        "id": "capability.communication.context-engine",
+        "name": "Context Engine",
+        "summary": "Headless knowledge operations",
+        "vector": "D7 / A7 / C6 / R6",
+    }
+    monkeypatch.setattr(
+        "reuse_surface.plan_check.load_federated_capabilities",
+        lambda: ([other, browser], _recent_date()),
+    )
+    result = run_plan_check(load_query_from_intent("headless browser"), use_llm=False)
+    assert result["verdict"] == "reuse"
+    assert result["matches"][0]["id"] == browser["id"]
+    assert result["matches"][0]["score"] > result["matches"][1]["score"]
+    assert maybe_file_capability_request(
+        result, requesting_domain="infotech", requesting_agent="test"
+    ) is None
+
+    # Extra operational documentation must not turn a direct name match into NEW.
+    original_score = result["top_score"]
+    browser["summary"] += " " + " ".join(f"command{i}" for i in range(100))
+    repeated = run_plan_check(load_query_from_intent("headless browser"), use_llm=False)
+    assert repeated["top_score"] == original_score
+
+
+def test_summary_only_matching_survives_name_scoring():
+    query = load_query_from_intent("responsive screenshots keyboard assertions")
+    matches = match_query(query, [{
+        "id": "capability.infotech.headless-browser",
+        "name": "Browser Automation",
+        "summary": "Responsive screenshots keyboard assertions",
+    }])
+    assert verdict_for_score(matches[0].score) == "reuse"
+
+
+def test_maturity_still_breaks_equally_relevant_name_ties():
+    candidates = [
+        {"id": "capability.example.early", "name": "Browser Automation",
+         "summary": "Early implementation", "vector": "D2 / A2 / C1 / R1"},
+        {"id": "capability.example.mature", "name": "Browser Automation",
+         "summary": "Documented implementation", "vector": "D4 / A5 / C3 / R3"},
+    ]
+    matches = match_query(load_query_from_intent("browser automation"), candidates)
+    assert matches[0].id == "capability.example.mature"
+    assert matches[0].score == matches[1].score
+
+
 def test_load_query_from_workplan(tmp_path):
     workplan = tmp_path / "TEST-WP-0001-thing.md"
     workplan.write_text(
diff --git a/tests/test_stats.py b/tests/test_stats.py
index 339670e..d5f47e0 100644
--- a/tests/test_stats.py
+++ b/tests/test_stats.py
@@ -2,6 +2,8 @@ from __future__ import annotations
 
 from pathlib import Path
 
+import pytest
+
 from reuse_surface.stats import (
     collect_roster_stats,
     collect_stats,
@@ -10,19 +12,36 @@ from reuse_surface.stats import (
 )
 
 
-def test_collect_stats_on_repo_root():
-    root = Path(__file__).resolve().parent.parent
-    stats = collect_stats(root)
+@pytest.fixture
+def stats_repo(tmp_path, monkeypatch):
+    monkeypatch.delenv("REUSE_SURFACE_URL", raising=False)
+    index = tmp_path / "registry/indexes/capabilities.yaml"
+    index.parent.mkdir(parents=True)
+    index.write_text("""version: 1
+domain: infotech
+capabilities:
+  - id: capability.example.source
+    vector: D3 / A2 / C2 / R2
+    path: registry/capabilities/source.md
+  - id: capability.example.service
+    vector: D4 / A5 / C3 / R3
+    path: registry/capabilities/service.md
+""")
+    return tmp_path
+
+
+def test_collect_stats_on_repo_root(stats_repo):
+    stats = collect_stats(stats_repo)
     assert stats["capability_count"] == 2
     assert stats["index_present"] is True
-    assert "discovery" in stats["histograms"]
+    assert stats["histograms"]["discovery"]["D3"] == 1
+    assert stats["histograms"]["discovery"]["D4"] == 1
+    assert stats["reliability"] == {"r0_r2": 1, "r3_plus": 1}
 
 
-def test_format_stats_markdown_contains_count():
-    root = Path(__file__).resolve().parent.parent
-    text = format_stats_markdown(collect_stats(root))
-    assert "Capabilities:" in text
-    assert "2" in text
+def test_format_stats_markdown_contains_count(stats_repo):
+    text = format_stats_markdown(collect_stats(stats_repo))
+    assert "**Capabilities:** 2" in text
 
 
 def test_collect_roster_stats_federation_ready():
diff --git a/workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md b/workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md
new file mode 100644
index 0000000..cf3decd
--- /dev/null
+++ b/workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md
@@ -0,0 +1,76 @@
+---
+id: REUSE-WP-0024
+type: workplan
+title: "Resolve browser discovery relevance and publish verified provider consumption"
+domain: infotech
+repo: reuse-surface
+status: active
+owner: codex
+origin: cross-repo
+origin_ref: REUSE-IN-0001
+created: "2026-10-13"
+updated: "2026-10-13"
+state_hub_workstream_id: "3d62d0af-5deb-55b5-b570-e62f05a43666"
+---
+
+# Browser discovery and provider evidence
+
+Reviewed against the current checkout and rapp-playwright's published 0.1.0
+contract, immutable release and independent consumer receipts. All prior
+workplans are closed. REUSE-IN-0001 and the October 13 provider inbox handoffs
+are the remaining actionable work. User authorized review, implementation,
+commit and synchronization.
+
+## Publish the verified provider path
+
+```task
+id: REUSE-WP-0024-T01
+status: done
+priority: high
+state_hub_task_id: "dd75f033-02f1-521e-b5c3-cddb5dce80df"
+```
+
+Update the existing capability, index and generated views with pinned public
+client/contract/release/evidence links and executable preflight/trial guidance.
+Assess maturity against the standard; distinguish deployable local container
+availability from pending managed platform admission and ephemeral endpoints.
+Retain the source-adaptation fallback. No second browser capability or consumer
+task closure. Verify published sources and the available local fixture path.
+
+## Fix short-intent relevance
+
+```task
+id: REUSE-WP-0024-T02
+status: done
+priority: high
+state_hub_task_id: "a689bc2a-a112-59d4-b00c-f6934665dffb"
+```
+
+Keep deterministic token matching, but score capability names separately so
+long summaries cannot dilute a direct name match. Test browser versus unrelated
+headless services, unrelated queries, long descriptions, and maturity ties.
+Make reuse advice distinguish lexical relevance from runtime availability.
+Verify the same behavior against the hosted snapshot using the local CLI.
+
+## Validate, publish and synchronize
+
+```task
+id: REUSE-WP-0024-T03
+status: progress
+priority: medium
+state_hub_task_id: "0be283ba-12da-52a1-b1af-0c2d6dcb58f1"
+```
+
+Run the appropriate tests and registry/generated-artifact checks. Commit and
+push, refresh hosted federation, retain public readback evidence, reconcile
+REUSE-IN-0001 and workplan statuses, and log progress to State Hub. Browser
+deployment and CONTENT-WP-0000-T04 acceptance remain their owners' work.
+
+## Implementation evidence
+
+See [review and trial receipts](../docs/evidence/2026-10-13-browser-discovery.md).
+The published client passed 14 fixture steps and produced four independently
+checked screenshots. Availability is now A5 for the published local container;
+A6 managed admission remains pending. Name scoring ranks the browser first at
+0.6667 instead of returning false-new. Replaced stale live-registry stats
+assumptions with a controlled fixture after the full suite exposed them.

From a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Tue, 13 Oct 2026 20:52:04 +0200
Subject: [PATCH 29/55] Record hosted browser readback and close synchronized
 discovery work

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13690-1c84-77a2-aeee-7f517ec60f5d
---
 .custodian-brief.md                           | 15 +----
 WORK-RECORDS.md                               | 10 +--
 docs/evidence/2026-10-13-browser-discovery.md | 33 +++++++++-
 .../hosted-plan-check.json                    | 66 +++++++++++++++++++
 .../hosted-readback.json                      | 43 ++++++++++++
 ...N-0001-headless-browser-runnable-answer.md | 29 +++++++-
 ...browser-discovery-and-provider-evidence.md | 12 +++-
 7 files changed, 186 insertions(+), 22 deletions(-)
 create mode 100644 docs/evidence/2026-10-13-browser-discovery/hosted-plan-check.json
 create mode 100644 docs/evidence/2026-10-13-browser-discovery/hosted-readback.json

diff --git a/.custodian-brief.md b/.custodian-brief.md
index acae414..ade9bcf 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,23 +2,12 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-13 18:43 UTC  
+**Last synced:** 2026-10-13 18:50 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-### Resolve browser discovery relevance and publish verified provider consumption
-Progress: 0/3 done  |  workplan_id: `3d62d0af-5deb-55b5-b570-e62f05a43666`
-
-**Open tasks:**
-- ► Publish the verified provider path  `dd75f033`
-- · Fix short-intent relevance  `a689bc2a`
-- · Validate, publish and synchronize  `0be283ba`
-
-## Inbox Hygiene
-
-**Stale unread:** 2 message(s) older than 3 day(s) — triage at session start.
-**Missing thread_id:** 2 unread message(s) lack supersession chains.
+*(none — repo may need first-session setup)*
 
 ---
 ## MCP Orientation (when available)
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index 2b2c7aa..e2a1123 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -10,12 +10,12 @@
 | --- | --- | --- | --- | --- |
 | workplan | ADHOC-2026-10-13 | finished | — | workplans/ADHOC-2026-10-13.md |
 | workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
-| workplan | REUSE-WP-0024 | active | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| workplan | REUSE-WP-0024 | finished | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
 | task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
-| task | REUSE-WP-0024-T01 | progress | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
-| task | REUSE-WP-0024-T02 | todo | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
-| task | REUSE-WP-0024-T03 | todo | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
-| intake | REUSE-IN-0001 | open | green | intakes/REUSE-IN-0001-headless-browser-runnable-answer.md |
+| task | REUSE-WP-0024-T01 | done | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| task | REUSE-WP-0024-T02 | done | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| task | REUSE-WP-0024-T03 | done | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| intake | REUSE-IN-0001 | closed | green | intakes/REUSE-IN-0001-headless-browser-runnable-answer.md |
diff --git a/docs/evidence/2026-10-13-browser-discovery.md b/docs/evidence/2026-10-13-browser-discovery.md
index d2c3287..edc34b9 100644
--- a/docs/evidence/2026-10-13-browser-discovery.md
+++ b/docs/evidence/2026-10-13-browser-discovery.md
@@ -81,4 +81,35 @@ two capabilities.
 - `validate --relations --fail-on-warnings`: **3 entries valid**.
 - `catalog`, `graph --check`, and `federation compose`: generated successfully;
   **66 federated capabilities**, preserving one browser capability.
-- `git diff --check`: clean.
+- Whitespace check passed apart from intentional Markdown hard breaks in the
+  generated Custodian brief.
+
+## Publication and hosted readback
+
+Implementation commit **`50077c9`** pushed to `origin/main`. Public raw capability
+and index documents matched the committed files byte for byte. Refreshed
+`https://reuse.coulomb.social/v1/federated?refresh=true` at **18:49:02 UTC**:
+`stale: false`, no federation warnings, **66 capabilities**, exactly one browser
+entry at **D3 / A5 / C2 / R2**.
+
+The updated local CLI queried this hosted snapshot with `--intent "headless
+browser" --no-llm`: browser first, score **0.6667**, verdict **reuse**, with the
+client and conditional availability guidance in the returned summary. Matching
+runs in the CLI against the hosted index; no server code deployment was needed.
+
+- [Hosted entry readback](2026-10-13-browser-discovery/hosted-readback.json)
+- [Hosted-snapshot plan-check](2026-10-13-browser-discovery/hosted-plan-check.json)
+
+REUSE-IN-0001 is closed for registry discovery/consumption concerns. Provider
+managed admission and consumer application acceptance remain outside this closure.
+
+`statehub fix-consistency --repo reuse-surface --json` synchronized the finished
+workplan and all three done tasks with zero failures or automation errors. Its
+generated brief/index are included with the closure commit; the automatic
+generated-only commit was refused by the existing Git hook. Four pre-existing
+repository-classification advisories remain. A plain intake status PATCH returned
+HTTP 500 because closure requires an outcome. Used the supported intake `/close`
+transition with `outcome: promoted`, `promoted_to: REUSE-WP-0024` after recording
+those fields in the canonical file.
+Inbox handoffs and standing notices were read/acknowledged. Progress receipt:
+`898a9638-09b8-44fa-8e04-5970c7cd2bbc`.
diff --git a/docs/evidence/2026-10-13-browser-discovery/hosted-plan-check.json b/docs/evidence/2026-10-13-browser-discovery/hosted-plan-check.json
new file mode 100644
index 0000000..62732b7
--- /dev/null
+++ b/docs/evidence/2026-10-13-browser-discovery/hosted-plan-check.json
@@ -0,0 +1,66 @@
+{
+  "query": {
+    "source": "intent",
+    "text": "headless browser",
+    "workplan_id": null,
+    "workplan_path": null
+  },
+  "verdict": "reuse",
+  "top_score": 0.6667,
+  "matches": [
+    {
+      "id": "capability.infotech.headless-browser",
+      "score": 0.6667,
+      "vector": "D3 / A5 / C2 / R2",
+      "owner": "reuse-surface",
+      "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.",
+      "kind": "deterministic"
+    },
+    {
+      "id": "capability.identity.user-engine",
+      "score": 0.2,
+      "vector": "D4 / A1 / C2 / R0",
+      "owner": "user-engine",
+      "summary": "Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.",
+      "kind": "deterministic"
+    },
+    {
+      "id": "capability.infotech.pdf-evidence-ingest",
+      "score": 0.2,
+      "vector": "D2 / A1 / C1 / R1",
+      "owner": "evidence-source",
+      "summary": "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling.",
+      "kind": "deterministic"
+    },
+    {
+      "id": "capability.communication.context-engine",
+      "score": 0.0476,
+      "vector": "D4 / A1 / C1 / R0",
+      "owner": "kontextual-engine",
+      "summary": "Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge.",
+      "kind": "deterministic"
+    },
+    {
+      "id": "capability.infotech.email-connector",
+      "score": 0.0476,
+      "vector": "D2 / A1 / C1 / R0",
+      "owner": "email-connect",
+      "summary": "Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports.",
+      "kind": "deterministic"
+    }
+  ],
+  "federated_index_updated": "2026-10-13",
+  "federated_index_stale_warning": null,
+  "index_source": {
+    "kind": "hosted",
+    "url": "https://reuse.coulomb.social/v1/federated",
+    "fetched_at": "2026-10-13T18:49:10.789378+00:00",
+    "composed_at": "2026-10-13T18:49:02+00:00",
+    "capability_count": 66,
+    "sha256": "59d5c247ac2a769e07f7ac6e464242bc0d3af78bc838b7f31ff995a8a36671e7",
+    "digest_format": "response-bytes",
+    "max_age_hours": 24,
+    "stale": false,
+    "federation_warnings": false
+  }
+}
diff --git a/docs/evidence/2026-10-13-browser-discovery/hosted-readback.json b/docs/evidence/2026-10-13-browser-discovery/hosted-readback.json
new file mode 100644
index 0000000..ae2e8d2
--- /dev/null
+++ b/docs/evidence/2026-10-13-browser-discovery/hosted-readback.json
@@ -0,0 +1,43 @@
+{
+  "composed_at": "2026-10-13T18:49:02+00:00",
+  "updated": "2026-10-13",
+  "stale": false,
+  "capability_count": 66,
+  "federation_warnings": null,
+  "browser": {
+    "id": "capability.infotech.headless-browser",
+    "name": "Headless Browser Automation",
+    "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.",
+    "vector": "D3 / A5 / C2 / R2",
+    "domain": "infotech",
+    "status": "reviewed",
+    "owner": "reuse-surface",
+    "path": "registry/capabilities/capability.infotech.headless-browser.md",
+    "tags": [
+      "headless",
+      "browser",
+      "automation",
+      "playwright",
+      "chromium",
+      "testing",
+      "screenshots",
+      "extraction",
+      "firefox",
+      "webkit",
+      "selenium",
+      "puppeteer"
+    ],
+    "consumption_modes": [
+      "informational",
+      "source adaptation",
+      "JavaScript library",
+      "Python library",
+      "cli",
+      "service API",
+      "container"
+    ],
+    "source_repo": "reuse-surface",
+    "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml",
+    "source_index": "/data/cache/reuse-surface.yaml"
+  }
+}
diff --git a/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
index 15cd89f..145f407 100644
--- a/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
+++ b/intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
@@ -4,7 +4,9 @@
 id: REUSE-IN-0001
 kind: intake
 title: "Answer a headless-browser request with a runnable trial, or say the gap is availability"
-status: open
+status: closed
+outcome: promoted
+promoted_to: REUSE-WP-0024
 lane: green
 flavor: implementation
 origin: cross-repo
@@ -81,3 +83,28 @@ description: >
   the consumer's task and is not completed by this announcement.
 state_hub_intake_id: "01a13530-89a8-77b0-bb95-ef16d74bb29b"
 ```
+
+## Registry resolution — 2026-10-13
+
+Implemented under REUSE-WP-0024 and published in commit `50077c9`.
+The original description above is retained as the intake history.
+
+- The same browser capability now includes a pinned, downloadable standalone
+  client, exact preflight/trial commands in the query summary, immutable local
+  container setup and conditional managed instructions. No sibling checkout or
+  consumer browser installation is needed for the provider path.
+- A fresh local client-only trial passed all 14 fixture steps; four downloaded
+  PNGs passed independent hash/dimension checks at desktop and narrow sizes.
+  Availability is A5 for the published container, with A2 source reuse retained.
+  The endpoint is ephemeral and managed Railiance admission remains pending.
+- Short-name scoring fixes relevance and false-new behavior. Plan-check using
+  the published hosted snapshot ranks the browser first at 0.6667, verdict
+  `reuse`. Relevance is explicitly separate from runtime readiness; an unavailable
+  provider is an availability gap on this entry.
+- Hosted federation readback at 18:49:02 UTC is fresh, warning-free, and includes
+  one browser capability among 66 entries. Public capability/index bytes match
+  the published commit.
+
+[Review, trial and publication evidence](../docs/evidence/2026-10-13-browser-discovery.md).
+This closes the registry-owned intake, not CONTENT-WP-0000-T04, platform
+admission or consumer application acceptance.
diff --git a/workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md b/workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md
index cf3decd..5641340 100644
--- a/workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md
+++ b/workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Resolve browser discovery relevance and publish verified provider consumption"
 domain: infotech
 repo: reuse-surface
-status: active
+status: finished
 owner: codex
 origin: cross-repo
 origin_ref: REUSE-IN-0001
@@ -56,7 +56,7 @@ Verify the same behavior against the hosted snapshot using the local CLI.
 
 ```task
 id: REUSE-WP-0024-T03
-status: progress
+status: done
 priority: medium
 state_hub_task_id: "0be283ba-12da-52a1-b1af-0c2d6dcb58f1"
 ```
@@ -74,3 +74,11 @@ checked screenshots. Availability is now A5 for the published local container;
 A6 managed admission remains pending. Name scoring ranks the browser first at
 0.6667 instead of returning false-new. Replaced stale live-registry stats
 assumptions with a controlled fixture after the full suite exposed them.
+
+Completed publication: implementation commit `50077c9` pushed to `origin/main`;
+public capability and index bytes match. Hosted readback at 18:49:02 UTC is fresh
+and warning-free, with 66 capabilities and one browser entry. The updated local
+CLI against that snapshot returns browser first, 0.6667, `reuse`; no server code
+deployment was required. All **212 tests** pass, registry validation and graph
+checks pass. REUSE-IN-0001 is closed for the registry-owned concerns. Managed
+admission and consumer acceptance remain with their existing owners.

From bf199707ff7ee9870472622ea73cb180b72acfe3 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 14 Oct 2026 06:44:43 +0200
Subject: [PATCH 30/55] docs(reuse): establish reviewed NetKingdom security
 capabilities

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
---
 .../capability.registry.register.md           | 263 +++++++++---------
 .../capability.registry.validate.md           | 125 +++++----
 registry/indexes/capabilities.yaml            | 121 +++++---
 3 files changed, 282 insertions(+), 227 deletions(-)

diff --git a/registry/capabilities/capability.registry.register.md b/registry/capabilities/capability.registry.register.md
index 05185f9..f873c59 100644
--- a/registry/capabilities/capability.registry.register.md
+++ b/registry/capabilities/capability.registry.register.md
@@ -1,34 +1,35 @@
 ---
 id: capability.registry.register
-name: Capability Registration
-summary: Register a new capability so it becomes visible for planning and implementation reuse.
+name: Capability registry and federation
+summary: Owner Markdown entries, indexes, federation hub and planning queries.
 owner: reuse-surface
 status: draft
 domain: helix_forge
 tags:
-  - registry
-  - governance
-  - meta
-
+- registry
+- governance
+- meta
+- security
+- netkingdom
+- framework-reuse
 maturity:
   discovery:
     current: D3
     target: D5
     confidence: medium
-    rationale: >
-      Core use case UC-RS-001 is documented in specs/UseCaseCatalog.md and the
-      registry model is bounded in INTENT.md, but concrete promotion workflows
+    rationale: 'Core use case UC-RS-001 is documented in specs/UseCaseCatalog.md and
+      the registry model is bounded in INTENT.md, but concrete promotion workflows
       are not yet grounded in registry artifacts.
+
+      '
   availability:
-    current: A4
+    current: A3
     target: A5
     confidence: medium
-    rationale: >
-      Local registry workflows use the reuse-surface CLI (A3). Federation repo
-      registration is also available through the hosted hub HTTP API at
-      reuse.coulomb.social (POST/PATCH /v1/repos), deployed and dogfood-tested
-      on Railiance01 (REUSE-WP-0011).
-
+    rationale: 'Source interface assessed 2026-10-14: Owner Markdown entries, indexes,
+      federation hub and planning queries. Availability describes the delivery form,
+      not production acceptance. Discovery is not readiness; empty and stale entries
+      need evidence-led maintenance.'
 external_evidence:
   completeness:
     level: C2
@@ -36,164 +37,162 @@ external_evidence:
     confidence: medium
     basis: scope_vs_intent_and_consumer_expectations
     satisfied_expectations:
-      - capability IDs can be assigned in registry entries
-      - maturity vectors can be recorded at registration time
-      - CLI validate, query, and export support registry workflows
-      - promotion history can be recorded in entries
-      - federation repo registration via hosted hub API and hub CLI
+    - capability IDs can be assigned in registry entries
+    - maturity vectors can be recorded at registration time
+    - CLI validate, query, and export support registry workflows
+    - promotion history can be recorded in entries
+    - federation repo registration via hosted hub API and hub CLI
     broken_expectations:
-      - no automated duplicate detection yet
+    - no automated duplicate detection yet
     out_of_scope_expectations:
-      - hosting registered capabilities
-      - enforcing implementation architecture
+    - hosting registered capabilities
+    - enforcing implementation architecture
   reliability:
     level: R3
     name: Usable
     confidence: medium
     basis: consumer_quality_signals
     known_reliability_risks:
-      - index drift still possible if authors skip validate
-      - CLI requires local venv install
-      - sibling repos cannot register until indexes publish raw URLs
+    - index drift still possible if authors skip validate
+    - CLI requires local venv install
+    - sibling repos cannot register until indexes publish raw URLs
     evidence:
       satisfied_signals:
-        - CI validate with fail-on-warnings on every push
-        - hub register/list/federated smoke on production reuse.coulomb.social
-        - pytest coverage for hub API and federation compose paths
-
+      - CI validate with fail-on-warnings on every push
+      - hub register/list/federated smoke on production reuse.coulomb.social
+      - pytest coverage for hub API and federation compose paths
 discovery:
-  intent: >
-    Make a capability candidate visible in the registry so humans and agents can
-    discover, assess, compare, and reuse it instead of rebuilding it in isolation.
+  intent: Owner Markdown entries, indexes, federation hub and planning queries
   includes:
-    - stable capability ID assignment
-    - initial discovery and availability classification
-    - explicit completeness and reliability placeholders
-    - evidence and relation references
+  - Owner Markdown entries, indexes, federation hub and planning queries
   excludes:
-    - implementing the registered capability
-    - certifying implementation quality
-    - operating runtime services for registered capabilities
+  - Discovery is not readiness; empty and stale entries need evidence-led maintenance
   assumptions:
-    - unregistered capabilities are invisible for registry-driven reuse
-    - low-maturity entries are acceptable when evidence gaps are explicit
+  - unregistered capabilities are invisible for registry-driven reuse
+  - low-maturity entries are acceptable when evidence gaps are explicit
   use_cases:
-    - UC-RS-001
+  - UC-RS-001
+  - 'U01: Architect composes a security deployment from explicit owner contracts and
+    case types'
+  - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and
+    verifies outcomes'
+  - 'U14: Framework adopter validates and reuses selected contracts, tools and reference
+    compositions'
   research_memos:
-    - specs/UseCaseCatalog.md
-    - specs/ProductRequirementsDocument.md
-
+  - specs/UseCaseCatalog.md
+  - specs/ProductRequirementsDocument.md
 availability:
-  current_level: A4
+  current_level: A3
   target_level: A5
   current_artifacts:
-    - templates/capability-entry.template.md
-    - registry/indexes/capabilities.yaml
-    - reuse_surface/cli.py
-    - reuse_surface/hub/
-    - specs/FederationHubAPI.md
-    - https://reuse.coulomb.social
+  - docs/RegistryFederation.md
+  - specs/CapabilityMaturityStandard.md
   target_artifacts:
-    - packaged container release with documented SLO
+  - packaged container release with documented SLO
   consumption_modes:
-    - informational
-    - markdown authoring
-    - cli
-    - service API
-
+  - library
+  - CLI
 relations:
   depends_on: []
   supports:
-    - capability.feature-control.evaluate
-    - capability.identity.vocabulary-canonicalize
+  - capability.feature-control.evaluate
+  - capability.identity.vocabulary-canonicalize
   related_to:
-    - capability.registry.validate
-
+  - capability.registry.validate
+  - capability.security.iam-tooling-suite
 evidence:
   documentation:
-    - INTENT.md
-    - specs/UseCaseCatalog.md
-    - specs/FederationHubAPI.md
-    - docs/deploy/reuse-kubernetes.md
+  - docs/RegistryFederation.md
+  - specs/CapabilityMaturityStandard.md
   tests:
-    - tests/test_hub.py
-    - tests/test_hub_sync.py
-    - .forgejo/workflows/ci.yml
+  - tests/test_hub.py
+  - tests/test_hub_sync.py
+  - .forgejo/workflows/ci.yml
   consumer_feedback:
-    - >
-        reuse-surface dogfood (REUSE-WP-0011): production hub registration and
-        /v1/federated compose succeeded on Railiance01 without write-path
-        regressions after WP-0011 deploy.
+  - 'reuse-surface dogfood (REUSE-WP-0011): production hub registration and /v1/federated
+    compose succeeded on Railiance01 without write-path regressions after WP-0011
+    deploy.
+
+    '
   bug_reports: []
   incidents: []
-
 consumer_guidance:
   recommended_for:
-    - making a new capability visible at D0/A0/C0/R0 with minimal friction
-    - seeding planning discussions before implementation exists
+  - Architect composes a security deployment from explicit owner contracts and case
+    types
+  - Maintainer observes posture, prioritizes findings, coordinates work and verifies
+    outcomes
+  - Framework adopter validates and reuses selected contracts, tools and reference
+    compositions
   not_recommended_for:
-    - treating registry presence as proof of implementation readiness
-    - skipping explicit evidence for maturity promotion
+  - Discovery is not readiness; empty and stale entries need evidence-led maintenance
   known_limitations:
-    - manual index updates are required after adding an entry
-    - duplicate detection is guidance-only in the MVP
-
+  - Discovery is not readiness; empty and stale entries need evidence-led maintenance
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
 promotion_history:
-  - date: "2026-06-14"
-    dimension: discovery
-    from: D0
-    to: D1
-    rationale: Added name, summary, and registry-first intent from INTENT.md.
-    author: reuse-surface
-  - date: "2026-06-15"
-    dimension: discovery
-    from: D1
-    to: D3
-    rationale: Bounded scope with UC-RS-001 and MVP registry artifacts in specs/.
-    author: reuse-surface
-  - date: "2026-06-15"
-    dimension: availability
-    from: A0
-    to: A3
-    rationale: reuse-surface CLI shipped validate, query, and export commands.
-    author: reuse-surface
-  - date: "2026-06-15"
-    dimension: availability
-    from: A3
-    to: A4
-    rationale: >
-      Hosted federation hub live at reuse.coulomb.social; hub register/update
-      via HTTP API and reuse-surface hub CLI; production deploy on Railiance01.
-    author: reuse-surface
-  - date: "2026-06-16"
-    dimension: reliability
-    from: R2
-    to: R3
-    rationale: >
-      CI gates, pytest hub/federation coverage, and production hub smoke support
-      normal registration workflows with documented limitations.
-    author: reuse-surface
+- date: '2026-06-14'
+  dimension: discovery
+  from: D0
+  to: D1
+  rationale: Added name, summary, and registry-first intent from INTENT.md.
+  author: reuse-surface
+- date: '2026-06-15'
+  dimension: discovery
+  from: D1
+  to: D3
+  rationale: Bounded scope with UC-RS-001 and MVP registry artifacts in specs/.
+  author: reuse-surface
+- date: '2026-06-15'
+  dimension: availability
+  from: A0
+  to: A3
+  rationale: reuse-surface CLI shipped validate, query, and export commands.
+  author: reuse-surface
+- date: '2026-06-15'
+  dimension: availability
+  from: A3
+  to: A4
+  rationale: 'Hosted federation hub live at reuse.coulomb.social; hub register/update
+    via HTTP API and reuse-surface hub CLI; production deploy on Railiance01.
+
+    '
+  author: reuse-surface
+- date: '2026-06-16'
+  dimension: reliability
+  from: R2
+  to: R3
+  rationale: 'CI gates, pytest hub/federation coverage, and production hub smoke support
+    normal registration workflows with documented limitations.
+
+    '
+  author: reuse-surface
+- date: '2026-10-14'
+  dimension: availability
+  from: A4
+  to: A3
+  rationale: Interface-form reassessment from current owner sources; no completeness/reliability
+    promotion.
+  author: codex
 ---
 
-# Capability Registration
+# Capability registry and federation
 
-## Overview
+Owner Markdown entries, indexes, federation hub and planning queries.
 
-Registration is the entry point for reuse visibility. A capability that is not
-registered cannot be discovered through the registry surface, even if code or
-documentation exists elsewhere.
+## Reuse boundary
 
-## Current reuse mode
+Discovery is not readiness; empty and stale entries need evidence-led maintenance.
 
-**Local registry (A3 CLI):** add Markdown entries under `registry/capabilities/`,
-update `registry/indexes/capabilities.yaml`, run `reuse-surface validate`.
+## Supported use cases
 
-**Federation registration (A4 API):** register published index URLs on the hosted
-hub (`reuse-surface hub register`, `POST /v1/repos`) for cross-repo discovery
-via `GET /v1/federated`.
+- U01: Architect composes a security deployment from explicit owner contracts and case types
+- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes
+- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions
 
-## Next promotion steps
+## Evidence and integration
 
-1. Attach concrete use cases and actors to reach D5.
-2. Package hub as a versioned container release with operator SLO (A5).
-3. Record consumer expectations and broken expectations as external evidence.
\ No newline at end of file
+- [docs/RegistryFederation.md](../../docs/RegistryFederation.md)
+- [specs/CapabilityMaturityStandard.md](../../specs/CapabilityMaturityStandard.md)
+
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
diff --git a/registry/capabilities/capability.registry.validate.md b/registry/capabilities/capability.registry.validate.md
index bd68d33..8231e35 100644
--- a/registry/capabilities/capability.registry.validate.md
+++ b/registry/capabilities/capability.registry.validate.md
@@ -1,24 +1,31 @@
 ---
 id: capability.registry.validate
-name: Registry Entry Validation
-summary: Validate capability registry entries against schema, index consistency, and relation integrity.
+name: Capability registry validation
+summary: Schema, index consistency and relation checks.
 owner: reuse-surface
 status: draft
 domain: helix_forge
-tags: [registry, validation, cli]
-
+tags:
+- registry
+- validation
+- cli
+- security
+- netkingdom
+- framework-reuse
 maturity:
   discovery:
     current: D4
     target: D5
     confidence: medium
-    rationale: UC-RS-023 is implemented via reuse-surface validate with schema and drift checks.
+    rationale: UC-RS-023 is implemented via reuse-surface validate with schema and
+      drift checks.
   availability:
     current: A3
     target: A3
     confidence: high
-    rationale: Available as reuse-surface validate CLI command.
-
+    rationale: 'Source interface assessed 2026-10-14: Schema, index consistency and
+      relation checks. Availability describes the delivery form, not production acceptance.
+      Schema validity alone proves neither capability behavior nor hosted freshness.'
 external_evidence:
   completeness:
     level: C3
@@ -26,82 +33,102 @@ external_evidence:
     confidence: medium
     basis: scope_vs_intent_and_consumer_expectations
     satisfied_expectations:
-      - schema validation for entry front matter
-      - index drift detection
-      - optional relation integrity checks
+    - schema validation for entry front matter
+    - index drift detection
+    - optional relation integrity checks
     broken_expectations: []
     out_of_scope_expectations:
-      - runtime validation of registered capability implementations
+    - runtime validation of registered capability implementations
   reliability:
     level: R3
     name: Usable
     confidence: medium
     basis: consumer_quality_signals
     known_reliability_risks:
-      - requires local venv install
-      - relation warnings require explicit --relations flag
+    - requires local venv install
+    - relation warnings require explicit --relations flag
     evidence:
       satisfied_signals:
-        - validate --relations --fail-on-warnings in CI
-        - tests/test_registry.py schema and drift coverage
-
+      - validate --relations --fail-on-warnings in CI
+      - tests/test_registry.py schema and drift coverage
 discovery:
-  intent: Keep registry data structurally sound so agents and humans can trust discovery metadata.
+  intent: Schema, index consistency and relation checks
   includes:
-    - JSON Schema validation
-    - index drift warnings
-    - relation reference checks
+  - Schema, index consistency and relation checks
   excludes:
-    - validating implementation code in other repos
+  - Schema validity alone proves neither capability behavior nor hosted freshness
   use_cases:
-    - UC-RS-023
+  - UC-RS-023
+  - 'U01: Architect composes a security deployment from explicit owner contracts and
+    case types'
+  - 'U14: Framework adopter validates and reuses selected contracts, tools and reference
+    compositions'
   research_memos:
-    - specs/UseCaseCatalog.md
-
+  - specs/UseCaseCatalog.md
 availability:
   current_level: A3
   target_level: A3
   current_artifacts:
-    - reuse_surface/cli.py
-    - schemas/capability.schema.yaml
+  - docs/RegistryFederation.md
+  - schemas/capability.schema.yaml
   consumption_modes:
-    - cli
-
+  - library
+  - CLI
 relations:
   depends_on:
-    - capability.registry.register
+  - capability.registry.register
   supports: []
   related_to:
-    - capability.registry.register
-
+  - capability.registry.register
+  - capability.security.iam-tooling-suite
 evidence:
   documentation:
-    - tools/README.md
-    - .forgejo/workflows/ci.yml
+  - docs/RegistryFederation.md
+  - schemas/capability.schema.yaml
   tests:
-    - tests/test_registry.py
+  - tests/test_registry.py
   consumer_feedback:
-    - >
-        reuse-surface CI: registry changes fail when schema validation or relation
-        checks warn with --fail-on-warnings, giving agents a dependable pre-merge gate.
+  - 'reuse-surface CI: registry changes fail when schema validation or relation checks
+    warn with --fail-on-warnings, giving agents a dependable pre-merge gate.
 
+    '
 consumer_guidance:
   recommended_for:
-    - pre-commit and CI validation of registry changes
+  - Architect composes a security deployment from explicit owner contracts and case
+    types
+  - Framework adopter validates and reuses selected contracts, tools and reference
+    compositions
   not_recommended_for:
-    - certifying business correctness of capability claims
+  - Schema validity alone proves neither capability behavior nor hosted freshness
   known_limitations:
-    - warnings do not fail CI unless --fail-on-warnings is set
-
+  - Schema validity alone proves neither capability behavior nor hosted freshness
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
 promotion_history:
-  - date: "2026-06-16"
-    dimension: reliability
-    from: R2
-    to: R3
-    rationale: CI fail-on-warnings and pytest registry coverage support dependable validation.
-    author: reuse-surface
+- date: '2026-06-16'
+  dimension: reliability
+  from: R2
+  to: R3
+  rationale: CI fail-on-warnings and pytest registry coverage support dependable validation.
+  author: reuse-surface
 ---
 
-# Registry Entry Validation
+# Capability registry validation
 
-Validates registry shape and consistency through the reuse-surface CLI.
\ No newline at end of file
+Schema, index consistency and relation checks.
+
+## Reuse boundary
+
+Schema validity alone proves neither capability behavior nor hosted freshness.
+
+## Supported use cases
+
+- U01: Architect composes a security deployment from explicit owner contracts and case types
+- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions
+
+## Evidence and integration
+
+- [docs/RegistryFederation.md](../../docs/RegistryFederation.md)
+- [schemas/capability.schema.yaml](../../schemas/capability.schema.yaml)
+
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml
index 21ca35a..fecdaac 100644
--- a/registry/indexes/capabilities.yaml
+++ b/registry/indexes/capabilities.yaml
@@ -1,49 +1,78 @@
-# Manually maintained capability index for humans and agents.
 version: 1
-updated: "2026-10-13"
+updated: '2026-10-14'
 domain: helix_forge
 capabilities:
-  - id: capability.infotech.headless-browser
-    name: Headless Browser Automation
-    summary: >-
-      Headless browser automation, screenshots and keyboard trials through
-      rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4).
-      Published A5 local container; managed Railiance admission is pending.
-      Download the Python 3.10+ standalone client from
-      https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
-      and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`,
-      then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
-      with a fresh output directory. This endpoint was verified locally on 2026-10-13
-      and is ephemeral; it installs no browser for the caller. If unreachable,
-      follow the local container setup in the capability card or adapt its A2 source
-      examples; this is an availability gap on the existing capability.
-      Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
-    vector: D3 / A5 / C2 / R2
-    domain: infotech
-    status: reviewed
-    owner: reuse-surface
-    path: registry/capabilities/capability.infotech.headless-browser.md
-    tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer]
-    consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container]
-
-  - id: capability.registry.register
-    name: Capability Registration
-    summary: Register a new capability so it becomes visible for planning and implementation reuse.
-    vector: D3 / A4 / C2 / R3
-    domain: helix_forge
-    status: draft
-    owner: reuse-surface
-    path: registry/capabilities/capability.registry.register.md
-    tags: [registry, governance, meta]
-    consumption_modes: [informational, markdown authoring, cli, service API]
-
-  - id: capability.registry.validate
-    name: Registry Entry Validation
-    summary: Validate capability registry entries against schema, index consistency, and relation integrity.
-    vector: D4 / A3 / C3 / R3
-    domain: helix_forge
-    status: draft
-    owner: reuse-surface
-    path: registry/capabilities/capability.registry.validate.md
-    tags: [registry, validation, cli]
-    consumption_modes: [cli]
+- id: capability.infotech.headless-browser
+  name: Headless Browser Automation
+  summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright
+    0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container;
+    managed Railiance admission is pending. Download the Python 3.10+ standalone client
+    from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
+    and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then
+    `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
+    with a fresh output directory. This endpoint was verified locally on 2026-10-13
+    and is ephemeral; it installs no browser for the caller. If unreachable, follow
+    the local container setup in the capability card or adapt its A2 source examples;
+    this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.'
+  vector: D3 / A5 / C2 / R2
+  domain: infotech
+  status: reviewed
+  owner: reuse-surface
+  path: registry/capabilities/capability.infotech.headless-browser.md
+  tags:
+  - headless
+  - browser
+  - automation
+  - playwright
+  - chromium
+  - testing
+  - screenshots
+  - extraction
+  - firefox
+  - webkit
+  - selenium
+  - puppeteer
+  consumption_modes:
+  - informational
+  - source adaptation
+  - JavaScript library
+  - Python library
+  - cli
+  - service API
+  - container
+- id: capability.registry.register
+  name: Capability registry and federation
+  summary: Owner Markdown entries, indexes, federation hub and planning queries.
+  domain: helix_forge
+  status: draft
+  owner: reuse-surface
+  tags:
+  - registry
+  - governance
+  - meta
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A3 / C2 / R3
+  path: registry/capabilities/capability.registry.register.md
+  consumption_modes:
+  - library
+  - CLI
+- id: capability.registry.validate
+  name: Capability registry validation
+  summary: Schema, index consistency and relation checks.
+  domain: helix_forge
+  status: draft
+  owner: reuse-surface
+  tags:
+  - registry
+  - validation
+  - cli
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A3 / C3 / R3
+  path: registry/capabilities/capability.registry.validate.md
+  consumption_modes:
+  - library
+  - CLI

From 03cd049773478e9de7e38035a49deaa82772a357 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 14 Oct 2026 06:51:28 +0200
Subject: [PATCH 31/55] docs(reuse): wire complete NetKingdom local discovery

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
---
 docs/NetKingdomSecurityDiscovery.md |   27 +
 registry/federation/sources.yaml    |  386 ++++--
 registry/indexes/federated.yaml     | 1704 +++++++++++++++++++++------
 3 files changed, 1608 insertions(+), 509 deletions(-)
 create mode 100644 docs/NetKingdomSecurityDiscovery.md

diff --git a/docs/NetKingdomSecurityDiscovery.md b/docs/NetKingdomSecurityDiscovery.md
new file mode 100644
index 0000000..5fe1446
--- /dev/null
+++ b/docs/NetKingdomSecurityDiscovery.md
@@ -0,0 +1,27 @@
+# NetKingdom security capability discovery
+
+The workstation federation includes 70 reviewed security and supporting capabilities from 60 sibling repositories. Two additional inspected repositories are nonproviders: rapp-secrets-engine is retired and rapp-forgejo is a placeholder without a package declaration. The owner capability entries are the reusable source; the architecture assessment is in the-custodian CUST-WP-0081.
+
+## Local discovery
+
+From a reuse-surface checkout beside those repositories:
+
+```sh
+reuse-surface federation compose
+reuse-surface plan-check --intent "bound approval consumption before credential delivery" --no-llm
+reuse-surface plan-check --intent "deterministic posture feedback evidence expiry" --no-llm
+```
+
+The source manifest uses relative sibling paths for the reviewed cohort and requires their indexes to exist. Other federation sources are preserved. A missing sibling is a composition error rather than silent loss of a reviewed capability. The composed local index supports planning; it is not a runtime readiness or authorization grant. `reuse-surface query` searches this repository's own index, while `plan-check` uses the composed federation.
+
+## Hosted discovery
+
+```sh
+reuse-surface plan-check --hub-url https://reuse.coulomb.social --intent "bound approval consumption" --no-llm
+```
+
+As checked on 2026-10-14, all 60 source registry commits are published, while the hosted hub contains 32 of the 70 reviewed capabilities. Thirty-eight new owner registrations remain pending scoped write access: the normal Warden lane was allowed by the PDP but OpenBao refused the current caller with HTTP 403. Seven of those indexes also require admitted private-source read access; anonymous retrieval returns 404. Do not change repository visibility or reuse another workload's credential to make discovery pass.
+
+The seven private sources are rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-telemetry, rapp-tenant-engine, rapp-user-engine and rapp-sbom-nexus. Hosted registration supports an `auth_env` reference to a credential already configured at the hub. Source-owner approval, scoped read provisioning and a successful native fetch must precede their registration. Thirty-one public-source registrations are otherwise ready.
+
+The exact registration plan, source commits, raw retrieval results and local/hosted verification receipts are retained in the-custodian at `docs/assessments/netkingdom-2026-10-14/`. Existing IDs were preserved where valid; the copied Secrets Engine repository-template entry was removed. Registry C/R values retained from older entries remain owner assessments, not renewed evidence.
diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml
index 457f4e6..02a3e22 100644
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -2,20 +2,26 @@ version: 1
 domain: helix_forge
 collision_policy: warn
 sources:
+- repo: access-engine
+  index: ../access-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: activity-core
-  url: https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../activity-core/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: agentic-resources
-  url: https://forgejo.coulomb.social/coulomb/agentic-resources/raw/main/registry/indexes/capabilities.yaml
+  index: ../agentic-resources/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: approval-engine
+  index: ../approval-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: artifact-store
   url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -24,12 +30,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: audit-core
-  url: https://forgejo.coulomb.social/coulomb/audit-core/raw/main/registry/indexes/capabilities.yaml
+  index: ../audit-core/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: can-you-assist
   url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -58,6 +62,13 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: commerce-canon
+  url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
+  enabled: true
+  required: false
+  domain: helix_forge
+  cache_ttl_seconds: 86400
+  auth_header: Authorization
 - repo: config-atlas
   url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -66,12 +77,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: coordination-engine
-  url: https://forgejo.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
+  index: ../coordination-engine/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: core-hub
   url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -93,6 +102,11 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: emergent-security
+  index: ../emergent-security/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: evidence-anchor
   url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -121,13 +135,21 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: access-engine
-  url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
+- repo: fin-hub
+  index: ../fin-hub/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: gate-house
+  index: ../gate-house/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: glas-harness
+  index: ../glas-harness/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: guide-board
   url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -156,13 +178,6 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: commerce-canon
-  url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
 - repo: ihp-railiance-probe
   url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -171,12 +186,15 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: info-tech-canon
-  url: https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/main/registry/indexes/capabilities.yaml
+  index: ../info-tech-canon/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: informed-decision
+  index: ../informed-decision/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: infospace-bench
   url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -185,12 +203,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: issue-core
-  url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../issue-core/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: kaizen-agentic
   url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -199,12 +215,15 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: key-cape
-  url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../key-cape/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: kings-guard
+  index: ../kings-guard/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: kontextual-engine
   url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -247,13 +266,16 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: net-kingdom
-  url: https://forgejo.coulomb.social/coulomb/net-kingdom/raw/main/registry/indexes/capabilities.yaml
+- repo: maturity-engine
+  index: ../maturity-engine/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: net-kingdom
+  index: ../net-kingdom/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: open-cmis-tck
   url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -269,12 +291,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: ops-bridge
-  url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml
+  index: ../ops-bridge/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: ops-hub
   url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -282,13 +302,16 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: ops-warden
-  url: https://forgejo.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
+- repo: ops-mason
+  index: ../ops-mason/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: ops-warden
+  index: ../ops-warden/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: phase-memory
   url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -296,55 +319,131 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: policy-nexus
+  index: ../policy-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rail-knative
+  index: ../rail-knative/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rail-kubernetes
+  index: ../rail-kubernetes/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: railiance-apps
-  url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-apps/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: railiance-bootstrap
+  index: ../railiance-bootstrap/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: railiance-cluster
-  url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-cluster/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-enablement
-  url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-enablement/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-fabric
-  url: https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/main/registry/indexes/capabilities.yaml
+  index: ../railiance-fabric/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-forge
-  url: https://forgejo.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
+  index: ../railiance-forge/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: railiance-infra
-  url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-infra/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: railiance-master
+  index: ../railiance-master/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: railiance-platform
-  url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../railiance-platform/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
+- repo: railiance-telemetry
+  index: ../railiance-telemetry/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-openbao
+  index: ../rapp-openbao/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-playwright
+  index: ../rapp-playwright/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-policy-nexus
+  index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-postgres
+  index: ../rapp-postgres/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-sbom-nexus
+  index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-telemetry
+  index: ../rapp-telemetry/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-tenant-engine
+  index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rapp-user-engine
+  index: ../rapp-user-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: reef-railiance
+  index: ../reef-railiance/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rein-aharness
+  index: ../rein-aharness/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: rein-openweights
+  index: ../rein-openweights/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: repo-manager
+  index: ../repo-manager/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: repo-scoping
   url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -359,13 +458,51 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
-- repo: reuse-surface
-  # Include this checkout's entries in local plan-check before publication.
-  index: registry/indexes/capabilities.yaml
+- repo: resource-control
+  index: ../resource-control/registry/indexes/capabilities.yaml
   enabled: true
   required: true
-  domain: helix_forge
-  description: Capability registry for helix_forge
+  domain: infotech
+- repo: reuse-surface
+  index: ../reuse-surface/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: risk-nexus
+  index: ../risk-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: role-engine
+  index: ../role-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: runbook-tutorials
+  index: ../runbook-tutorials/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: sand-boxer
+  index: ../sand-boxer/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: sbom-nexus
+  index: ../sbom-nexus/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: secrets-engine
+  index: ../secrets-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
+- repo: security-canon
+  index: ../security-canon/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: shard-wiki
   url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -374,12 +511,10 @@ sources:
   cache_ttl_seconds: 86400
   auth_header: Authorization
 - repo: state-hub
-  url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
+  index: ../state-hub/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: tegwick-control
   url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -387,20 +522,21 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: tenant-engine
+  index: ../tenant-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: the-custodian
-  url: https://forgejo.coulomb.social/coulomb/the-custodian/raw/main/registry/indexes/capabilities.yaml
+  index: ../the-custodian/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: user-engine
-  url: https://forgejo.coulomb.social/coulomb/user-engine/raw/main/registry/indexes/capabilities.yaml
+  index: ../user-engine/registry/indexes/capabilities.yaml
   enabled: true
-  required: false
-  domain: helix_forge
-  cache_ttl_seconds: 86400
-  auth_header: Authorization
+  required: true
+  domain: infotech
 - repo: vantage-point
   url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -415,6 +551,11 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: whitehat-security
+  index: ../whitehat-security/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: whynot-control
   url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
   enabled: true
@@ -429,3 +570,8 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: zone-engine
+  index: ../zone-engine/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index ba26a8e..520c63a 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,272 +1,366 @@
-# Composed federated capability index. Regenerate with:
-# reuse-surface federation compose
 version: 1
-updated: '2026-10-13'
+updated: '2026-10-14'
 domain: helix_forge
 collision_policy: warn
 sources:
+- repo: access-engine
+  count: 1
+  index: ../access-engine/registry/indexes/capabilities.yaml
 - repo: activity-core
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/activity-core.yaml
+  index: ../activity-core/registry/indexes/capabilities.yaml
 - repo: agentic-resources
-  count: 0
-  url: https://forgejo.coulomb.social/coulomb/agentic-resources/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/agentic-resources.yaml
+  count: 1
+  index: ../agentic-resources/registry/indexes/capabilities.yaml
+- repo: approval-engine
+  count: 1
+  index: ../approval-engine/registry/indexes/capabilities.yaml
 - repo: artifact-store
   count: 1
   url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/artifact-store.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/artifact-store.yaml
 - repo: audit-core
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/audit-core/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/audit-core.yaml
+  index: ../audit-core/registry/indexes/capabilities.yaml
 - repo: can-you-assist
   count: 1
   url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/can-you-assist.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/can-you-assist.yaml
 - repo: citation-engine
   count: 1
   url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/citation-engine.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/citation-engine.yaml
 - repo: citation-evidence
   count: 1
   url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/citation-evidence.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/citation-evidence.yaml
 - repo: citation-work
   count: 0
   url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/citation-work.yaml
-- repo: config-atlas
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/config-atlas.yaml
-- repo: coordination-engine
-  count: 0
-  url: https://forgejo.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/coordination-engine.yaml
-- repo: core-hub
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/core-hub.yaml
-- repo: domain-tree
-  count: 0
-  url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/domain-tree.yaml
-- repo: email-connect
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/email-connect.yaml
-- repo: evidence-anchor
-  count: 0
-  url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/evidence-anchor.yaml
-- repo: evidence-binder
-  count: 2
-  url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/evidence-binder.yaml
-- repo: evidence-source
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/evidence-source.yaml
-- repo: feature-control
-  count: 3
-  url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/feature-control.yaml
-- repo: access-engine
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/access-engine.yaml
-- repo: guide-board
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/guide-board.yaml
-- repo: helix-forge
-  count: 0
-  url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/helix-forge.yaml
-- repo: hub-core
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/hub-core.yaml
-- repo: human-resources
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/human-resources.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/citation-work.yaml
 - repo: commerce-canon
   count: 2
   url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/commerce-canon.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml
+- repo: config-atlas
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/config-atlas.yaml
+- repo: coordination-engine
+  count: 1
+  index: ../coordination-engine/registry/indexes/capabilities.yaml
+- repo: core-hub
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/core-hub.yaml
+- repo: domain-tree
+  count: 0
+  url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/domain-tree.yaml
+- repo: email-connect
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/email-connect.yaml
+- repo: emergent-security
+  count: 1
+  index: ../emergent-security/registry/indexes/capabilities.yaml
+- repo: evidence-anchor
+  count: 0
+  url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/evidence-anchor.yaml
+- repo: evidence-binder
+  count: 2
+  url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml
+- repo: evidence-source
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/evidence-source.yaml
+- repo: feature-control
+  count: 3
+  url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
+- repo: fin-hub
+  count: 1
+  index: ../fin-hub/registry/indexes/capabilities.yaml
+- repo: gate-house
+  count: 1
+  index: ../gate-house/registry/indexes/capabilities.yaml
+- repo: glas-harness
+  count: 1
+  index: ../glas-harness/registry/indexes/capabilities.yaml
+- repo: guide-board
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/guide-board.yaml
+- repo: helix-forge
+  count: 0
+  url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/helix-forge.yaml
+- repo: hub-core
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/hub-core.yaml
+- repo: human-resources
+  count: 1
+  url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/human-resources.yaml
 - repo: ihp-railiance-probe
   count: 0
   url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/ihp-railiance-probe.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/ihp-railiance-probe.yaml
 - repo: info-tech-canon
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/info-tech-canon.yaml
+  index: ../info-tech-canon/registry/indexes/capabilities.yaml
+- repo: informed-decision
+  count: 1
+  index: ../informed-decision/registry/indexes/capabilities.yaml
 - repo: infospace-bench
   count: 1
   url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/infospace-bench.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/infospace-bench.yaml
 - repo: issue-core
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/issue-core.yaml
+  index: ../issue-core/registry/indexes/capabilities.yaml
 - repo: kaizen-agentic
   count: 1
   url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/kaizen-agentic.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/kaizen-agentic.yaml
 - repo: key-cape
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/key-cape.yaml
+  index: ../key-cape/registry/indexes/capabilities.yaml
+- repo: kings-guard
+  count: 1
+  index: ../kings-guard/registry/indexes/capabilities.yaml
 - repo: kontextual-engine
   count: 1
   url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/kontextual-engine.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/kontextual-engine.yaml
 - repo: llm-connect
   count: 1
   url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/llm-connect.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/llm-connect.yaml
 - repo: markitect-filter
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/markitect-filter.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/markitect-filter.yaml
 - repo: markitect-main
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/markitect-main.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/markitect-main.yaml
 - repo: markitect-quarkdown
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/markitect-quarkdown.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/markitect-quarkdown.yaml
 - repo: markitect-tool
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/markitect-tool.yaml
-- repo: net-kingdom
+  cache: /tmp/netkingdom-reuse-federation-cache/markitect-tool.yaml
+- repo: maturity-engine
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/net-kingdom/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/net-kingdom.yaml
+  index: ../maturity-engine/registry/indexes/capabilities.yaml
+- repo: net-kingdom
+  count: 6
+  index: ../net-kingdom/registry/indexes/capabilities.yaml
 - repo: open-cmis-tck
   count: 1
   url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/open-cmis-tck.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/open-cmis-tck.yaml
 - repo: open-reuse
   count: 1
   url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/open-reuse.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/open-reuse.yaml
 - repo: ops-bridge
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/ops-bridge.yaml
+  index: ../ops-bridge/registry/indexes/capabilities.yaml
 - repo: ops-hub
   count: 1
   url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/ops-hub.yaml
-- repo: ops-warden
+  cache: /tmp/netkingdom-reuse-federation-cache/ops-hub.yaml
+- repo: ops-mason
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/ops-warden.yaml
+  index: ../ops-mason/registry/indexes/capabilities.yaml
+- repo: ops-warden
+  count: 3
+  index: ../ops-warden/registry/indexes/capabilities.yaml
 - repo: phase-memory
   count: 1
   url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/phase-memory.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/phase-memory.yaml
+- repo: policy-nexus
+  count: 1
+  index: ../policy-nexus/registry/indexes/capabilities.yaml
+- repo: rail-knative
+  count: 1
+  index: ../rail-knative/registry/indexes/capabilities.yaml
+- repo: rail-kubernetes
+  count: 1
+  index: ../rail-kubernetes/registry/indexes/capabilities.yaml
 - repo: railiance-apps
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/railiance-apps.yaml
+  index: ../railiance-apps/registry/indexes/capabilities.yaml
+- repo: railiance-bootstrap
+  count: 1
+  index: ../railiance-bootstrap/registry/indexes/capabilities.yaml
 - repo: railiance-cluster
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/railiance-cluster.yaml
+  index: ../railiance-cluster/registry/indexes/capabilities.yaml
 - repo: railiance-enablement
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/railiance-enablement.yaml
+  index: ../railiance-enablement/registry/indexes/capabilities.yaml
 - repo: railiance-fabric
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/railiance-fabric.yaml
+  index: ../railiance-fabric/registry/indexes/capabilities.yaml
 - repo: railiance-forge
-  count: 1
-  url: https://forgejo.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/railiance-forge.yaml
+  count: 2
+  index: ../railiance-forge/registry/indexes/capabilities.yaml
 - repo: railiance-infra
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/railiance-infra.yaml
+  index: ../railiance-infra/registry/indexes/capabilities.yaml
+- repo: railiance-master
+  count: 1
+  index: ../railiance-master/registry/indexes/capabilities.yaml
 - repo: railiance-platform
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/railiance-platform.yaml
+  index: ../railiance-platform/registry/indexes/capabilities.yaml
+- repo: railiance-telemetry
+  count: 1
+  index: ../railiance-telemetry/registry/indexes/capabilities.yaml
+- repo: rapp-openbao
+  count: 1
+  index: ../rapp-openbao/registry/indexes/capabilities.yaml
+- repo: rapp-playwright
+  count: 1
+  index: ../rapp-playwright/registry/indexes/capabilities.yaml
+- repo: rapp-policy-nexus
+  count: 1
+  index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml
+- repo: rapp-postgres
+  count: 1
+  index: ../rapp-postgres/registry/indexes/capabilities.yaml
+- repo: rapp-sbom-nexus
+  count: 1
+  index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml
+- repo: rapp-telemetry
+  count: 1
+  index: ../rapp-telemetry/registry/indexes/capabilities.yaml
+- repo: rapp-tenant-engine
+  count: 1
+  index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml
+- repo: rapp-user-engine
+  count: 1
+  index: ../rapp-user-engine/registry/indexes/capabilities.yaml
+- repo: reef-railiance
+  count: 1
+  index: ../reef-railiance/registry/indexes/capabilities.yaml
+- repo: rein-aharness
+  count: 1
+  index: ../rein-aharness/registry/indexes/capabilities.yaml
+- repo: rein-openweights
+  count: 1
+  index: ../rein-openweights/registry/indexes/capabilities.yaml
+- repo: repo-manager
+  count: 1
+  index: ../repo-manager/registry/indexes/capabilities.yaml
 - repo: repo-scoping
   count: 1
   url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/repo-scoping.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/repo-scoping.yaml
 - repo: repo-seed
   count: 1
   url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/repo-seed.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/repo-seed.yaml
+- repo: resource-control
+  count: 1
+  index: ../resource-control/registry/indexes/capabilities.yaml
 - repo: reuse-surface
   count: 3
-  index: registry/indexes/capabilities.yaml
+  index: ../reuse-surface/registry/indexes/capabilities.yaml
+- repo: risk-nexus
+  count: 1
+  index: ../risk-nexus/registry/indexes/capabilities.yaml
+- repo: role-engine
+  count: 1
+  index: ../role-engine/registry/indexes/capabilities.yaml
+- repo: runbook-tutorials
+  count: 1
+  index: ../runbook-tutorials/registry/indexes/capabilities.yaml
+- repo: sand-boxer
+  count: 1
+  index: ../sand-boxer/registry/indexes/capabilities.yaml
+- repo: sbom-nexus
+  count: 1
+  index: ../sbom-nexus/registry/indexes/capabilities.yaml
+- repo: secrets-engine
+  count: 1
+  index: ../secrets-engine/registry/indexes/capabilities.yaml
+- repo: security-canon
+  count: 1
+  index: ../security-canon/registry/indexes/capabilities.yaml
 - repo: shard-wiki
   count: 8
   url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/shard-wiki.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - repo: state-hub
   count: 2
-  url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/state-hub.yaml
+  index: ../state-hub/registry/indexes/capabilities.yaml
 - repo: tegwick-control
   count: 0
   url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/tegwick-control.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/tegwick-control.yaml
+- repo: tenant-engine
+  count: 1
+  index: ../tenant-engine/registry/indexes/capabilities.yaml
 - repo: the-custodian
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/the-custodian/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/the-custodian.yaml
+  index: ../the-custodian/registry/indexes/capabilities.yaml
 - repo: user-engine
   count: 1
-  url: https://forgejo.coulomb.social/coulomb/user-engine/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/user-engine.yaml
+  index: ../user-engine/registry/indexes/capabilities.yaml
 - repo: vantage-point
   count: 1
   url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/vantage-point.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/vantage-point.yaml
 - repo: vergabe-teilnahme
   count: 1
   url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/vergabe-teilnahme.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/vergabe-teilnahme.yaml
+- repo: whitehat-security
+  count: 1
+  index: ../whitehat-security/registry/indexes/capabilities.yaml
 - repo: whynot-control
   count: 0
   url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/whynot-control.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/whynot-control.yaml
 - repo: whynot-design
   count: 1
   url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
-  cache: registry/federation/cache/whynot-design.yaml
+  cache: /tmp/netkingdom-reuse-federation-cache/whynot-design.yaml
+- repo: zone-engine
+  count: 1
+  index: ../zone-engine/registry/indexes/capabilities.yaml
 capabilities:
 - id: capability.activity.event-coordinate
-  name: Organizational Event Coordination
-  summary: Coordinate structured responses to cross-domain events through activity
-    workflows and automation.
-  vector: D3 / A1 / C1 / R0
+  name: Durable automation and bounded operations
+  summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime
+    sinks.
   domain: helix_forge
   status: draft
   owner: activity-core
-  path: registry/capabilities/capability.activity.event-coordinate.md
   tags:
   - activity
   - coordination
   - automation
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C1 / R0
+  path: registry/capabilities/capability.activity.event-coordinate.md
   consumption_modes:
-  - informational
+  - HTTP API
+  - source
   source_repo: activity-core
-  source_url: https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/activity-core.yaml
+  source_index: ../activity-core/registry/indexes/capabilities.yaml
 - id: capability.agents.cli-assistant
   name: Console-Native LLM Assistant (cya)
   summary: Console-native, backend-agnostic assistant CLI that expresses user intent
@@ -285,27 +379,27 @@ capabilities:
   - cli
   source_repo: can-you-assist
   source_url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/can-you-assist.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/can-you-assist.yaml
 - id: capability.agents.custodian-runtime-tooling
-  name: Custodian Runtime And Repo-Classification Tooling
-  summary: 'Generic tooling from The Custodian''s runtime and ecosystem-management
-    surface: an agent runtime framework (context, actions, tool adapters, policies)
-    and repo-classification batch tooling used across the workstation''s 61 repos.'
-  vector: D2 / A1 / C1 / R0
+  name: Generic agent runtime and repository tooling
+  summary: Agent runtime modules and repository classification tooling.
   domain: custodian
   status: draft
   owner: the-custodian
-  path: registry/capabilities/capability.agents.custodian-runtime-tooling.md
   tags:
   - agents
   - runtime
   - classification
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D2 / A2 / C1 / R0
+  path: registry/capabilities/capability.agents.custodian-runtime-tooling.md
   consumption_modes:
-  - library import (runtime/)
-  - cli (tools/ scripts)
+  - CLI
+  - source
   source_repo: the-custodian
-  source_url: https://forgejo.coulomb.social/coulomb/the-custodian/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/the-custodian.yaml
+  source_index: ../the-custodian/registry/indexes/capabilities.yaml
 - id: capability.agents.kaizen-framework
   name: Kaizen Agentic Framework
   summary: AI agency framework providing 20 deployable agent instruction sets, project
@@ -329,7 +423,7 @@ capabilities:
   - file contracts
   source_repo: kaizen-agentic
   source_url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/kaizen-agentic.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/kaizen-agentic.yaml
 - id: capability.agents.llm-connector
   name: Pluggable LLM Adapter Library (llm-connect)
   summary: Provider-neutral Python/CLI LLM adapter library supporting OpenRouter,
@@ -349,7 +443,24 @@ capabilities:
   - cli
   source_repo: llm-connect
   source_url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/llm-connect.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/llm-connect.yaml
+- id: capability.agents.performance-learning
+  name: Agent performance learning
+  summary: Capture sessions, curate patterns, distribute lessons and measure outcomes.
+  domain: infotech
+  status: draft
+  owner: agentic-resources
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.agents.performance-learning.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: agentic-resources
+  source_index: ../agentic-resources/registry/indexes/capabilities.yaml
 - id: capability.agents.repo-scoping-service
   name: Repository Scoping Service
   summary: Maps repositories from usefulness to implementation (Ability -> Capability
@@ -370,46 +481,44 @@ capabilities:
   - ui
   source_repo: repo-scoping
   source_url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/repo-scoping.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/repo-scoping.yaml
 - id: capability.audit.event-retain
-  name: Audit Event Retention
-  summary: Collect, normalize, retain, and search audit events with integrity evidence
-    across tenants.
-  joins: operations.audit
-  provision: data/capability/audit-core-operational.json
-  vector: D4 provision / A4 / C3 / R2
+  name: Independent audit custody
+  summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.
   domain: infotech
-  status: production
+  status: draft
   owner: audit-core
-  path: registry/capabilities/capability.audit.event-retain.md
   tags:
-  - audit
-  - retention
-  - compliance
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C3 / R2
+  path: registry/capabilities/capability.audit.event-retain.md
   consumption_modes:
-  - http ingest
-  - source module
+  - HTTP API
+  - source
   source_repo: audit-core
-  source_url: https://forgejo.coulomb.social/coulomb/audit-core/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/audit-core.yaml
+  source_index: ../audit-core/registry/indexes/capabilities.yaml
 - id: capability.authorization.policy-evaluate
-  name: Authorization Policy Evaluation
-  summary: Evaluate access decisions from policy-as-code rules for subjects, resources,
-    and actions.
-  vector: D4 / A2 / C2 / R1
+  name: Policy evaluation and decision evidence
+  summary: Check, batch, list-allowed, explain, binding, lifetime and decision records.
   domain: helix_forge
   status: draft
-  owner: flex-auth
-  path: registry/capabilities/capability.authorization.policy-evaluate.md
+  owner: access-engine
   tags:
   - authorization
   - policy
   - flex-auth
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A4 / C2 / R1
+  path: registry/capabilities/capability.authorization.policy-evaluate.md
   consumption_modes:
-  - source module
+  - HTTP API
+  - source
   source_repo: access-engine
-  source_url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/access-engine.yaml
+  source_index: ../access-engine/registry/indexes/capabilities.yaml
 - id: capability.cmis.tck
   name: OpenCMIS Conformance-Preparation Extension
   summary: CMIS conformance-preparation extension for guide-board, keeping CMIS-specific
@@ -428,7 +537,7 @@ capabilities:
   - library import (guide-board extension)
   source_repo: open-cmis-tck
   source_url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/open-cmis-tck.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/open-cmis-tck.yaml
 - id: capability.communication.compliance-evidence-framework
   name: Certification And Compliance Evidence Framework
   summary: Framework that turns standards, conformance, regulatory, and repository-quality
@@ -448,7 +557,7 @@ capabilities:
   - cli
   source_repo: guide-board
   source_url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/guide-board.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/guide-board.yaml
 - id: capability.communication.context-engine
   name: Kontextual Engine (Knowledge Operations Runtime)
   summary: Headless knowledge-operations engine turning heterogeneous information
@@ -467,7 +576,7 @@ capabilities:
   - library import
   source_repo: kontextual-engine
   source_url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/kontextual-engine.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/kontextual-engine.yaml
 - id: capability.communication.infospace-workspace
   name: Infospace Workspace And Evaluation Bench
   summary: Workspace and service for creating, developing, evaluating, and inspecting
@@ -487,7 +596,7 @@ capabilities:
   - library import (consumed by info-tech-canon)
   source_repo: infospace-bench
   source_url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/infospace-bench.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/infospace-bench.yaml
 - id: capability.communication.markitect-legacy-platform
   name: MarkiTect Legacy Platform
   summary: Intelligent markdown engine and information-management platform treating
@@ -507,7 +616,7 @@ capabilities:
   - application (legacy, not recommended for new integration)
   source_repo: markitect-main
   source_url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/markitect-main.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-main.yaml
 - id: capability.communication.markitect-quarkdown-adapter
   name: Markitect Quarkdown Render Adapter
   summary: Concrete Quarkdown render/export adapter for Markitect, mapping Markitect
@@ -526,7 +635,7 @@ capabilities:
   - library import (plugin/entry-point)
   source_repo: markitect-quarkdown
   source_url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/markitect-quarkdown.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-quarkdown.yaml
 - id: capability.communication.markitect-source-adapters
   name: Markitect Source-Format Adapters
   summary: Concrete source-format adapters (EPUB3, PDF) converting external document
@@ -545,7 +654,7 @@ capabilities:
   - library import (plugin/entry-point)
   source_repo: markitect-filter
   source_url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/markitect-filter.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-filter.yaml
 - id: capability.communication.markitect-toolkit
   name: Markitect Markdown Toolkit And CLI
   summary: Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown
@@ -566,7 +675,24 @@ capabilities:
   - library import
   source_repo: markitect-tool
   source_url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/markitect-tool.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-tool.yaml
+- id: capability.coordination.cross-owner-work
+  name: Cross-owner coordination lifecycle
+  summary: Observation, lease, wake-up, checkpoint and receipt contracts/runtime.
+  domain: infotech
+  status: draft
+  owner: coordination-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.coordination.cross-owner-work.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: coordination-engine
+  source_index: ../coordination-engine/registry/indexes/capabilities.yaml
 - id: capability.design.whynot-system
   name: Whynot Design System
   summary: 'Framework-agnostic visual language for whynot prototype/market-signal
@@ -587,7 +713,7 @@ capabilities:
   - django template adapter
   source_repo: whynot-design
   source_url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/whynot-design.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/whynot-design.yaml
 - id: capability.evidence.binding
   name: Evidence-to-Target Binding
   summary: Links evidence items to structured targets with relation, status, and confidence
@@ -609,7 +735,7 @@ capabilities:
   - React provider
   source_repo: evidence-binder
   source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/evidence-binder.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml
 - id: capability.evidence.rect-registry
   name: Visual-Guide Rect Registry
   summary: Coordinates field, evidence-card, and highlight rectangles from independent
@@ -630,7 +756,83 @@ capabilities:
   - React component
   source_repo: evidence-binder
   source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/evidence-binder.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml
+- id: capability.execution.openweight-rein
+  name: Bounded open-weight agent execution
+  summary: Tool loop, path guards, turn/budget limits and verified-commit result.
+  domain: infotech
+  status: draft
+  owner: rein-openweights
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.execution.openweight-rein.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rein-openweights
+  source_index: ../rein-openweights/registry/indexes/capabilities.yaml
+- id: capability.execution.profile-harness
+  name: Profile-bound agent execution lifecycle
+  summary: Typed execution requests, profile/rein resolution, sandbox and cleanup
+    orchestration.
+  domain: infotech
+  status: draft
+  owner: glas-harness
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A3 / C1 / R0
+  path: registry/capabilities/capability.execution.profile-harness.md
+  consumption_modes:
+  - library
+  - CLI
+  source_repo: glas-harness
+  source_index: ../glas-harness/registry/indexes/capabilities.yaml
+- id: capability.execution.sandbox-provision
+  name: Sandbox establishment and lifecycle
+  summary: Profiles, extensions, provision, checkpoints, TTL teardown and telemetry.
+  domain: infotech
+  status: draft
+  owner: sand-boxer
+  tags:
+  - sandbox
+  - isolation
+  - provision
+  - e2e
+  - agentic
+  - execution
+  - profile
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D5 / A5 / C5 / R0
+  path: registry/capabilities/execution.sandbox-provision.md
+  consumption_modes:
+  - containerized service
+  - CLI
+  source_repo: sand-boxer
+  source_index: ../sand-boxer/registry/indexes/capabilities.yaml
+- id: capability.execution.scheduled-agent-rein
+  name: Scheduled agent intake and harness routing
+  summary: Activity Core lease claim/heartbeat and Glas profile execution.
+  domain: infotech
+  status: draft
+  owner: rein-aharness
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.execution.scheduled-agent-rein.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rein-aharness
+  source_index: ../rein-aharness/registry/indexes/capabilities.yaml
 - id: capability.feature-control.evaluate
   name: Feature Availability Evaluation
   summary: Evaluate whether a feature is active, hidden, disabled, or unavailable
@@ -649,7 +851,7 @@ capabilities:
   - service API
   source_repo: feature-control
   source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/feature-control.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
 - id: capability.feature-control.rollout
   name: Feature Rollout Control
   summary: Gradually expose features to subjects across tenants, domains, groups,
@@ -668,7 +870,7 @@ capabilities:
   - SDK
   source_repo: feature-control
   source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/feature-control.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
 - id: capability.feature-control.visibility
   name: Feature Visibility Control
   summary: Control whether features are visible or hidden for subjects without changing
@@ -685,7 +887,24 @@ capabilities:
   - source module
   source_repo: feature-control
   source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/feature-control.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
+- id: capability.finance.security-budget-evidence
+  name: Budget and cost evidence for security operations
+  summary: Budget, commitment, spend attribution and planning-evidence consumption.
+  domain: infotech
+  status: draft
+  owner: fin-hub
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C1 / R0
+  path: registry/capabilities/capability.finance.security-budget-evidence.md
+  consumption_modes:
+  - HTTP API
+  - source
+  source_repo: fin-hub
+  source_index: ../fin-hub/registry/indexes/capabilities.yaml
 - id: capability.graph.nbgm-spec
   name: Network-Based Graph Model (NBGM) Specification
   summary: Generic system and versioned protocol specification for exploring dependency
@@ -704,7 +923,7 @@ capabilities:
   - informational (specification only)
   source_repo: vantage-point
   source_url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/vantage-point.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/vantage-point.yaml
 - id: capability.hr.workflow-catalog
   name: HR Workflow Catalog
   summary: Markdown-first registry of HR planning workflows with an iterative assessment
@@ -723,27 +942,26 @@ capabilities:
   - informational
   source_repo: human-resources
   source_url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/human-resources.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/human-resources.yaml
 - id: capability.iam.key-cape
-  name: KeyCape Lightweight IAM (NetKingdom Profile)
-  summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned
-    OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications
-    integrate against the profile, not against implementation internals.
-  vector: D4 / A2 / C2 / R1
+  name: OIDC identity and assurance
+  summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.
   domain: infotech
   status: draft
   owner: key-cape
-  path: registry/capabilities/capability.iam.key-cape.md
   tags:
   - iam
   - oidc
   - netkingdom
   - security
+  - framework-reuse
+  vector: D4 / A4 / C2 / R1
+  path: registry/capabilities/capability.iam.key-cape.md
   consumption_modes:
-  - service (self-hosted deployment)
+  - HTTP API
+  - source
   source_repo: key-cape
-  source_url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/key-cape.yaml
+  source_index: ../key-cape/registry/indexes/capabilities.yaml
 - id: capability.identity.subject-resolution
   name: Identity Subject Resolution
   summary: Resolve who or what is acting by mapping principals, accounts, actors,
@@ -761,26 +979,45 @@ capabilities:
   - informational
   source_repo: commerce-canon
   source_url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/commerce-canon.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml
+- id: capability.identity.tenant-facts
+  name: Tenant lifecycle and guardrail facts
+  summary: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.
+  domain: infotech
+  status: draft
+  owner: tenant-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C1 / R0
+  path: registry/capabilities/capability.identity.tenant-facts.md
+  consumption_modes:
+  - HTTP API
+  - source
+  source_repo: tenant-engine
+  source_index: ../tenant-engine/registry/indexes/capabilities.yaml
 - id: capability.identity.user-engine
-  name: Headless Multi-Tenant User Engine
-  summary: Headless, multi-application, multi-tenant user management engine covering
-    registration, identity/factor models, entitlement claims, hats/realms/services/assets
-    access profiles, and onboarding journeys.
-  vector: D4 / A1 / C2 / R0
+  name: User lifecycle and account journeys
+  summary: Accounts, identity links, membership, MFA and recovery portal, advisory
+    catalog.
   domain: communication
   status: draft
   owner: user-engine
-  path: registry/capabilities/capability.identity.user-engine.md
   tags:
   - identity
   - user-management
   - multi-tenant
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A4 / C2 / R0
+  path: registry/capabilities/capability.identity.user-engine.md
   consumption_modes:
-  - library import
+  - HTTP API
+  - source
   source_repo: user-engine
-  source_url: https://forgejo.coulomb.social/coulomb/user-engine/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/user-engine.yaml
+  source_index: ../user-engine/registry/indexes/capabilities.yaml
 - id: capability.identity.vocabulary-canonicalize
   name: Identity Vocabulary Canonicalization
   summary: Define an implementation-neutral vocabulary for identity-related concepts
@@ -798,7 +1035,7 @@ capabilities:
   - informational
   source_repo: commerce-canon
   source_url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/commerce-canon.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml
 - id: capability.infotech.artifact-store
   name: Artifact Registry And Storage Gateway
   summary: Generic artifact registry and storage gateway for generated outputs, evidence
@@ -818,27 +1055,27 @@ capabilities:
   - cli
   source_repo: artifact-store
   source_url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/artifact-store.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/artifact-store.yaml
 - id: capability.infotech.canon-service
-  name: InfoTechCanon Service Surface
-  summary: Concrete service surface (CLI, importable functions, read-only local HTTP
-    API) over the InfoTechCanon information-processing infospace, backed by infospace-bench.
-  vector: D2 / A2 / C1 / R0
+  name: Shared semantic contracts and validation
+  summary: Markdown canon with library, CLI and read-only API.
   domain: infotech
   status: draft
   owner: info-tech-canon
-  path: registry/capabilities/capability.infotech.canon-service.md
   tags:
   - canon
   - infospace
   - service
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D2 / A4 / C1 / R0
+  path: registry/capabilities/capability.infotech.canon-service.md
   consumption_modes:
-  - cli
-  - library import
-  - http api (read-only, local)
+  - HTTP API
+  - source
   source_repo: info-tech-canon
-  source_url: https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/info-tech-canon.yaml
+  source_index: ../info-tech-canon/registry/indexes/capabilities.yaml
 - id: capability.infotech.citation-engine
   name: Citation Evidence Domain Engine
   summary: "Core domain model and engine services for the citation-evidence ecosystem\
@@ -857,7 +1094,7 @@ capabilities:
   - library import (workspace link)
   source_repo: citation-engine
   source_url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/citation-engine.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/citation-engine.yaml
 - id: capability.infotech.citation-evidence-workspace
   name: Citation Evidence Workspace
   summary: "Document-centered evidence workspace for capturing, managing, presenting,\
@@ -876,7 +1113,7 @@ capabilities:
   - application (local dev server)
   source_repo: citation-evidence
   source_url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/citation-evidence.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/citation-evidence.yaml
 - id: capability.infotech.config-surface-atlas
   name: Configuration Surface Atlas
   summary: "Read-first, cross-kind map and evidence layer for configuration surfaces\
@@ -898,7 +1135,7 @@ capabilities:
   - source module
   source_repo: config-atlas
   source_url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/config-atlas.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/config-atlas.yaml
 - id: capability.infotech.core-hub
   name: Core Hub Production Interaction Framework
   summary: Contract-first framework for cross-domain state, agent coordination, evidence,
@@ -921,7 +1158,7 @@ capabilities:
   - cli
   source_repo: core-hub
   source_url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/core-hub.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/core-hub.yaml
 - id: capability.infotech.email-connector
   name: Mailbox Evidence Scanner (email-connect)
   summary: Headless, provider-neutral email communication and evidence service; first
@@ -940,7 +1177,7 @@ capabilities:
   - cli
   source_repo: email-connect
   source_url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/email-connect.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/email-connect.yaml
 - id: capability.infotech.headless-browser
   name: Headless Browser Automation
   summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright
@@ -980,7 +1217,7 @@ capabilities:
   - service API
   - container
   source_repo: reuse-surface
-  source_index: registry/indexes/capabilities.yaml
+  source_index: ../reuse-surface/registry/indexes/capabilities.yaml
 - id: capability.infotech.hub-core-library
   name: Reusable FOS Hub Core Primitives
   summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State
@@ -999,27 +1236,27 @@ capabilities:
   - library import
   source_repo: hub-core
   source_url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/hub-core.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/hub-core.yaml
 - id: capability.infotech.issue-tracking
-  name: Universal Issue Tracking Coordination
-  summary: Unified Python/CLI interface for issue tracking across Forgejo, GitHub,
-    and GitLab, preventing direct platform API usage and credential sprawl for coordinating
-    agents.
-  vector: D4 / A2 / C2 / R1
+  name: External issue tracker connector
+  summary: CLI and Python adapters for external issue systems.
   domain: infotech
   status: draft
   owner: issue-core
-  path: registry/capabilities/capability.infotech.issue-tracking.md
   tags:
   - issue-tracking
-  - coordination
-  - multi-platform
+  - connector
+  - work-record
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A2 / C2 / R1
+  path: registry/capabilities/capability.infotech.issue-tracking.md
   consumption_modes:
-  - cli
-  - library import
+  - CLI
+  - source
   source_repo: issue-core
-  source_url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/issue-core.yaml
+  source_index: ../issue-core/registry/indexes/capabilities.yaml
 - id: capability.infotech.oss-integration-continuity
   name: Managed Continuity For OSS Integrations
   summary: Turns proven open-source integrations into structured, maintainable, continuously
@@ -1038,7 +1275,7 @@ capabilities:
   - library import
   source_repo: open-reuse
   source_url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/open-reuse.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/open-reuse.yaml
 - id: capability.infotech.pdf-evidence-ingest
   name: Headless PDF Evidence Ingest
   summary: "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation\
@@ -1059,7 +1296,7 @@ capabilities:
   - library import
   source_repo: evidence-source
   source_url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/evidence-source.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/evidence-source.yaml
 - id: capability.infotech.repo-template
   name: Coulomb Repository Template
   summary: Bootstrap new git repositories with agent instructions, registry scaffold,
@@ -1079,7 +1316,41 @@ capabilities:
   - informational
   source_repo: repo-seed
   source_url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/repo-seed.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/repo-seed.yaml
+- id: capability.infotech.runbook-tutorials
+  name: Guided administrative runbooks
+  summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.
+  domain: infotech
+  status: draft
+  owner: runbook-tutorials
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.infotech.runbook-tutorials.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: runbook-tutorials
+  source_index: ../runbook-tutorials/registry/indexes/capabilities.yaml
+- id: capability.infotech.sbom-management
+  name: Dependency provenance and SBOM evidence
+  summary: Controlled archive ingest, immutable snapshots, freshness and license review.
+  domain: infotech
+  status: draft
+  owner: sbom-nexus
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C1 / R0
+  path: registry/capabilities/capability.infotech.sbom-management.md
+  consumption_modes:
+  - HTTP API
+  - source
+  source_repo: sbom-nexus
+  source_index: ../sbom-nexus/registry/indexes/capabilities.yaml
 - id: capability.memory.phase-planning
   name: Profile-Driven Memory Phase Planning (phase-memory)
   summary: Interprets Markitect memory profiles as runtime plans, modeling memory
@@ -1098,7 +1369,24 @@ capabilities:
   - library import
   source_repo: phase-memory
   source_url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/phase-memory.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/phase-memory.yaml
+- id: capability.observability.security-signals
+  name: Security-relevant telemetry contracts and adapters
+  summary: Signal contract, platform adapters, report exporter and absence/alert rules.
+  domain: infotech
+  status: draft
+  owner: railiance-telemetry
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.observability.security-signals.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: railiance-telemetry
+  source_index: ../railiance-telemetry/registry/indexes/capabilities.yaml
 - id: capability.operations.ops-hub
   name: Operations Hub Extension Contract
   summary: Versioned hub-extension package and bootstrap client for operational truth,
@@ -1118,27 +1406,44 @@ capabilities:
   - command-line bootstrap
   source_repo: ops-hub
   source_url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/ops-hub.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/ops-hub.yaml
 - id: capability.ops.tunnel-bridge
-  name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge)
-  summary: CLI that manages named SSH reverse tunnels keeping remote execution environments
-    connected to the local Custodian State Hub, with auto-reconnect, health checks,
-    and structured audit events.
-  vector: D3 / A2 / C2 / R1
+  name: SSH tunnel lifecycle
+  summary: Named tunnels, reconnect, health and TTL-aware cert_command.
   domain: infotech
   status: draft
   owner: ops-bridge
-  path: registry/capabilities/capability.ops.tunnel-bridge.md
   tags:
   - ssh
   - tunnel
   - ops
   - connectivity
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C2 / R1
+  path: registry/capabilities/capability.ops.tunnel-bridge.md
   consumption_modes:
-  - cli
+  - CLI
+  - source
   source_repo: ops-bridge
-  source_url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/ops-bridge.yaml
+  source_index: ../ops-bridge/registry/indexes/capabilities.yaml
+- id: capability.organization.role-catalog
+  name: Organizational role definitions
+  summary: Versioned documentation catalog.
+  domain: infotech
+  status: draft
+  owner: role-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A0 / C1 / R0
+  path: registry/capabilities/capability.organization.role-catalog.md
+  consumption_modes:
+  - informational
+  source_repo: role-engine
+  source_index: ../role-engine/registry/indexes/capabilities.yaml
 - id: capability.procurement.vergabe-teilnahme
   name: Vergabe Teilnahme (Public Procurement Participation) Application
   summary: "Django application (with a Vite/Tailwind frontend) for managing German\
@@ -1157,222 +1462,802 @@ capabilities:
   - application (Django + Vite, local dev via docker-compose)
   source_repo: vergabe-teilnahme
   source_url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/vergabe-teilnahme.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/vergabe-teilnahme.yaml
+- id: capability.railiance.bootstrap-sequencing
+  name: Bootstrap sequencing contracts
+  summary: Bare-VM to estate sequence and handoff contract.
+  domain: infotech
+  status: draft
+  owner: railiance-bootstrap
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A0 / C1 / R0
+  path: registry/capabilities/capability.railiance.bootstrap-sequencing.md
+  consumption_modes:
+  - informational
+  source_repo: railiance-bootstrap
+  source_index: ../railiance-bootstrap/registry/indexes/capabilities.yaml
+- id: capability.railiance.browser-verification
+  name: Managed browser verification pilot
+  summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts.
+  domain: infotech
+  status: draft
+  owner: rapp-playwright
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C1 / R0
+  path: registry/capabilities/capability.railiance.browser-verification.md
+  consumption_modes:
+  - HTTP API
+  - source
+  source_repo: rapp-playwright
+  source_index: ../rapp-playwright/registry/indexes/capabilities.yaml
 - id: capability.railiance.ci-enablement
-  name: Railiance Developer Enablement And CI/CD Templates
-  summary: "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable\
-    \ CI/CD workflow templates, developer portal paths, platform templates, SDKs,\
-    \ and buildpacks, using forge capabilities without owning forge runtime."
-  vector: D3 / A2 / C2 / R1
+  name: Developer delivery and CI templates
+  summary: Reusable CI workflows, build and deployment patterns.
   domain: financials
   status: draft
   owner: railiance-enablement
-  path: registry/capabilities/capability.railiance.ci-enablement.md
   tags:
   - railiance
   - ci-cd
   - developer-enablement
   - forgejo
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C2 / R1
+  path: registry/capabilities/capability.railiance.ci-enablement.md
   consumption_modes:
-  - ci workflow template (copy/reference)
-  - cli (promote-repo-to-forgejo.sh)
+  - CLI
+  - source
   source_repo: railiance-enablement
-  source_url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/railiance-enablement.yaml
+  source_index: ../railiance-enablement/registry/indexes/capabilities.yaml
 - id: capability.railiance.cluster-bootstrap
-  name: Railiance Cluster Runtime Bootstrap
-  summary: 'Cluster runtime entry point of the Railiance Infrastructure-as-Code framework:
-    from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated
-    Kubernetes-based environment.'
-  vector: D3 / A2 / C1 / R0
+  name: Kubernetes runtime and cluster controls
+  summary: k3s, ingress, CNI, operators and kubeconfig/runtime checks.
   domain: financials
   status: draft
   owner: railiance-cluster
-  path: registry/capabilities/capability.railiance.cluster-bootstrap.md
   tags:
   - railiance
   - kubernetes
   - iac
   - bootstrap
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.cluster-bootstrap.md
   consumption_modes:
-  - cli
-  - ansible playbook
+  - CLI
+  - source
   source_repo: railiance-cluster
-  source_url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/railiance-cluster.yaml
+  source_index: ../railiance-cluster/registry/indexes/capabilities.yaml
 - id: capability.railiance.fabric-graph
-  name: Railiance Fabric Ecosystem Graph
-  summary: 'Models the durable infrastructure-responsibility graph of the Railiance
-    netkingdom: schemas, discovery tools, registry services, graph queries, and State
-    Hub export contracts for services, machines, repos, deployables, endpoints, ownership,
-    dependencies, and bindings.'
-  vector: D3 / A1 / C1 / R0
+  name: Infrastructure ownership and dependency graph
+  summary: Schemas, validation, graph queries and State Hub exports.
   domain: financials
   status: draft
   owner: railiance-fabric
-  path: registry/capabilities/capability.railiance.fabric-graph.md
   tags:
   - railiance
   - graph
   - ownership
   - discovery
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.fabric-graph.md
   consumption_modes:
-  - library import
-  - cli (validation)
+  - CLI
+  - source
   source_repo: railiance-fabric
-  source_url: https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/railiance-fabric.yaml
+  source_index: ../railiance-fabric/registry/indexes/capabilities.yaml
 - id: capability.railiance.forge-infrastructure
-  name: Railiance Forge And Artifact Infrastructure
-  summary: Source forge, registry, and automation-runner infrastructure for Railiance,
-    separated out from railiance-apps/railiance-enablement; covers current Gitea operation,
-    the Forgejo migration, container/package registries, and Actions runner substrate.
-  vector: D3 / A1 / C1 / R0
+  name: Source forge, registries and runner substrate
+  summary: Forgejo operation, package registries and runner lifecycle.
   domain: financials
   status: draft
   owner: railiance-forge
-  path: registry/capabilities/capability.railiance.forge-infrastructure.md
   tags:
   - railiance
   - forgejo
   - forge
   - ci-runner
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.forge-infrastructure.md
   consumption_modes:
-  - cli (operator tooling)
-  - documentation/runbooks
+  - CLI
+  - source
   source_repo: railiance-forge
-  source_url: https://forgejo.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/railiance-forge.yaml
+  source_index: ../railiance-forge/registry/indexes/capabilities.yaml
 - id: capability.railiance.infra-provisioning
-  name: RailianceHosts Infrastructure Provisioning
-  summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud
-    using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets
-    and a servers.yaml inventory as source of truth.
-  vector: D4 / A2 / C2 / R1
+  name: Host convergence and security baseline
+  summary: Ansible inventory, firewall, SSH bootstrap and baseline verification.
   domain: financials
   status: draft
   owner: railiance-infra
-  path: registry/capabilities/capability.railiance.infra-provisioning.md
   tags:
   - railiance
   - terraform
   - ansible
   - infrastructure
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A2 / C2 / R1
+  path: registry/capabilities/capability.railiance.infra-provisioning.md
   consumption_modes:
-  - cli (terraform/ansible)
-  - gitops
+  - CLI
+  - source
   source_repo: railiance-infra
-  source_url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/railiance-infra.yaml
-- id: capability.railiance.platform-services
-  name: Railiance Platform Services
-  summary: "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster\
-    \ services: PostgreSQL HA, Valkey cache, secret management, identity integration,\
-    \ and object storage."
+  source_index: ../railiance-infra/registry/indexes/capabilities.yaml
+- id: capability.railiance.knative-rail
+  name: Knative workload lifecycle
+  summary: Derived rail for activation, revisions, traffic, scaling and rollback.
+  domain: infotech
+  status: draft
+  owner: rail-knative
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
   vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.knative-rail.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rail-knative
+  source_index: ../rail-knative/registry/indexes/capabilities.yaml
+- id: capability.railiance.kubernetes-rail
+  name: Generic Kubernetes workload lifecycle
+  summary: Workload declaration, rollout, observe, promote and rollback surfaces.
+  domain: infotech
+  status: draft
+  owner: rail-kubernetes
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.kubernetes-rail.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rail-kubernetes
+  source_index: ../rail-kubernetes/registry/indexes/capabilities.yaml
+- id: capability.railiance.openbao-package
+  name: Managed OpenBao deployment package
+  summary: Helm values, package deploy/status/smoke/rollback and custody boundary.
+  domain: infotech
+  status: draft
+  owner: rapp-openbao
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.openbao-package.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rapp-openbao
+  source_index: ../rapp-openbao/registry/indexes/capabilities.yaml
+- id: capability.railiance.platform-services
+  name: Secret custody and platform data services
+  summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup
+    contracts.
   domain: financials
   status: draft
   owner: railiance-platform
-  path: registry/capabilities/capability.railiance.platform-services.md
   tags:
   - railiance
   - platform
   - secrets
   - postgres
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.platform-services.md
   consumption_modes:
-  - cli (shell/python scripts)
+  - CLI
+  - source
   source_repo: railiance-platform
-  source_url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/railiance-platform.yaml
+  source_index: ../railiance-platform/registry/indexes/capabilities.yaml
+- id: capability.railiance.policy-publication-package
+  name: Policy publication runtime package
+  summary: Immutable image, non-root/read-only runtime and approved TLS exposure.
+  domain: infotech
+  status: draft
+  owner: rapp-policy-nexus
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.policy-publication-package.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rapp-policy-nexus
+  source_index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml
+- id: capability.railiance.postgres-isolation-recovery
+  name: Database isolation and recovery package
+  summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore
+    procedures.
+  domain: infotech
+  status: draft
+  owner: rapp-postgres
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.postgres-isolation-recovery.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rapp-postgres
+  source_index: ../rapp-postgres/registry/indexes/capabilities.yaml
+- id: capability.railiance.sbom-runtime-package
+  name: Private SBOM runtime and dynamic database delivery
+  summary: Immutable deployment, private network policy, dynamic database leases and
+    migration/rollback.
+  domain: infotech
+  status: draft
+  owner: rapp-sbom-nexus
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.sbom-runtime-package.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rapp-sbom-nexus
+  source_index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml
+- id: capability.railiance.security-consumption-contracts
+  name: Platform security consumption architecture
+  summary: Rail/rapp/reef boundaries, exposure and security consumption contracts.
+  domain: infotech
+  status: draft
+  owner: railiance-master
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A0 / C1 / R0
+  path: registry/capabilities/capability.railiance.security-consumption-contracts.md
+  consumption_modes:
+  - informational
+  source_repo: railiance-master
+  source_index: ../railiance-master/registry/indexes/capabilities.yaml
+- id: capability.railiance.substrate-bindings
+  name: Substrate topology and bindings
+  summary: Grouped home-reef identity, topology and placement declarations.
+  domain: infotech
+  status: draft
+  owner: reef-railiance
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A0 / C1 / R0
+  path: registry/capabilities/capability.railiance.substrate-bindings.md
+  consumption_modes:
+  - informational
+  source_repo: reef-railiance
+  source_index: ../reef-railiance/registry/indexes/capabilities.yaml
+- id: capability.railiance.telemetry-package
+  name: Private monitoring package
+  summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence.
+  domain: infotech
+  status: draft
+  owner: rapp-telemetry
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.telemetry-package.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rapp-telemetry
+  source_index: ../rapp-telemetry/registry/indexes/capabilities.yaml
+- id: capability.railiance.tenant-engine-package
+  name: Tenant Engine runtime package
+  summary: Package declaration, smoke and rollback.
+  domain: infotech
+  status: draft
+  owner: rapp-tenant-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.tenant-engine-package.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rapp-tenant-engine
+  source_index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml
+- id: capability.railiance.user-engine-package
+  name: User Engine runtime package
+  summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback.
+  domain: infotech
+  status: draft
+  owner: rapp-user-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.user-engine-package.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: rapp-user-engine
+  source_index: ../rapp-user-engine/registry/indexes/capabilities.yaml
 - id: capability.railiance.workload-deployment-tooling
-  name: Railiance Application Workload Deployment Tooling
-  summary: "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack\
-    \ \u2014 application Helm releases, Kubernetes workload manifests, deployment\
-    \ guardrails, and smoke-test/check tooling for user-facing services."
-  vector: D3 / A2 / C1 / R1
+  name: Workload release configuration and guards
+  summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback.
   domain: financials
   status: draft
   owner: railiance-apps
-  path: registry/capabilities/capability.railiance.workload-deployment-tooling.md
   tags:
   - railiance
   - kubernetes
   - helm
   - deployment
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R1
+  path: registry/capabilities/capability.railiance.workload-deployment-tooling.md
   consumption_modes:
-  - cli (shell scripts)
-  - helm/kubernetes deployment
+  - CLI
+  - source
   source_repo: railiance-apps
-  source_url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/railiance-apps.yaml
+  source_index: ../railiance-apps/registry/indexes/capabilities.yaml
 - id: capability.registry.register
-  name: Capability Registration
-  summary: Register a new capability so it becomes visible for planning and implementation
-    reuse.
-  vector: D3 / A4 / C2 / R3
+  name: Capability registry and federation
+  summary: Owner Markdown entries, indexes, federation hub and planning queries.
   domain: helix_forge
   status: draft
   owner: reuse-surface
-  path: registry/capabilities/capability.registry.register.md
   tags:
   - registry
   - governance
   - meta
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A3 / C2 / R3
+  path: registry/capabilities/capability.registry.register.md
   consumption_modes:
-  - informational
-  - markdown authoring
-  - cli
-  - service API
+  - library
+  - CLI
   source_repo: reuse-surface
-  source_index: registry/indexes/capabilities.yaml
+  source_index: ../reuse-surface/registry/indexes/capabilities.yaml
 - id: capability.registry.validate
-  name: Registry Entry Validation
-  summary: Validate capability registry entries against schema, index consistency,
-    and relation integrity.
-  vector: D4 / A3 / C3 / R3
+  name: Capability registry validation
+  summary: Schema, index consistency and relation checks.
   domain: helix_forge
   status: draft
   owner: reuse-surface
-  path: registry/capabilities/capability.registry.validate.md
   tags:
   - registry
   - validation
   - cli
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A3 / C3 / R3
+  path: registry/capabilities/capability.registry.validate.md
   consumption_modes:
-  - cli
+  - library
+  - CLI
   source_repo: reuse-surface
-  source_index: registry/indexes/capabilities.yaml
-- id: capability.security.iam-tooling-suite
-  name: NetKingdom Security/IAM Tooling Suite
-  summary: Canonical security architecture and executable reference tooling for IAM,
-    bootstrap, posture validation, deterministic plan-only security scenario composition,
-    and proposal-only posture feedback.
-  vector: D3 / A2 / C1 / R1
+  source_index: ../reuse-surface/registry/indexes/capabilities.yaml
+- id: capability.resources.security-capacity
+  name: Capacity and recovery resource planning
+  summary: Provider-neutral inventory, procurement evidence and optimization reports.
+  domain: infotech
+  status: draft
+  owner: resource-control
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.resources.security-capacity.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: resource-control
+  source_index: ../resource-control/registry/indexes/capabilities.yaml
+- id: capability.security.access-routing
+  name: Credential routing and contained access
+  summary: warden route and access catalog; exact lane conduit and secret-exec routing.
+  domain: infotech
+  status: draft
+  owner: ops-warden
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A3 / C1 / R0
+  path: registry/capabilities/capability.security.access-routing.md
+  consumption_modes:
+  - library
+  - CLI
+  source_repo: ops-warden
+  source_index: ../ops-warden/registry/indexes/capabilities.yaml
+- id: capability.security.adversarial-evidence
+  name: Authorized adversarial evidence harness
+  summary: Offline ASM and tenancy calibrations and engagement admission.
+  domain: infotech
+  status: draft
+  owner: whitehat-security
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.adversarial-evidence.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: whitehat-security
+  source_index: ../whitehat-security/registry/indexes/capabilities.yaml
+- id: capability.security.agent-knowledge
+  name: Verified security orientation for agents
+  summary: Versioned source-pinned cards, read-only CLI, provider adapters and sealed
+    exports.
+  domain: infotech
+  status: draft
+  owner: emergent-security
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.agent-knowledge.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: emergent-security
+  source_index: ../emergent-security/registry/indexes/capabilities.yaml
+- id: capability.security.approval-lifecycle
+  name: Bound approval lifecycle
+  summary: Authenticated issue, claim, revoke, supersede and atomic consume API with
+    outbox.
+  domain: infotech
+  status: draft
+  owner: approval-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C1 / R0
+  path: registry/capabilities/capability.security.approval-lifecycle.md
+  consumption_modes:
+  - HTTP API
+  - source
+  source_repo: approval-engine
+  source_index: ../approval-engine/registry/indexes/capabilities.yaml
+- id: capability.security.bootstrap-recovery
+  name: Guarded bootstrap and recovery preparation
+  summary: Local identity, bootstrap console, encrypted custody handoff and caller
+    tools.
+  domain: infotech
+  status: draft
+  owner: net-kingdom
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.bootstrap-recovery.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: net-kingdom
+  source_index: ../net-kingdom/registry/indexes/capabilities.yaml
+- id: capability.security.case-contracts
+  name: Security case types and instance validation
+  summary: Versioned types, cases and schema validation.
+  domain: infotech
+  status: draft
+  owner: net-kingdom
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.case-contracts.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: net-kingdom
+  source_index: ../net-kingdom/registry/indexes/capabilities.yaml
+- id: capability.security.case-follow-through
+  name: Security case operational follow-through
+  summary: KnownSecurityCase route, plan and operational receipts.
+  domain: infotech
+  status: draft
+  owner: ops-warden
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.case-follow-through.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: ops-warden
+  source_index: ../ops-warden/registry/indexes/capabilities.yaml
+- id: capability.security.credential-lifecycle
+  name: Cataloged credential lifecycle
+  summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
+    delivery and revoke.
+  domain: infotech
+  status: draft
+  owner: secrets-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.credential-lifecycle.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: secrets-engine
+  source_index: ../secrets-engine/registry/indexes/capabilities.yaml
+- id: capability.security.doctrine-review
+  name: Security doctrine and architecture review
+  summary: Layer rules, authority context, ASM criteria and interpretations.
+  domain: infotech
+  status: draft
+  owner: gate-house
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A0 / C1 / R0
+  path: registry/capabilities/capability.security.doctrine-review.md
+  consumption_modes:
+  - informational
+  source_repo: gate-house
+  source_index: ../gate-house/registry/indexes/capabilities.yaml
+- id: capability.security.emission-profile
+  name: Security emission cadence validation
+  summary: Security profile over generic emission contracts and validator.
+  domain: infotech
+  status: draft
+  owner: net-kingdom
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.emission-profile.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: net-kingdom
+  source_index: ../net-kingdom/registry/indexes/capabilities.yaml
+- id: capability.security.forge-secret-prevention
+  name: Independent introduced-history secret prevention
+  summary: Pinned receive adapter, lifecycle template and fail-closed scan.
+  domain: infotech
+  status: draft
+  owner: railiance-forge
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.forge-secret-prevention.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: railiance-forge
+  source_index: ../railiance-forge/registry/indexes/capabilities.yaml
+- id: capability.security.human-decision-workspace
+  name: Human security decision presentation and disposition
+  summary: Headless lifecycle and browser workspace with exact native approval references.
+  domain: infotech
+  status: draft
+  owner: informed-decision
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A4 / C1 / R0
+  path: registry/capabilities/capability.security.human-decision-workspace.md
+  consumption_modes:
+  - HTTP API
+  - source
+  source_repo: informed-decision
+  source_index: ../informed-decision/registry/indexes/capabilities.yaml
+- id: capability.security.iam-tooling-suite
+  name: NetKingdom security architecture and conformance tooling
+  summary: Versioned IAM, layer, tenancy and credential contracts plus validators.
   domain: infotech
   status: draft
   owner: net-kingdom
-  path: registry/capabilities/capability.security.iam-tooling-suite.md
   tags:
   - security
   - iam
   - kubernetes
   - conformance
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R1
+  path: registry/capabilities/capability.security.iam-tooling-suite.md
   consumption_modes:
-  - cli
-  - local web ui
+  - CLI
+  - source
   source_repo: net-kingdom
-  source_url: https://forgejo.coulomb.social/coulomb/net-kingdom/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/net-kingdom.yaml
+  source_index: ../net-kingdom/registry/indexes/capabilities.yaml
+- id: capability.security.maturity-claims
+  name: Evidence-based maturity claims and gap register
+  summary: SQLite library and CLI for ladders, evidence expiry, compute, explain and
+    stance inventory.
+  domain: infotech
+  status: draft
+  owner: maturity-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.maturity-claims.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: maturity-engine
+  source_index: ../maturity-engine/registry/indexes/capabilities.yaml
+- id: capability.security.policy-publication
+  name: Policy publication with source provenance
+  summary: Generated immutable publication, source currency and stable policy URLs.
+  domain: infotech
+  status: draft
+  owner: policy-nexus
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.policy-publication.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: policy-nexus
+  source_index: ../policy-nexus/registry/indexes/capabilities.yaml
+- id: capability.security.posture-assessment
+  name: Security posture assessment and response proposals
+  summary: Normalized observation evaluator, cadence checks and secret-use snapshot
+    adapter.
+  domain: infotech
+  status: draft
+  owner: kings-guard
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.posture-assessment.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: kings-guard
+  source_index: ../kings-guard/registry/indexes/capabilities.yaml
+- id: capability.security.posture-feedback
+  name: Deterministic posture feedback
+  summary: CLI evaluates evidence age and posture into owner-routed findings.
+  domain: infotech
+  status: draft
+  owner: net-kingdom
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.posture-feedback.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: net-kingdom
+  source_index: ../net-kingdom/registry/indexes/capabilities.yaml
+- id: capability.security.practice-canon
+  name: Security practice and authority vocabulary
+  summary: Versioned SEC-DSM and Mode of Authority documents.
+  domain: infotech
+  status: draft
+  owner: security-canon
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A0 / C1 / R0
+  path: registry/capabilities/capability.security.practice-canon.md
+  consumption_modes:
+  - informational
+  source_repo: security-canon
+  source_index: ../security-canon/registry/indexes/capabilities.yaml
+- id: capability.security.repository-secret-prevention
+  name: Repository metadata and staged-secret prevention
+  summary: Repository observation plus pinned staged-blob scanner and hook integration.
+  domain: infotech
+  status: draft
+  owner: repo-manager
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.repository-secret-prevention.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: repo-manager
+  source_index: ../repo-manager/registry/indexes/capabilities.yaml
+- id: capability.security.risk-register
+  name: Security risk and exception review register
+  summary: Markdown findings and Python review, verification and due-work reports.
+  domain: infotech
+  status: draft
+  owner: risk-nexus
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.risk-register.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: risk-nexus
+  source_index: ../risk-nexus/registry/indexes/capabilities.yaml
+- id: capability.security.scenario-compose
+  name: Deterministic security scenario composition
+  summary: CLI selects pinned providers and orders trust transitions.
+  domain: infotech
+  status: draft
+  owner: net-kingdom
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.scenario-compose.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: net-kingdom
+  source_index: ../net-kingdom/registry/indexes/capabilities.yaml
 - id: capability.security.ssh-certificate-issuance
-  name: SSH Certificate Issuance
-  summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors
-    through a stable cert_command CLI interface; steward NetKingdom operational access
-    routing.
-  vector: D4 / A3 / C3 / R2
+  name: Decision-bound SSH certificates
+  summary: warden sign with local and OpenBao backends and adm/agt/atm actors.
   domain: helix_forge
   status: draft
   owner: ops-warden
-  path: registry/capabilities/capability.security.ssh-certificate-issuance.md
   tags:
   - ssh
   - certificate
@@ -1380,49 +2265,90 @@ capabilities:
   - ops-warden
   - openbao
   - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A3 / C3 / R2
+  path: registry/capabilities/capability.security.ssh-certificate-issuance.md
+  consumption_modes:
+  - library
+  - CLI
+  source_repo: ops-warden
+  source_index: ../ops-warden/registry/indexes/capabilities.yaml
+- id: capability.security.structure-construction
+  name: Reviewed security structure construction
+  summary: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.
+  domain: infotech
+  status: draft
+  owner: ops-mason
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.structure-construction.md
   consumption_modes:
   - CLI
-  - cert_command subprocess
-  source_repo: ops-warden
-  source_url: https://forgejo.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/ops-warden.yaml
+  - source
+  source_repo: ops-mason
+  source_index: ../ops-mason/registry/indexes/capabilities.yaml
+- id: capability.security.zone-reference
+  name: Zone membership reference conformance
+  summary: Offline resolution, exception and lineage checks.
+  domain: infotech
+  status: draft
+  owner: zone-engine
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.security.zone-reference.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: zone-engine
+  source_index: ../zone-engine/registry/indexes/capabilities.yaml
 - id: capability.statehub.progress-log
-  name: Work Progress Logging
-  summary: Record progress events, decisions, and session notes against workstreams
-    and tasks in State Hub.
-  vector: D4 / A4 / C3 / R3
+  name: Progress and work evidence indexing
+  summary: REST progress and task evidence references.
   domain: helix_forge
   status: draft
   owner: state-hub
-  path: registry/capabilities/capability.statehub.progress-log.md
   tags:
   - state-hub
   - progress
   - coordination
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A4 / C3 / R3
+  path: registry/capabilities/capability.statehub.progress-log.md
   consumption_modes:
-  - service API
+  - HTTP API
+  - source
   source_repo: state-hub
-  source_url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/state-hub.yaml
+  source_index: ../state-hub/registry/indexes/capabilities.yaml
 - id: capability.statehub.workstream-coordinate
-  name: Workstream And Task Coordination
-  summary: Track active workstreams, tasks, progress, and consistency across domain
-    repositories.
-  vector: D4 / A4 / C3 / R2
+  name: Cross-repository work tracking
+  summary: File-derived workplans, tasks, dependencies, decisions and coordination
+    views.
   domain: helix_forge
   status: draft
   owner: state-hub
-  path: registry/capabilities/capability.statehub.workstream-coordinate.md
   tags:
   - state-hub
   - coordination
   - workplans
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D4 / A4 / C3 / R2
+  path: registry/capabilities/capability.statehub.workstream-coordinate.md
   consumption_modes:
-  - service API
-  - HTTP REST
+  - HTTP API
+  - source
   source_repo: state-hub
-  source_url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/state-hub.yaml
+  source_index: ../state-hub/registry/indexes/capabilities.yaml
 - id: capability.wiki.adapter-contract
   name: Capability-Aware Shard Adapter Contract
   summary: A versioned backend interface where each binding declares a verified capability
@@ -1443,7 +2369,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - id: capability.wiki.coordination-journal
   name: Event-Sourced Coordination Journal
   summary: An append-only, totally-ordered-per-space decision log whose current state
@@ -1464,7 +2390,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - id: capability.wiki.derived-views
   name: Wiki Derived Views
   summary: "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges,\
@@ -1485,7 +2411,7 @@ capabilities:
   - informational
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - id: capability.wiki.engine-typed-extensions
   name: Wiki Engine with Typed Extensions
   summary: A small-core wiki engine realizing a typed-extension framework that addresses
@@ -1505,7 +2431,7 @@ capabilities:
   - informational
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - id: capability.wiki.federation-models
   name: Selectable Federation-Model Taxonomy
   summary: Federation as a plural, composable coordination axis (fork+journal, VCS-replication,
@@ -1525,7 +2451,7 @@ capabilities:
   - informational
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - id: capability.wiki.overlay
   name: Overlay-Before-Mutation Write Path
   summary: Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only
@@ -1546,7 +2472,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - id: capability.wiki.page-model
   name: Backend-Neutral Wiki Page Model
   summary: A Markdown-first but stretchable page model with stable identity separate
@@ -1567,7 +2493,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
 - id: capability.wiki.shard-orchestration
   name: Wiki Shard Orchestration
   summary: Present a union of pages across heterogeneous wiki-shaped shards while
@@ -1587,4 +2513,4 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: registry/federation/cache/shard-wiki.yaml
+  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml

From b181240b35394127868f1e3d962991b2fbbc4a64 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Thu, 15 Oct 2026 01:25:49 +0200
Subject: [PATCH 32/55] Protect authenticated federation sources with exact
 runtime URL bindings

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
---
 .../candidate-owner-review-r1.json            |  55 ++
 .../ccr0046-consumer-owner-review-r2.json     |  40 ++
 .../local-consented-metadata-validation.json  |  75 +++
 .../cust81-private-reader/owner-review-r1.md  | 102 +++
 .../runtime-auth-source-allowlist-r1.json     |  18 +
 .../suite-environment-validation.json         | 628 ++++++++++++++++++
 reuse_surface/federation.py                   |  41 +-
 reuse_surface/private_source_verify.py        | 178 +++++
 tests/test_private_source_verify.py           | 188 ++++++
 ...-WP-0025-private-source-reader-boundary.md |  66 ++
 10 files changed, 1388 insertions(+), 3 deletions(-)
 create mode 100644 docs/assessments/cust81-private-reader/candidate-owner-review-r1.json
 create mode 100644 docs/assessments/cust81-private-reader/ccr0046-consumer-owner-review-r2.json
 create mode 100644 docs/assessments/cust81-private-reader/local-consented-metadata-validation.json
 create mode 100644 docs/assessments/cust81-private-reader/owner-review-r1.md
 create mode 100644 docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json
 create mode 100644 docs/assessments/cust81-private-reader/suite-environment-validation.json
 create mode 100644 reuse_surface/private_source_verify.py
 create mode 100644 tests/test_private_source_verify.py
 create mode 100644 workplans/REUSE-WP-0025-private-source-reader-boundary.md

diff --git a/docs/assessments/cust81-private-reader/candidate-owner-review-r1.json b/docs/assessments/cust81-private-reader/candidate-owner-review-r1.json
new file mode 100644
index 0000000..54d305f
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/candidate-owner-review-r1.json
@@ -0,0 +1,55 @@
+{
+  "id": "REUSE-WP-0025-CONSUMER-CANDIDATE-REVIEW-R1",
+  "reviewed_at": "2026-10-14T23:08:33.016513+00:00",
+  "review_scope": "Consumer code, receipt-only verification helper, exact metadata URL configuration and local image preparation integration only; not credential provisioning, production rollout, registry admission or runtime approval.",
+  "owner_review": {
+    "reviewer": "reuse-surface-owner (agent reuse-surface, codex)",
+    "decision": "approved",
+    "comment": "REUSE-WP-0025-T02. INTENT.md Registry First, Consumer Experience Matters, and Internal and External Evidence Must Stay Separate: the reviewed native patch makes source credentials usable only for operator-approved exact HTTPS URLs, before any caller-selected credential lookup; redirects are refused. The helper verifies native acquisition of the consented seven indexes and seven entries by exact hashes/schema without stale-cache fallback and returns bounded receipts. Exact candidate source/helper/config/test and preparation patch digests are bound below. 227 tests pass in explicit fixture environment and source hashes match the locally smoke-verified image. This approves consumer preparation integration only; baseline proposal unchanged-image reader delivery remains changes_requested. No credential execution, founder approval or production success is inferred."
+  },
+  "workplan_id": "REUSE-WP-0025",
+  "task_id": "REUSE-WP-0025-T02",
+  "intent_sha256": "511d1029a7aefc67b68a6363ed3ce8f803f2516c00062ff805263dffe26c771b",
+  "candidate_artifacts": {
+    "reuse_surface/federation.py": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd",
+    "reuse_surface/private_source_verify.py": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c",
+    "tests/test_private_source_verify.py": "5f0c0b30b98b4db96d695bdda952b25707916e297d566744fadb6dde7bea18b2",
+    "docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json": "e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286",
+    "docs/assessments/cust81-private-reader/suite-environment-validation.json": "84f9c410f09e0dd5c0c90987744bc9f6e85292d2e28e4db88859ee0b24e68bd2",
+    "docs/assessments/cust81-private-reader/reuse-owner-preparation-r1.patch": "da9634481ce80658dfce815d3539ba023234938dc76163dfd93d7677be95ed51"
+  },
+  "local_image": {
+    "manifest_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0",
+    "receipt_path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/hardened-reader-local-image-r1.json",
+    "receipt_sha256": "ed7c2516925d7f16b573a70b5e48d5656a4875e9eb94bcc8760a8bdcbe07f59c",
+    "published": false,
+    "deployed": false,
+    "credentials_provisioned": false
+  },
+  "existing_auth_source_inventory": {
+    "receipt_path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/live-authenticated-source-inventory-r1.json",
+    "receipt_sha256": "ba669d6231c8c611191c7ad28f5914d6c47332032b23b0ea40a13f753e883073",
+    "checked_at": "2026-10-14T23:01:13.254261+00:00",
+    "authenticated_source_count": 0,
+    "must_recheck_before_rollout": true
+  },
+  "preserved_baseline_review": {
+    "path": "docs/assessments/cust81-private-reader/owner-review-r1.md",
+    "decision": "changes_requested",
+    "scope": "Original R1 same-image credential delivery proposal; preserved, not rewritten."
+  },
+  "remaining_execution_gates": [
+    "Platform/Forgejo/apps/mason owner reviews of exact current CCR and implementation.",
+    "Exact founder credential and live rollout decision remains separate.",
+    "Publish and independently verify registry image digest before rendering actual release values.",
+    "Recheck metadata-only authenticated source inventory and materialized exact14 reader allowlist before approved rollout.",
+    "Run receipt helper in actual hub environment with native authenticated fresh acquisition, then exact70 hosted audit."
+  ],
+  "does_not_approve": [
+    "Credential provision or access grant",
+    "Live production mutation or rollout",
+    "Other owner roles",
+    "Registration/admission status change",
+    "Entire objective completion"
+  ]
+}
diff --git a/docs/assessments/cust81-private-reader/ccr0046-consumer-owner-review-r2.json b/docs/assessments/cust81-private-reader/ccr0046-consumer-owner-review-r2.json
new file mode 100644
index 0000000..6c82bac
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/ccr0046-consumer-owner-review-r2.json
@@ -0,0 +1,40 @@
+{
+  "id": "REUSE-WP-0025-CCR0046-CONSUMER-REVIEW-R2",
+  "reviewed_at": "2026-10-14T23:19:37.233425+00:00",
+  "workplan_id": "REUSE-WP-0025",
+  "task_id": "REUSE-WP-0025-T01",
+  "ccr_id": "CCR-2026-0046",
+  "revision": 2,
+  "review": {
+    "reviewer": "reuse-surface-owner (agent reuse-surface, codex)",
+    "decision": "approved",
+    "comment": "REUSE-WP-0025-T01; INTENT.md Registry First, Consumer Experience Matters and Internal and External Evidence Must Stay Separate. Reviewed exact CCR-2026-0046 revision2, provisioner, exact-token recovery, bootstrap contract and ESO policy SHA256 listed below solely for consumer delivery boundary. The exact seven consented sources/commits/hash rows match original pinned disclosure preparation. Separate reader KV and env protect scoped writer callers; contract prohibits delivery to baseline/current image and requires full reviewed HTTPS/redirect/credential-before-use allowlist enforcement plus exact fourteen metadata URLs. Final actual hub helper must prove native index AND entry hashes without stale cache; 70-ID hosted audit remains independent. Recovery confines revocation to separately approved exact dedicated PAT, preserves shared runtime KV/Secret/public sources, and does not remint after ambiguity. Full native code/helper/config preparation integration review is separately approved and pinned below. This owner judgement approves preparation integration of this consumer boundary, not human credential/rollout go, provisioner execution, status/admission changes, other owners or deployment success."
+  },
+  "artifacts": {
+    "credential-change-requests/CCR-2026-0046-reuse-surface-forgejo-source-read.yaml": "90522912fb78fed72e625382fb7114a0e9aafe76d59e36bffecab83c5bb7d643",
+    "scripts/provision-reuse-surface-forgejo-source.py": "abf60a754596baa1610d23b1fd367385b0222ac8aeaebba0f2cfb7ec4c62055b",
+    "scripts/revoke-reuse-surface-forgejo-source.py": "f78d1b26fbff93c6cc481a896d9fb9b9ce93049b8b3267fa41a64bc57dadb162",
+    "docs/proposals/2026-10-15-reuse-private-reader/bootstrap-contract.json": "2bb72671e0a5f230497ab8ef2967a20ee68d1f2cf081f07c84f6db3442e18d8b",
+    "openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl": "6320f6c2d262d924ea16291d301d5f9eeb7efdb6ce7ea141c1a41d277d86b01b"
+  },
+  "consumer_preparation_review": {
+    "path": "docs/assessments/cust81-private-reader/candidate-owner-review-r1.json",
+    "sha256": "853cb3b721d83ba5aeb0847111cc47f8094b733f870059cca9834b2c1a5a6219",
+    "decision": "approved"
+  },
+  "preserved_baseline": "Original same-image reader delivery review remains changes_requested; this R2 consumer boundary resolves that design defect without altering earlier evidence.",
+  "execution_authorized": false,
+  "required_before_execution": [
+    "Human exact credential and separately scoped rollout decisions, with all required independent owner reviews.",
+    "Published independently verified image digest and reviewed release config for the full security patch.",
+    "Recheck metadata-only live authenticated-source inventory (last snapshot0) and validate exact14 runtime reader URLs.",
+    "Post-rollout native authenticated helper receipt plus separate registration and exact70 hosted completion audit."
+  ],
+  "not_proven": [
+    "Real Forgejo reader scope",
+    "Live OpenBao/ESO materialization",
+    "Production image/config rollout",
+    "Actual authenticated metadata fetch",
+    "Hosted private capability admission"
+  ]
+}
diff --git a/docs/assessments/cust81-private-reader/local-consented-metadata-validation.json b/docs/assessments/cust81-private-reader/local-consented-metadata-validation.json
new file mode 100644
index 0000000..cd4af82
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/local-consented-metadata-validation.json
@@ -0,0 +1,75 @@
+{
+  "id": "CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1",
+  "checked_at": "2026-10-14T22:43:42.958330+00:00",
+  "proposal_sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99",
+  "disclosure_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35",
+  "consent_sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52",
+  "cache_used": false,
+  "all_verified": true,
+  "sources": [
+    {
+      "repo": "rapp-openbao",
+      "commit": "35672be138036c8433a5ac5de91e068c03c2b124",
+      "index_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
+      "verified": true,
+      "entry_sha256": [
+        "9de890da536c34ac2b50576e2c4a9c03792c8a07545d2a0566ace68ac10a293e"
+      ]
+    },
+    {
+      "repo": "rapp-policy-nexus",
+      "commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
+      "index_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
+      "verified": true,
+      "entry_sha256": [
+        "21415ed5e89dcf8bd2df0c8bc99b07d2c87173809c37fa2582de6d336918a126"
+      ]
+    },
+    {
+      "repo": "rapp-postgres",
+      "commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
+      "index_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
+      "verified": true,
+      "entry_sha256": [
+        "64503872abb24bb28f291264e860ab094c6abb721fbfe90b47258ad13b77af44"
+      ]
+    },
+    {
+      "repo": "rapp-sbom-nexus",
+      "commit": "adbedd349e8df97be43a1f57db7095af45ff29d1",
+      "index_sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057",
+      "verified": true,
+      "entry_sha256": [
+        "1a15e37bd3d19c4c89ef25803667937f549ade1cd27bedfa85132ac48ffe3f48"
+      ]
+    },
+    {
+      "repo": "rapp-telemetry",
+      "commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
+      "index_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
+      "verified": true,
+      "entry_sha256": [
+        "a67dbf6905223c04b1c003d5f967841038743c8c1479812f5cf0bb55ad6cee77"
+      ]
+    },
+    {
+      "repo": "rapp-tenant-engine",
+      "commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
+      "index_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
+      "verified": true,
+      "entry_sha256": [
+        "e7cf0485cfdb6f497281638d81f908b5c2fe1053125c6ef28130504909d1d49e"
+      ]
+    },
+    {
+      "repo": "rapp-user-engine",
+      "commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738",
+      "index_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
+      "verified": true,
+      "entry_sha256": [
+        "84ec4fdce99134c88c110104cac93bdea36cffb5ba34e046b9ad161fb860dce2"
+      ]
+    }
+  ],
+  "transport": "fake-only local committed metadata; no authenticated network fetch or runtime evidence"
+}
diff --git a/docs/assessments/cust81-private-reader/owner-review-r1.md b/docs/assessments/cust81-private-reader/owner-review-r1.md
new file mode 100644
index 0000000..d83f087
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/owner-review-r1.md
@@ -0,0 +1,102 @@
+# Reuse-surface independent consumer preparation review
+
+Disposition: **changes_requested** for reader provisioning proposal
+`CUST81-PRIVATE-READER-PROVISIONING-PREPARATION-R1`, SHA256
+`7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99`.
+Reviewer: delegated reuse-surface owner preparation worker, supervised local scope.
+This review does not authorize credentials, approve another owner's implementation,
+claim deployment success, or grant permanent repo authority.
+
+INTENT requires inspectable registry membership and evidence-driven consumer
+reliability. Acquisition must protect source custody while making the explicitly
+consented metadata discoverable. The proposal's seven-repository reader, separate
+KV path and exact commit pins fit that purpose, but its unchanged-image rollout
+assumption fails consumer credential isolation.
+
+## Findings and prepared correction
+
+1. Native `fetch_remote_index_text` originally supplies Authorization to urllib's
+   default opener. Redirect handling copies headers to the redirect target. A
+   source redirect can disclose the PAT to another origin or unreviewed path.
+   Prepared patch rejects **all authenticated redirects**, even same-origin ones.
+   Anonymous federation keeps its previous behavior.
+2. Hub registration accepts caller-selected `auth_env`, `auth_header` and `url`.
+   Composition passes these to `_auth_headers`, which reads the named runtime env
+   and sends its value to that URL. A holder of the writer token can therefore
+   induce credential exfiltration without a redirect. Prepared patch validates
+   operator-owned `REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST` JSON before looking up the
+   credential. Exact allowed env name and URL are mandatory; missing/malformed
+   configuration fails closed. Authenticated HTTP is rejected.
+3. `resolve_source_index_path(refresh=True)` may return stale cache after remote
+   failure. A fresh composition timestamp alone cannot prove private acquisition.
+   Prepared helper calls native fetch directly, never the resolver/cache path,
+   and verifies exact consented index **and Markdown entry** SHA256 plus capability
+   identity, owner and entry schema. Failed receipts contain bounded categories,
+   never raw exception text, bodies, headers, or secrets.
+
+## Exact prepared artifacts
+
+- `reuse_surface/federation.py` SHA256
+  `dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd`
+- `reuse_surface/private_source_verify.py` SHA256
+  `c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c`
+- `tests/test_private_source_verify.py` SHA256
+  `5f0c0b30b98b4db96d695bdda952b25707916e297d566744fadb6dde7bea18b2`
+- `runtime-auth-source-allowlist-r1.json` SHA256
+  `e1948c537e206b30fc72b9e4732a3f600d92e131813e6f7ecfd4bfbb18c27286`
+  is the exact fourteen commit-pinned index/entry URLs for reader env
+  `REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN`. Serialize this object as the runtime
+  value of `REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST`; do not use host wildcards.
+
+## Validation and limits
+
+Focused fake transport tests cover native Bearer header handling, all fourteen
+fetches, no cache path, mismatched index/entry hashes, tampered consent packet,
+missing authentication, sanitized errors, same/cross-origin redirects without
+second requests, HTTP rejection, missing/malformed/unapproved allowlists, and
+broadened reader URL scope. Focused tests: **30 passed**. Whole test suite initially
+reported **226 passed, 1 failed**: existing `test_federation_compose` resolved a
+required sibling index to missing `/tmp/access-engine/registry/indexes/capabilities.yaml`.
+The first sibling fixture preparation also stopped at maturity-engine's untracked
+registry index, and that partial fixture run reported **226 passed, 1 failed**.
+Both outcomes remain in `suite-environment-validation.json`; no consumer test
+failure or failed preparation is hidden.
+
+With the complete task-owned fixture environment, the unchanged source patch
+passes the **entire suite: 227 passed, 1 existing dependency warning**. Command:
+`/home/worsch/reuse-surface/.venv/bin/python -m pytest -q tests`, cwd
+`/tmp/cust81-reuse-suite-fixtures-r1/reuse-surface`. That fixture contains sixty
+required local registry indexes and thirty-nine seeded anonymous caches to avoid
+live network dependencies. Fifty-nine local indexes are copied from committed
+HEAD; maturity-engine's existing untracked index is copied read-only and labeled
+as a test fixture, never publication evidence. Member indexes are only read;
+composition writes its own copied registry/cache. No foreign checkout is written.
+Tests rewrite generated catalog/graph files in their own fixture checkout; earlier
+generated changes in the integration checkout were restored to its HEAD.
+
+`local-consented-metadata-validation.json` proves schema and exact hashes for all
+seven repositories' consented committed metadata using a fake transport and a
+fixture-only token. It is explicitly **not** a network, credential, rollout or
+live federation verification receipt.
+
+Static `registry/federation/sources.yaml` contains no `auth_env`, but public hub
+registration responses intentionally omit it and do not prove live SQLite dynamic
+source inventory. This patch changes authenticated-source behavior: every existing
+authenticated lane needs a reviewed exact-URL allowlist entry. Before rollout,
+platform/apps must safely inventory only auth env names and registered URLs,
+preserve approved existing lanes in runtime config, and prove no unrelated runtime
+secret name can be routed. No raw env dump or Secret read is required for that
+inventory. Until this migration and the reviewed new consumer image are complete,
+do not deliver the new PAT to the existing hub image.
+
+After separate exact credential/rollout approval, invoke the helper from inside
+the hub process environment with the pinned proposal/disclosure/consent files:
+
+```sh
+python -m reuse_surface.private_source_verify --proposal /review/private-reader-provisioning-preparation-r1.json --disclosure /review/private-source-disclosure-proposal-r1.json --consent /review/private-source-owner-consent-r1.json
+```
+
+It accepts no credential argument and returns only bounded metadata receipts.
+Exit zero means all seven native index/entry fetches matched pinned consent; it
+does not prove registration/federation completion. Final admission still needs
+separate live source registrations and exact 70-ID fresh hosted audit.
diff --git a/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json b/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json
new file mode 100644
index 0000000..edb5f74
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json
@@ -0,0 +1,18 @@
+{
+  "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN": [
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738",
+    "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738"
+  ]
+}
diff --git a/docs/assessments/cust81-private-reader/suite-environment-validation.json b/docs/assessments/cust81-private-reader/suite-environment-validation.json
new file mode 100644
index 0000000..e062fbe
--- /dev/null
+++ b/docs/assessments/cust81-private-reader/suite-environment-validation.json
@@ -0,0 +1,628 @@
+{
+  "id": "REUSE-WP-0025-SUITE-ENVIRONMENT-R1",
+  "fixture_checkout": "/tmp/cust81-reuse-suite-fixtures-r1/reuse-surface",
+  "fixture_only": true,
+  "sources": [
+    {
+      "repo": "access-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "7d59022dac9da4d8dcbecab936d3cea9b154c8c51478b378932fd9ebe5ec7e02"
+    },
+    {
+      "repo": "activity-core",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "536d359366ccf3db3b2b0d390635bc2c5311bd37ac7ff89dae11d809ef15b848"
+    },
+    {
+      "repo": "agentic-resources",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "42986b7a274ef510166e566a9756d594a6f88706189bc97ac889bab86b20240d"
+    },
+    {
+      "repo": "approval-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "b6812fd12dc530270fb66bae592c828f56f17f2fc86759cb04d750162fc619a4"
+    },
+    {
+      "repo": "artifact-store",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "200802ac737195721a52d6d345104f2302fbdc35b4122b431bd2255f4e5552bc"
+    },
+    {
+      "repo": "audit-core",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "6a1d7dbb442f0fd0e481d54fb0acbee37ef2e693198b6f2108e154d3c3795e0e"
+    },
+    {
+      "repo": "can-you-assist",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "ce106e5c106453635075dd1b5906762d516e84601af4d5620c9a7faab444be46"
+    },
+    {
+      "repo": "citation-engine",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "e02914ffe937c8342022d92b5bfa6906aef560edeb6e90f80826cbf8e0620ada"
+    },
+    {
+      "repo": "citation-evidence",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "628e338df6da2f0966675e8facf91f52cc3ac4a0c81417b33e1284045db1dfad"
+    },
+    {
+      "repo": "citation-work",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86"
+    },
+    {
+      "repo": "commerce-canon",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "6e1186aad49634b9725bc2cfa051c42b2ac13e5c4abe4bade7b39c0483f4242d"
+    },
+    {
+      "repo": "config-atlas",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "d0325d71a5de1e756c080dc9abc3162536b9700cc37942a028ad2f65bad9bfef"
+    },
+    {
+      "repo": "coordination-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "f7a2c140ac1a7628a2106b1047b59e208879257b23ffed6dceef8ecf6c3bd420"
+    },
+    {
+      "repo": "core-hub",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "31cb09dd3b04a7891533387479ecb340b543445b64a849d9973ee857efa4cca1"
+    },
+    {
+      "repo": "domain-tree",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86"
+    },
+    {
+      "repo": "email-connect",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "5bce1e037a368816811a21dd9123ebf47f1a7d293c424c661d30fa14f2366231"
+    },
+    {
+      "repo": "emergent-security",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "268d9192dc9b97da462d46fe5b40ea33e678840b23944ab0cd73622c130bdef6"
+    },
+    {
+      "repo": "evidence-anchor",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86"
+    },
+    {
+      "repo": "evidence-binder",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "2664dfb5668238051b7cd540470ee2f7a5557415c53462fa4f14474829f3ce46"
+    },
+    {
+      "repo": "evidence-source",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "7b2a3c7b108fbdc69828b088915418c87dedfee5e202e4546defe68d8df64667"
+    },
+    {
+      "repo": "feature-control",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "2335b614d120a3e954d55389448b4c8462bfab3582de2e0bbae02dd5474dd132"
+    },
+    {
+      "repo": "fin-hub",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c6bb1aa6b770f684721fae9f1576f2c2f0128d1b758f4e33b8a277e0b4ff087a"
+    },
+    {
+      "repo": "gate-house",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "2b63d94375d29649c41a7eae7cfb3f6e35210fd3438aa5013f3ddc22a662511a"
+    },
+    {
+      "repo": "glas-harness",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "8f86dbdaf6535c909ff19967f7806d85c1f7a09db1e999033abf9b9007ed805b"
+    },
+    {
+      "repo": "guide-board",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "abbc20c7ab14bcbdb73679a5143355c7ad3a7441b8f8e7bf5a1af393c7d1c1e1"
+    },
+    {
+      "repo": "helix-forge",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86"
+    },
+    {
+      "repo": "hub-core",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "a78d185973e0d0600f6ff05470ff3b840130fca4ed7922edaf08155d246e9008"
+    },
+    {
+      "repo": "human-resources",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "d72d6b4f1479992e33400ed7c950cdc7112ead9c22abd38275717f0ae9255787"
+    },
+    {
+      "repo": "ihp-railiance-probe",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86"
+    },
+    {
+      "repo": "info-tech-canon",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "6015ec78772586e6e351422741430be8c40d7c7116403ee4b92933df342c4c72"
+    },
+    {
+      "repo": "informed-decision",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "b43ea44c725dcbd59fe957ffc307805e0aabc23b60a4a9049005c70ca4871a62"
+    },
+    {
+      "repo": "infospace-bench",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "74ba65dad84faffd6ce0e6d771f8650abe76b87a6ee09ee007780bd13c5cd9b2"
+    },
+    {
+      "repo": "issue-core",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "70eb00870ed87072aeb0f7c38de0a879f1b3910fe6f976b982a191e261e8e7be"
+    },
+    {
+      "repo": "kaizen-agentic",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "0236d486d6df6d928e7fd9f186a02273c8a59d534abb026603f7128876fbe776"
+    },
+    {
+      "repo": "key-cape",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "901d15c15cacd844cf19a1a7b74c890ce5e0b00a3372a9e10bd7114f328596c8"
+    },
+    {
+      "repo": "kings-guard",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "8a143864a6ce9a7b6c5a0f64eb75f67cfa99c2b9b155baac4f81a261d3a5312c"
+    },
+    {
+      "repo": "kontextual-engine",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "5a5980f37031c15fc9b332f143ddbfbd6c2789ff6c6ec0f4c3e971cbc506830e"
+    },
+    {
+      "repo": "llm-connect",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "27420d2b21fb45cf6cf6ac41890518f6b5a8c10027594a7e95ec535715a01296"
+    },
+    {
+      "repo": "markitect-filter",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "95d2743d4201f6b89efedebfcd34fdb03e3f832fa00b6f4f646015c3264dfb60"
+    },
+    {
+      "repo": "markitect-main",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "ba7e29cc82fd4d1eff61e48b1d870714f2d9c97531e839c469f892602509f137"
+    },
+    {
+      "repo": "markitect-quarkdown",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "67c718d9bb8221b9b58ab30cbf9eb1cf340e2d2ecc1d77cb4b5bdaf28fa5befc"
+    },
+    {
+      "repo": "markitect-tool",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "9159a4af2783b17602c23ca4b72b552641d5e1c3170a4dee1aee69c3ba9371d2"
+    },
+    {
+      "repo": "maturity-engine",
+      "kind": "required_local_index",
+      "origin": "worktree_untracked_registry_fixture_not_publication_evidence",
+      "sha256": "42b4cd1f9c6fe0960acadd10a337a579a6313fa46c2ff5a2a34bbacf2749d049"
+    },
+    {
+      "repo": "net-kingdom",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "6fadeb0e89729a9226d6eebd44fbb07723512a3ebe6737f5a1113b14829447ed"
+    },
+    {
+      "repo": "open-cmis-tck",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "e8fe7a7d0d3af104009f996c466353467e737069d0c2d04f880a86ae60d76bda"
+    },
+    {
+      "repo": "open-reuse",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "f5e8b9cd3ceb7e336a2afc5097065a6c0453cc697c8c4aa2d2c39c1d1fe4fe66"
+    },
+    {
+      "repo": "ops-bridge",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "aefd795eb16fcfdebc108450826a0f62e000bc61e9d78007bc6221bc2328e40c"
+    },
+    {
+      "repo": "ops-hub",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "6fea9fee803a5d55ece3daefdfda0efff11eae8d2a0b719fbd0dec64f4f85314"
+    },
+    {
+      "repo": "ops-mason",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "5eb499bc819c874835b8e6727ccbd5f9889ebb6f25a90018e3e574e5b6082b32"
+    },
+    {
+      "repo": "ops-warden",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "4d3aba70ead10c826814dc766f9d23e3e0ce52475330acf57905bf62b01c819c"
+    },
+    {
+      "repo": "phase-memory",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "e84b7603c98ae48879002b16a8302fb0e0e1b6c6e1099565570a8d8f98478d31"
+    },
+    {
+      "repo": "policy-nexus",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c1eb3e23621de354a9081cbf29a2f3d772b5f8538aaceca417574cde5a04c021"
+    },
+    {
+      "repo": "rail-knative",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "e044b8f2f6bc1b8aa7c672ee33dfac69d6813fd672388713a70ab7ea4d4052c0"
+    },
+    {
+      "repo": "rail-kubernetes",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "699f69facea1ce4e71d90fe0790db19b68d3a546015453651d3afc808d31d09d"
+    },
+    {
+      "repo": "railiance-apps",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "2a550acf8545e95bd81842bb1b00f4db46c4dbb42b522823f043e948667ddf2c"
+    },
+    {
+      "repo": "railiance-bootstrap",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "feefcc699e045a1a72f254d71f46460ad2362ed23c9de6e54c952711fcb33788"
+    },
+    {
+      "repo": "railiance-cluster",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "0e67a2aca183ee7ef9c4c04e618fcb03647120f456a133e84a8f42c2b8d8fcde"
+    },
+    {
+      "repo": "railiance-enablement",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "4b1f91b0da94e3098916f3e360b20b9926be4dd8683d6fb167a027aaf04ebfac"
+    },
+    {
+      "repo": "railiance-fabric",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "f473644906fe3f331702b407c3519e6a3cd0d96d362cf30d80e03aac53c3b862"
+    },
+    {
+      "repo": "railiance-forge",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "4df605d617b7656ffb94a43ab4633c8fc69ec723f68f5f5b8d5f24ad8efb6b98"
+    },
+    {
+      "repo": "railiance-infra",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "14a76b1f1dd317a1d426502ff5f80780e9551cd1cd600543de6fb9a84cb8ada2"
+    },
+    {
+      "repo": "railiance-master",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "f36cb2765ec04064314f43866f9a87a94a4f0f728adfaad46739f232b4986c0a"
+    },
+    {
+      "repo": "railiance-platform",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "0315d526165368e0a513de6b15932778d43c3e6045c589c95060f555fca3202e"
+    },
+    {
+      "repo": "railiance-telemetry",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "82f3f2d188e2d7ebea71b7262e106c5f48feaf39a2da881bb645ff9352884205"
+    },
+    {
+      "repo": "rapp-openbao",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64"
+    },
+    {
+      "repo": "rapp-playwright",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "79645df817858f96230f2443d66796d1078185c7afef5948f6a38632234d33bb"
+    },
+    {
+      "repo": "rapp-policy-nexus",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00"
+    },
+    {
+      "repo": "rapp-postgres",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776"
+    },
+    {
+      "repo": "rapp-sbom-nexus",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "d2ee0f193d2198bf8f16ce64c90ae7664e59a2bc307ad711426af3fd47deb057"
+    },
+    {
+      "repo": "rapp-telemetry",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4"
+    },
+    {
+      "repo": "rapp-tenant-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732"
+    },
+    {
+      "repo": "rapp-user-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc"
+    },
+    {
+      "repo": "reef-railiance",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "84a89c376021e3cb980c02c41d1a31396b874bebcc3801c2d1a9a33ae4195eb5"
+    },
+    {
+      "repo": "rein-aharness",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "20990ed0e016b3330a0d44e9b86bfff8966e82bc8800469ec0f320cfa8a63fbc"
+    },
+    {
+      "repo": "rein-openweights",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "2f4e59b2dbc7ea6078405f5c2f2be0aebd9434bee171a429b9ebe6baa83f3c2b"
+    },
+    {
+      "repo": "repo-manager",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "ba068a8dd7a282664e94e2acdbbb170a2ba48e260e7ce0ec8eaaa8aee6f9e7c2"
+    },
+    {
+      "repo": "repo-scoping",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "480d7c57759d6997d7bd531e966c207bb290e978f9fe831d6d246b5592c3dd71"
+    },
+    {
+      "repo": "repo-seed",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "8cb4e4baacd95a070a96db6d72f4fb3019cffda95606c65896f796ccac0c9c7c"
+    },
+    {
+      "repo": "resource-control",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "31b16f7d824e376f21de44aff46d5d532d3679d5e72035ce84813572b11bbd44"
+    },
+    {
+      "repo": "reuse-surface",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "a77c952e9e1a37a3504ccd7001a7a2493d60d46f147f277071829cd05646e31c"
+    },
+    {
+      "repo": "risk-nexus",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "53f0bf9e0aa06a6db0aa991f0ebdaa1d2bf74cfaf4e30eed8c003a4d2186a746"
+    },
+    {
+      "repo": "role-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "1188e02e0333664b3554d11c59c12942fef9e29e6491b186dcec67e6ae3e8a5c"
+    },
+    {
+      "repo": "runbook-tutorials",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "a74fa708c4fea755f5c52504bd227393888cca78c043349cdc182c4d783390e5"
+    },
+    {
+      "repo": "sand-boxer",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "a182d5672d088e80b79eacff9cb37fc2f3518c3c100537e18d125abc7f169e96"
+    },
+    {
+      "repo": "sbom-nexus",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "ed6efd581483d0058a3928b365b933cbbd98c035b0a75c866156a69961d74edc"
+    },
+    {
+      "repo": "secrets-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "d5d903336d05ccd0b75a49f7be7e866ef89c6bdb6444e8c747a5ffa934a6bbe2"
+    },
+    {
+      "repo": "security-canon",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "9b9f9348e560a72d8032f62b2ba4820d81fe182353ccc886e4f5c57cbdea563f"
+    },
+    {
+      "repo": "shard-wiki",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "b0bb63c0a080e46c60f24a87959c529da5e725334ed69c4ba985c39107c54ef9"
+    },
+    {
+      "repo": "state-hub",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "eab454bd985ab6ab83c38fd29e6e58ebdfe1e09bbc5388edddaa07a88133619a"
+    },
+    {
+      "repo": "tegwick-control",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86"
+    },
+    {
+      "repo": "tenant-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "4131f1b63e52306f267204cdfb0faa90d6550f8bca51f97cf1062becea95d805"
+    },
+    {
+      "repo": "the-custodian",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "cfe7f25e91fee824347aa22ccee2a70e7dd58ac06a7106f7e2ec9e54dc163020"
+    },
+    {
+      "repo": "user-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "7133c52c2013cea70d07d33960f145c370d33a8b4397c1dc927769fcaf200cbd"
+    },
+    {
+      "repo": "vantage-point",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "cc5cf52ead95adc2920db84299d994e54def089d3f8fd852e10d9857ab0fdd2e"
+    },
+    {
+      "repo": "vergabe-teilnahme",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "73ffd306894d9839f4800aa028144883d012bf0fe74a310ad09ef9296c627d56"
+    },
+    {
+      "repo": "whitehat-security",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "e4bf9bac7f62f60cf10a9fbd25aa8200c22f13d61861862ff5fa1cc90b55f37c"
+    },
+    {
+      "repo": "whynot-control",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86"
+    },
+    {
+      "repo": "whynot-design",
+      "kind": "anonymous_cache_seed_not_runtime_evidence",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "541104bcafb17dcf7d26dabbce7ff93b2025a0bc6cad9bec71ac145f5ec72669"
+    },
+    {
+      "repo": "zone-engine",
+      "kind": "required_local_index",
+      "origin": "committed_HEAD_fixture",
+      "sha256": "b6b196089a3011f16e8a38f6914589efc72a29ee3aca4bc0c5e3cf30bee97ec4"
+    }
+  ],
+  "foreign_repo_writes": false,
+  "network_fetch_needed": false,
+  "preserved_prior_outcomes": [
+    {
+      "environment": "original isolated checkout without siblings",
+      "passed": 226,
+      "failed": 1,
+      "failure": "required access-engine sibling missing"
+    },
+    {
+      "environment": "partial fixture preparation failed at untracked maturity-engine registry",
+      "passed": 226,
+      "failed": 1,
+      "failure": "required maturity-engine fixture missing; preparation failure not hidden"
+    }
+  ],
+  "final_result": {
+    "command": "/home/worsch/reuse-surface/.venv/bin/python -m pytest -q tests",
+    "cwd": "/tmp/cust81-reuse-suite-fixtures-r1/reuse-surface",
+    "exit_code": 0,
+    "passed": 227,
+    "failed": 0,
+    "warnings": 1,
+    "duration_seconds": 7.8,
+    "warning": "Starlette httpx testclient deprecation",
+    "consumer_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd"
+  }
+}
diff --git a/reuse_surface/federation.py b/reuse_surface/federation.py
index f736667..3be03f8 100644
--- a/reuse_surface/federation.py
+++ b/reuse_surface/federation.py
@@ -1,8 +1,10 @@
 from __future__ import annotations
 
 import os
+import json
 import re
 import urllib.error
+import urllib.parse
 import urllib.request
 from datetime import date, datetime, timezone
 from pathlib import Path
@@ -103,11 +105,44 @@ def _auth_headers(source: dict[str, Any]) -> dict[str, str]:
     return {header_name: token}
 
 
+class _RejectAuthenticatedRedirect(urllib.request.HTTPRedirectHandler):
+    """Never replay a source credential at a redirect target.
+
+    A private source must register its final URL. This also rejects same-origin
+    redirects because a path change can escape the reviewed repository scope.
+    """
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise ConnectionError("authenticated source redirect refused")
+
+
 def fetch_remote_index_text(url: str, source: dict[str, Any]) -> str:
-    headers = {"User-Agent": USER_AGENT, **_auth_headers(source)}
+    if source.get("auth_env"):
+        if urllib.parse.urlsplit(url).scheme.lower() != "https":
+            raise ValueError("authenticated source requires HTTPS")
+        # Registrations are writable data, not credential-routing authority.
+        # Operators must bind each allowed environment name to exact URLs in
+        # runtime configuration before the credential itself can be read.
+        try:
+            allowlist = json.loads(os.environ.get("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", "{}"))
+            allowed_urls = allowlist.get(source["auth_env"], [])
+            permitted = isinstance(allowed_urls, list) and url in allowed_urls
+        except (ValueError, AttributeError, TypeError):
+            permitted = False
+        if not permitted:
+            raise ValueError("authenticated source URL is not runtime-authorized")
+    auth_headers = _auth_headers(source)
+    headers = {"User-Agent": USER_AGENT, **auth_headers}
     request = urllib.request.Request(url, headers=headers)
+    # urllib's default redirect handler copies Authorization to the target.
+    # Anonymous federation retains its existing redirect behavior.
+    opener = (
+        urllib.request.build_opener(_RejectAuthenticatedRedirect()).open
+        if auth_headers
+        else urllib.request.urlopen
+    )
     try:
-        with urllib.request.urlopen(request, timeout=30) as response:
+        with opener(request, timeout=30) as response:
             return response.read().decode("utf-8")
     except urllib.error.HTTPError as exc:
         raise ConnectionError(
@@ -313,4 +348,4 @@ def write_federated_index(
         header + yaml.safe_dump(federated, sort_keys=False),
         encoding="utf-8",
     )
-    return target, warnings
\ No newline at end of file
+    return target, warnings
diff --git a/reuse_surface/private_source_verify.py b/reuse_surface/private_source_verify.py
new file mode 100644
index 0000000..311addb
--- /dev/null
+++ b/reuse_surface/private_source_verify.py
@@ -0,0 +1,178 @@
+"""Owner-prepared, receipt-only native acquisition check for CUST81 revision 1.
+
+Run inside the hub environment after a separately approved credential rollout:
+python -m reuse_surface.private_source_verify --proposal FILE --disclosure FILE
+    --consent FILE
+No credentials are accepted as arguments. No bodies or exception text are emitted.
+This command does not register sources or use the federation cache.
+"""
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+from urllib.parse import quote
+
+import yaml
+from jsonschema import Draft202012Validator
+
+from reuse_surface import federation
+from reuse_surface.registry import load_schema
+
+PROPOSAL_SHA256 = "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99"
+DISCLOSURE_SHA256 = "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35"
+CONSENT_SHA256 = "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52"
+AUTH_ENV = "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN"
+REPOSITORIES = frozenset({
+    "rapp-openbao", "rapp-policy-nexus", "rapp-postgres", "rapp-sbom-nexus",
+    "rapp-telemetry", "rapp-tenant-engine", "rapp-user-engine",
+})
+
+
+def _sha(content: bytes) -> str:
+    return hashlib.sha256(content).hexdigest()
+
+
+def _load(path: Path, expected: str) -> dict[str, Any]:
+    data = path.read_bytes()
+    if _sha(data) != expected:
+        raise ValueError("packet_digest_mismatch")
+    return json.loads(data)
+
+
+def _raw_url(repo: str, commit: str, path: str) -> str:
+    if not re.fullmatch(r"[0-9a-f]{40}", commit):
+        raise ValueError("invalid_commit")
+    if not re.fullmatch(r"registry/(indexes|capabilities)/[a-zA-Z0-9._-]+\.(yaml|md)", path):
+        raise ValueError("invalid_metadata_path")
+    return (
+        f"https://forgejo.coulomb.social/api/v1/repos/coulomb/{repo}/raw/"
+        f"{quote(path, safe='/')}?ref={commit}"
+    )
+
+
+def _prepared_sources(proposal_path: Path, disclosure_path: Path, consent_path: Path):
+    proposal = _load(proposal_path, PROPOSAL_SHA256)
+    disclosure = _load(disclosure_path, DISCLOSURE_SHA256)
+    consent = _load(consent_path, CONSENT_SHA256)
+    if (
+        consent["consent_status"] != "approved"
+        or consent["proposal_sha256"] != DISCLOSURE_SHA256
+        or consent["proposal_id"] != disclosure["id"]
+        or consent["proposal_revision"] != disclosure["revision"]
+        or set(consent["repositories"]) != REPOSITORIES
+    ):
+        raise ValueError("invalid_consent")
+    sources = proposal["sources"]
+    approved = {source["repo"]: source for source in disclosure["sources"]}
+    if len(sources) != 7 or {source["repo"] for source in sources} != REPOSITORIES:
+        raise ValueError("invalid_source_scope")
+    for source in sources:
+        owner = approved[source["repo"]]
+        files = {item["path"]: item["sha256"] for item in owner["files"]}
+        if (
+            source["consented_commit"] != owner["commit"]
+            or source["capability_ids"] != owner["capability_ids"]
+            or source["index_sha256"] != files["registry/indexes/capabilities.yaml"]
+            or source["auth_env"] != AUTH_ENV
+            or source["native_raw_url"] != _raw_url(
+                source["repo"], owner["commit"], "registry/indexes/capabilities.yaml"
+            )
+        ):
+            raise ValueError("source_not_consented")
+        yield source, files
+
+
+def verify(proposal_path: Path, disclosure_path: Path, consent_path: Path) -> dict[str, Any]:
+    receipt: dict[str, Any] = {
+        "id": "CUST81-PRIVATE-NATIVE-FETCH-RECEIPT-R1",
+        "checked_at": datetime.now(timezone.utc).isoformat(),
+        "proposal_sha256": PROPOSAL_SHA256,
+        "disclosure_sha256": DISCLOSURE_SHA256,
+        "consent_sha256": CONSENT_SHA256,
+        "cache_used": False,
+        "all_verified": False,
+        "sources": [],
+    }
+    try:
+        # Exhaust all packet checks before any native network request.
+        sources = list(_prepared_sources(proposal_path, disclosure_path, consent_path))
+        expected_urls = {
+            _raw_url(source["repo"], source["consented_commit"], path)
+            for source, files in sources for path in files
+        }
+        allowlist = json.loads(os.environ.get("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", "{}"))
+        actual_urls = allowlist.get(AUTH_ENV)
+        if (
+            not isinstance(actual_urls, list)
+            or len(actual_urls) != 14
+            or set(actual_urls) != expected_urls
+        ):
+            raise ValueError("runtime_scope_not_exact")
+        schema = Draft202012Validator(load_schema())
+    except Exception:
+        receipt["error"] = "packet_scope_or_schema_validation_failed"
+        return receipt
+    for source, files in sources:
+        row = {
+            "repo": source["repo"],
+            "commit": source["consented_commit"],
+            "index_sha256": source["index_sha256"],
+            "verified": False,
+            "entry_sha256": [],
+        }
+        receipt["sources"].append(row)
+        try:
+            index_text = federation.fetch_remote_index_text(source["native_raw_url"], source)
+            if _sha(index_text.encode("utf-8")) != source["index_sha256"]:
+                raise ValueError("index_hash_mismatch")
+            index = yaml.safe_load(index_text)
+            entries = index["capabilities"]
+            if not isinstance(entries, list) or [e["id"] for e in entries] != source["capability_ids"]:
+                raise ValueError("unexpected_capability_ids")
+            for entry in entries:
+                if not {"id", "name", "summary", "vector", "domain", "status", "owner", "path"} <= entry.keys():
+                    raise ValueError("invalid_index_row")
+                if entry["owner"] != source["repo"] or entry["path"] not in files:
+                    raise ValueError("unconsented_entry")
+                entry_url = _raw_url(source["repo"], source["consented_commit"], entry["path"])
+                entry_text = federation.fetch_remote_index_text(entry_url, source)
+                digest = _sha(entry_text.encode("utf-8"))
+                if digest != files[entry["path"]]:
+                    raise ValueError("entry_hash_mismatch")
+                front = re.match(r"^---\n(.*?)\n---", entry_text, re.DOTALL)
+                if front is None:
+                    raise ValueError("missing_front_matter")
+                metadata = yaml.safe_load(front.group(1))
+                schema.validate(metadata)
+                if metadata["id"] != entry["id"] or metadata["owner"] != source["repo"]:
+                    raise ValueError("entry_identity_mismatch")
+                row["entry_sha256"].append(digest)
+            row["verified"] = True
+        except Exception:
+            # Never stringify errors: HTTP handlers and parsers can embed bodies,
+            # headers, credentials, or private source text in their messages.
+            row["error"] = "native_fetch_or_metadata_validation_failed"
+    receipt["all_verified"] = len(receipt["sources"]) == 7 and all(
+        row["verified"] for row in receipt["sources"]
+    )
+    return receipt
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    for name in ("proposal", "disclosure", "consent"):
+        parser.add_argument(f"--{name}", type=Path, required=True)
+    args = parser.parse_args()
+    receipt = verify(args.proposal, args.disclosure, args.consent)
+    print(json.dumps(receipt, sort_keys=True))
+    return 0 if receipt["all_verified"] else 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/tests/test_private_source_verify.py b/tests/test_private_source_verify.py
new file mode 100644
index 0000000..fa950d5
--- /dev/null
+++ b/tests/test_private_source_verify.py
@@ -0,0 +1,188 @@
+import hashlib
+import io
+import json
+from email.message import Message
+from urllib.request import HTTPSHandler, build_opener
+from urllib.response import addinfourl
+
+import pytest
+import yaml
+
+from reuse_surface import federation, private_source_verify as verifier
+
+
+def _digest(text):
+    return hashlib.sha256(text.encode()).hexdigest()
+
+
+@pytest.fixture
+def packets(tmp_path, monkeypatch):
+    """Fake owner-consented bodies; no estate credential or network transport."""
+    approved, sources, bodies = [], [], {}
+    for repo in sorted(verifier.REPOSITORIES):
+        cap_id = f"capability.fixture.{repo}"
+        commit = "a" * 40
+        path = f"registry/capabilities/{cap_id}.md"
+        metadata = {
+            "id": cap_id, "name": "Fixture", "summary": "Fixture metadata",
+            "owner": repo, "status": "draft",
+            "maturity": {"discovery": {"current": "D3", "target": "D5"}, "availability": {"current": "A2", "target": "A5"}},
+            "external_evidence": {"completeness": {"level": "C1"}, "reliability": {"level": "R0"}},
+        }
+        entry = "---\n" + yaml.safe_dump(metadata) + "---\nPrivate fixture body\n"
+        index = yaml.safe_dump({"capabilities": [{
+            "id": cap_id, "name": "Fixture", "summary": "Fixture metadata", "vector": "D3 / A2 / C1 / R0",
+            "domain": "infotech", "status": "draft", "owner": repo, "path": path,
+        }]})
+        index_url = verifier._raw_url(repo, commit, "registry/indexes/capabilities.yaml")
+        bodies[index_url] = index
+        bodies[verifier._raw_url(repo, commit, path)] = entry
+        sources.append({"repo": repo, "capability_ids": [cap_id], "consented_commit": commit,
+                        "native_raw_url": index_url, "index_sha256": _digest(index), "auth_env": verifier.AUTH_ENV})
+        approved.append({"repo": repo, "capability_ids": [cap_id], "commit": commit, "files": [
+            {"path": "registry/indexes/capabilities.yaml", "sha256": _digest(index)},
+            {"path": path, "sha256": _digest(entry)},
+        ]})
+    disclosure = json.dumps({"id": "fixture", "revision": 1, "sources": approved})
+    consent = json.dumps({"consent_status": "approved", "proposal_sha256": _digest(disclosure),
+                         "proposal_id": "fixture", "proposal_revision": 1, "repositories": sorted(verifier.REPOSITORIES)})
+    proposal = json.dumps({"sources": sources})
+    paths = []
+    for name, text in (("proposal", proposal), ("disclosure", disclosure), ("consent", consent)):
+        path = tmp_path / f"{name}.json"
+        path.write_text(text)
+        paths.append(path)
+        monkeypatch.setattr(verifier, f"{name.upper()}_SHA256", _digest(text))
+    return paths, bodies
+
+
+def _transport(monkeypatch, bodies, mutate=None):
+    calls = []
+
+    class FakeResponse:
+        def __init__(self, body):
+            self.body = body
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return False
+
+        def read(self):
+            return self.body.encode()
+
+    class FakeOpener:
+        def open(self, req, timeout):
+            assert req.get_header("Authorization") == "Bearer fixture-secret"
+            assert timeout == 30
+            calls.append(req.full_url)
+            body = bodies[req.full_url]
+            return FakeResponse(mutate(req.full_url, body) if mutate else body)
+
+    monkeypatch.setenv(verifier.AUTH_ENV, "fixture-secret")
+    monkeypatch.setenv("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", json.dumps({verifier.AUTH_ENV: list(bodies)}))
+    monkeypatch.setattr(federation.urllib.request, "build_opener", lambda handler: FakeOpener())
+    # Deliberately prohibit composition/cache resolution; direct fetch must work.
+    monkeypatch.setattr(federation, "resolve_source_index_path", lambda *a, **k: pytest.fail("cache path used"))
+    return calls
+
+
+def test_exact_consented_native_index_and_entries_no_cache(packets, monkeypatch):
+    paths, bodies = packets
+    calls = _transport(monkeypatch, bodies)
+    receipt = verifier.verify(*paths)
+    assert receipt["all_verified"]
+    assert not receipt["cache_used"]
+    assert len(calls) == 14
+    assert all("?ref=" + "a" * 40 in url for url in calls)
+    output = json.dumps(receipt)
+    assert "fixture-secret" not in output
+    assert "Private fixture body" not in output
+
+
+@pytest.mark.parametrize("suffix", [".yaml", ".md"])
+def test_changed_unconsented_body_fails(packets, monkeypatch, suffix):
+    paths, bodies = packets
+    _transport(monkeypatch, bodies, lambda url, text: text + "changed" if suffix in url else text)
+    receipt = verifier.verify(*paths)
+    assert not receipt["all_verified"]
+    assert all(not row["verified"] for row in receipt["sources"])
+
+
+def test_packet_tampering_rejected_before_fetch(packets, monkeypatch):
+    paths, _ = packets
+    paths[0].write_text(paths[0].read_text() + " ")
+    monkeypatch.setattr(federation, "fetch_remote_index_text", lambda *a: pytest.fail("network before consent checks"))
+    assert verifier.verify(*paths)["error"] == "packet_scope_or_schema_validation_failed"
+
+
+def test_missing_auth_fails_before_transport(packets, monkeypatch):
+    paths, bodies = packets
+    monkeypatch.setenv("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", json.dumps({verifier.AUTH_ENV: list(bodies)}))
+    monkeypatch.delenv(verifier.AUTH_ENV, raising=False)
+    monkeypatch.setattr(federation.urllib.request, "build_opener", lambda *a: pytest.fail("transport without auth"))
+    receipt = verifier.verify(*paths)
+    assert not receipt["all_verified"]
+    assert all(not row["verified"] for row in receipt["sources"])
+
+
+def test_error_output_never_embeds_secret_or_body(packets, monkeypatch):
+    paths, bodies = packets
+    monkeypatch.setenv("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", json.dumps({verifier.AUTH_ENV: list(bodies)}))
+
+    def failure(*args):
+        raise ValueError("fixture-secret Private fixture body")
+
+    monkeypatch.setattr(federation, "fetch_remote_index_text", failure)
+    output = json.dumps(verifier.verify(*paths))
+    assert "fixture-secret" not in output
+    assert "Private fixture body" not in output
+
+
+def test_broadened_runtime_reader_scope_fails_before_fetch(packets, monkeypatch):
+    paths, bodies = packets
+    monkeypatch.setenv("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", json.dumps({verifier.AUTH_ENV: list(bodies) + ["https://attacker.invalid/"]}))
+    monkeypatch.setattr(federation, "fetch_remote_index_text", lambda *a: pytest.fail("broadened scope used"))
+    assert not verifier.verify(*paths)["all_verified"]
+
+
+@pytest.mark.parametrize("target", ["https://attacker.invalid/stolen", "https://forgejo.coulomb.social/other/repo"])
+def test_native_auth_redirect_never_replays_header(monkeypatch, target):
+    calls = []
+
+    class FakeHTTPS(HTTPSHandler):
+        def https_open(self, req):
+            calls.append(req.full_url)
+            headers = Message()
+            headers["Location"] = target
+            result = addinfourl(io.BytesIO(b""), headers, req.full_url, 302)
+            result.msg = "Found"
+            return result
+
+    # Use real urllib opener/redirect/error processors and fake HTTPS transport.
+    opener = build_opener(FakeHTTPS(), federation._RejectAuthenticatedRedirect())
+    monkeypatch.setattr(federation.urllib.request, "build_opener", lambda *a: opener)
+    monkeypatch.setenv("FIXTURE_AUTH", "fixture-secret")
+    monkeypatch.setenv("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", json.dumps({"FIXTURE_AUTH": ["https://forgejo.coulomb.social/approved"]}))
+    with pytest.raises(ConnectionError, match="redirect refused"):
+        federation.fetch_remote_index_text("https://forgejo.coulomb.social/approved", {"repo": "fixture", "auth_env": "FIXTURE_AUTH"})
+    assert calls == ["https://forgejo.coulomb.social/approved"]
+
+
+def test_authenticated_http_rejected_before_transport(monkeypatch):
+    monkeypatch.setenv("FIXTURE_AUTH", "fixture-secret")
+    monkeypatch.setattr(federation.urllib.request, "build_opener", lambda *a: pytest.fail("cleartext transport"))
+    with pytest.raises(ValueError, match="HTTPS"):
+        federation.fetch_remote_index_text("http://forgejo.coulomb.social/approved", {"repo": "fixture", "auth_env": "FIXTURE_AUTH"})
+
+
+@pytest.mark.parametrize("config", [None, "broken-json", "[]", '{"FIXTURE_AUTH":"https://attacker.invalid/"}', '{"OTHER_AUTH":["https://attacker.invalid/"]}'])
+def test_unapproved_auth_target_rejected_before_credential_lookup(monkeypatch, config):
+    if config is None:
+        monkeypatch.delenv("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", raising=False)
+    else:
+        monkeypatch.setenv("REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST", config)
+    monkeypatch.setattr(federation, "_auth_headers", lambda *a: pytest.fail("unauthorized credential lookup"))
+    with pytest.raises(ValueError, match="runtime-authorized"):
+        federation.fetch_remote_index_text("https://attacker.invalid/", {"repo": "fixture", "auth_env": "FIXTURE_AUTH"})
diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
new file mode 100644
index 0000000..04dc0fa
--- /dev/null
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -0,0 +1,66 @@
+---
+id: REUSE-WP-0025
+type: workplan
+title: "Bind private source reader to consented metadata URLs"
+domain: infotech
+repo: reuse-surface
+status: blocked
+owner: reuse-surface-owner-preparation-worker
+created: "2026-10-15"
+updated: "2026-10-15"
+flavor: implementation
+depends_on: [CUST-WP-0081]
+---
+
+Prepared in an isolated owner checkout under the user's explicit worker-agent
+request. This worker has supervised local preparation scope only; no founder
+credential approval, permanent repo-owner authority, deployment, or source-owner
+consent is inferred. The custodian integration agent handles hub synchronization
+after accepting the proposed owner workitem. No State Hub mutation is performed
+from this isolated checkout.
+
+## Independent consumer review
+
+```task
+id: REUSE-WP-0025-T01
+status: done
+priority: high
+```
+
+Reviewed consumer INTENT, native authenticated acquisition, public API registration
+fields, and stale-cache behavior. The deployed baseline is unsuitable for a new
+private reader: registered auth_env/URL can route runtime credentials to arbitrary
+hosts; urllib's default redirect handler also forwards Authorization. Review is
+`changes_requested`; metadata consent does not authorize reader provisioning.
+See docs/assessments/cust81-private-reader/owner-review-r1.md.
+
+## Prepare native boundary and verification helper
+
+```task
+id: REUSE-WP-0025-T02
+status: done
+priority: high
+```
+
+Patch rejects authenticated cleartext URLs and all redirects, and requires an
+operator-controlled exact env-to-URL allowlist before credential lookup. Receipt
+helper invokes native fetch directly for all seven consented index/entry pairs,
+checks exact hashes and entry schema, and never uses cached fallback. Fake
+transport tests and local committed metadata validation are preparation evidence,
+not live authenticated fetch receipts.
+
+## Review, publish and verify deployed consumer
+
+```task
+id: REUSE-WP-0025-T03
+status: wait
+priority: high
+```
+
+Owner review and exact credential/rollout disposition remain pending. Platform/apps
+must inventory every existing authenticated dynamic registration without reading
+Secret values, migrate approved exact URLs, and deliver a reviewed image containing
+the fix plus the exact reader allowlist. Then run helper inside the hub environment
+with the owner-provided packets, verify all seven sources fresh, and hand a
+sanitized receipt to the custodian for registration and final 70-capability audit.
+No new PAT is delivered to the current baseline consumer.

From d36fc463bc3d4752ec87a176ac900eb3b4be1cc8 Mon Sep 17 00:00:00 2001
From: repo-manager 
Date: Thu, 15 Oct 2026 01:26:01 +0200
Subject: [PATCH 33/55] repo.work.assign_missing_identifiers

source: repo-manager
reason: deterministic projection registration

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684
---
 workplans/REUSE-WP-0025-private-source-reader-boundary.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
index 04dc0fa..ff13038 100644
--- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -10,6 +10,7 @@ created: "2026-10-15"
 updated: "2026-10-15"
 flavor: implementation
 depends_on: [CUST-WP-0081]
+state_hub_workstream_id: "23c7bcf5-5f5d-524f-a06e-be5247ae1a98"
 ---
 
 Prepared in an isolated owner checkout under the user's explicit worker-agent
@@ -25,6 +26,7 @@ from this isolated checkout.
 id: REUSE-WP-0025-T01
 status: done
 priority: high
+state_hub_task_id: "1f841e28-fc55-5b12-bb51-bb3291f17d8b"
 ```
 
 Reviewed consumer INTENT, native authenticated acquisition, public API registration
@@ -40,6 +42,7 @@ See docs/assessments/cust81-private-reader/owner-review-r1.md.
 id: REUSE-WP-0025-T02
 status: done
 priority: high
+state_hub_task_id: "a9e794f6-a894-52e6-bd93-4781e05c6a55"
 ```
 
 Patch rejects authenticated cleartext URLs and all redirects, and requires an
@@ -55,6 +58,7 @@ not live authenticated fetch receipts.
 id: REUSE-WP-0025-T03
 status: wait
 priority: high
+state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
 ```
 
 Owner review and exact credential/rollout disposition remain pending. Platform/apps

From 662782e65ade239e5194e16f4c4a902c792d8d44 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Fri, 16 Oct 2026 01:37:23 +0200
Subject: [PATCH 34/55] registry: expose identity backup and bootstrap recovery
 handoff

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13eab-1e6a-7b33-9c37-372e90ada3a2
---
 registry/indexes/federated.yaml | 185 +++++++++++++++++---------------
 1 file changed, 99 insertions(+), 86 deletions(-)

diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 520c63a..ba83e2f 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,5 +1,7 @@
+# Composed federated capability index. Regenerate with:
+# reuse-surface federation compose
 version: 1
-updated: '2026-10-14'
+updated: '2026-10-16'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -18,68 +20,68 @@ sources:
 - repo: artifact-store
   count: 1
   url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/artifact-store.yaml
+  cache: registry/federation/cache/artifact-store.yaml
 - repo: audit-core
   count: 1
   index: ../audit-core/registry/indexes/capabilities.yaml
 - repo: can-you-assist
   count: 1
   url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/can-you-assist.yaml
+  cache: registry/federation/cache/can-you-assist.yaml
 - repo: citation-engine
   count: 1
   url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/citation-engine.yaml
+  cache: registry/federation/cache/citation-engine.yaml
 - repo: citation-evidence
   count: 1
   url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/citation-evidence.yaml
+  cache: registry/federation/cache/citation-evidence.yaml
 - repo: citation-work
   count: 0
   url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/citation-work.yaml
+  cache: registry/federation/cache/citation-work.yaml
 - repo: commerce-canon
   count: 2
   url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml
+  cache: registry/federation/cache/commerce-canon.yaml
 - repo: config-atlas
   count: 1
   url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/config-atlas.yaml
+  cache: registry/federation/cache/config-atlas.yaml
 - repo: coordination-engine
   count: 1
   index: ../coordination-engine/registry/indexes/capabilities.yaml
 - repo: core-hub
   count: 1
   url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/core-hub.yaml
+  cache: registry/federation/cache/core-hub.yaml
 - repo: domain-tree
   count: 0
   url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/domain-tree.yaml
+  cache: registry/federation/cache/domain-tree.yaml
 - repo: email-connect
   count: 1
   url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/email-connect.yaml
+  cache: registry/federation/cache/email-connect.yaml
 - repo: emergent-security
   count: 1
   index: ../emergent-security/registry/indexes/capabilities.yaml
 - repo: evidence-anchor
   count: 0
   url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/evidence-anchor.yaml
+  cache: registry/federation/cache/evidence-anchor.yaml
 - repo: evidence-binder
   count: 2
   url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml
+  cache: registry/federation/cache/evidence-binder.yaml
 - repo: evidence-source
   count: 1
   url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/evidence-source.yaml
+  cache: registry/federation/cache/evidence-source.yaml
 - repo: feature-control
   count: 3
   url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
+  cache: registry/federation/cache/feature-control.yaml
 - repo: fin-hub
   count: 1
   index: ../fin-hub/registry/indexes/capabilities.yaml
@@ -92,23 +94,23 @@ sources:
 - repo: guide-board
   count: 1
   url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/guide-board.yaml
+  cache: registry/federation/cache/guide-board.yaml
 - repo: helix-forge
   count: 0
   url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/helix-forge.yaml
+  cache: registry/federation/cache/helix-forge.yaml
 - repo: hub-core
   count: 1
   url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/hub-core.yaml
+  cache: registry/federation/cache/hub-core.yaml
 - repo: human-resources
   count: 1
   url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/human-resources.yaml
+  cache: registry/federation/cache/human-resources.yaml
 - repo: ihp-railiance-probe
   count: 0
   url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/ihp-railiance-probe.yaml
+  cache: registry/federation/cache/ihp-railiance-probe.yaml
 - repo: info-tech-canon
   count: 1
   index: ../info-tech-canon/registry/indexes/capabilities.yaml
@@ -118,14 +120,14 @@ sources:
 - repo: infospace-bench
   count: 1
   url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/infospace-bench.yaml
+  cache: registry/federation/cache/infospace-bench.yaml
 - repo: issue-core
   count: 1
   index: ../issue-core/registry/indexes/capabilities.yaml
 - repo: kaizen-agentic
   count: 1
   url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/kaizen-agentic.yaml
+  cache: registry/federation/cache/kaizen-agentic.yaml
 - repo: key-cape
   count: 1
   index: ../key-cape/registry/indexes/capabilities.yaml
@@ -135,27 +137,27 @@ sources:
 - repo: kontextual-engine
   count: 1
   url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/kontextual-engine.yaml
+  cache: registry/federation/cache/kontextual-engine.yaml
 - repo: llm-connect
   count: 1
   url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/llm-connect.yaml
+  cache: registry/federation/cache/llm-connect.yaml
 - repo: markitect-filter
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/markitect-filter.yaml
+  cache: registry/federation/cache/markitect-filter.yaml
 - repo: markitect-main
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/markitect-main.yaml
+  cache: registry/federation/cache/markitect-main.yaml
 - repo: markitect-quarkdown
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/markitect-quarkdown.yaml
+  cache: registry/federation/cache/markitect-quarkdown.yaml
 - repo: markitect-tool
   count: 1
   url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/markitect-tool.yaml
+  cache: registry/federation/cache/markitect-tool.yaml
 - repo: maturity-engine
   count: 1
   index: ../maturity-engine/registry/indexes/capabilities.yaml
@@ -165,18 +167,18 @@ sources:
 - repo: open-cmis-tck
   count: 1
   url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/open-cmis-tck.yaml
+  cache: registry/federation/cache/open-cmis-tck.yaml
 - repo: open-reuse
   count: 1
   url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/open-reuse.yaml
+  cache: registry/federation/cache/open-reuse.yaml
 - repo: ops-bridge
   count: 1
   index: ../ops-bridge/registry/indexes/capabilities.yaml
 - repo: ops-hub
   count: 1
   url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/ops-hub.yaml
+  cache: registry/federation/cache/ops-hub.yaml
 - repo: ops-mason
   count: 1
   index: ../ops-mason/registry/indexes/capabilities.yaml
@@ -186,7 +188,7 @@ sources:
 - repo: phase-memory
   count: 1
   url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/phase-memory.yaml
+  cache: registry/federation/cache/phase-memory.yaml
 - repo: policy-nexus
   count: 1
   index: ../policy-nexus/registry/indexes/capabilities.yaml
@@ -265,11 +267,11 @@ sources:
 - repo: repo-scoping
   count: 1
   url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/repo-scoping.yaml
+  cache: registry/federation/cache/repo-scoping.yaml
 - repo: repo-seed
   count: 1
   url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/repo-seed.yaml
+  cache: registry/federation/cache/repo-seed.yaml
 - repo: resource-control
   count: 1
   index: ../resource-control/registry/indexes/capabilities.yaml
@@ -300,14 +302,14 @@ sources:
 - repo: shard-wiki
   count: 8
   url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  cache: registry/federation/cache/shard-wiki.yaml
 - repo: state-hub
   count: 2
   index: ../state-hub/registry/indexes/capabilities.yaml
 - repo: tegwick-control
   count: 0
   url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/tegwick-control.yaml
+  cache: registry/federation/cache/tegwick-control.yaml
 - repo: tenant-engine
   count: 1
   index: ../tenant-engine/registry/indexes/capabilities.yaml
@@ -320,22 +322,22 @@ sources:
 - repo: vantage-point
   count: 1
   url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/vantage-point.yaml
+  cache: registry/federation/cache/vantage-point.yaml
 - repo: vergabe-teilnahme
   count: 1
   url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/vergabe-teilnahme.yaml
+  cache: registry/federation/cache/vergabe-teilnahme.yaml
 - repo: whitehat-security
   count: 1
   index: ../whitehat-security/registry/indexes/capabilities.yaml
 - repo: whynot-control
   count: 0
   url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/whynot-control.yaml
+  cache: registry/federation/cache/whynot-control.yaml
 - repo: whynot-design
   count: 1
   url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
-  cache: /tmp/netkingdom-reuse-federation-cache/whynot-design.yaml
+  cache: registry/federation/cache/whynot-design.yaml
 - repo: zone-engine
   count: 1
   index: ../zone-engine/registry/indexes/capabilities.yaml
@@ -379,7 +381,7 @@ capabilities:
   - cli
   source_repo: can-you-assist
   source_url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/can-you-assist.yaml
+  source_index: registry/federation/cache/can-you-assist.yaml
 - id: capability.agents.custodian-runtime-tooling
   name: Generic agent runtime and repository tooling
   summary: Agent runtime modules and repository classification tooling.
@@ -423,7 +425,7 @@ capabilities:
   - file contracts
   source_repo: kaizen-agentic
   source_url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/kaizen-agentic.yaml
+  source_index: registry/federation/cache/kaizen-agentic.yaml
 - id: capability.agents.llm-connector
   name: Pluggable LLM Adapter Library (llm-connect)
   summary: Provider-neutral Python/CLI LLM adapter library supporting OpenRouter,
@@ -443,7 +445,7 @@ capabilities:
   - cli
   source_repo: llm-connect
   source_url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/llm-connect.yaml
+  source_index: registry/federation/cache/llm-connect.yaml
 - id: capability.agents.performance-learning
   name: Agent performance learning
   summary: Capture sessions, curate patterns, distribute lessons and measure outcomes.
@@ -481,7 +483,7 @@ capabilities:
   - ui
   source_repo: repo-scoping
   source_url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/repo-scoping.yaml
+  source_index: registry/federation/cache/repo-scoping.yaml
 - id: capability.audit.event-retain
   name: Independent audit custody
   summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.
@@ -537,7 +539,7 @@ capabilities:
   - library import (guide-board extension)
   source_repo: open-cmis-tck
   source_url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/open-cmis-tck.yaml
+  source_index: registry/federation/cache/open-cmis-tck.yaml
 - id: capability.communication.compliance-evidence-framework
   name: Certification And Compliance Evidence Framework
   summary: Framework that turns standards, conformance, regulatory, and repository-quality
@@ -557,7 +559,7 @@ capabilities:
   - cli
   source_repo: guide-board
   source_url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/guide-board.yaml
+  source_index: registry/federation/cache/guide-board.yaml
 - id: capability.communication.context-engine
   name: Kontextual Engine (Knowledge Operations Runtime)
   summary: Headless knowledge-operations engine turning heterogeneous information
@@ -576,7 +578,7 @@ capabilities:
   - library import
   source_repo: kontextual-engine
   source_url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/kontextual-engine.yaml
+  source_index: registry/federation/cache/kontextual-engine.yaml
 - id: capability.communication.infospace-workspace
   name: Infospace Workspace And Evaluation Bench
   summary: Workspace and service for creating, developing, evaluating, and inspecting
@@ -596,7 +598,7 @@ capabilities:
   - library import (consumed by info-tech-canon)
   source_repo: infospace-bench
   source_url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/infospace-bench.yaml
+  source_index: registry/federation/cache/infospace-bench.yaml
 - id: capability.communication.markitect-legacy-platform
   name: MarkiTect Legacy Platform
   summary: Intelligent markdown engine and information-management platform treating
@@ -616,7 +618,7 @@ capabilities:
   - application (legacy, not recommended for new integration)
   source_repo: markitect-main
   source_url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-main.yaml
+  source_index: registry/federation/cache/markitect-main.yaml
 - id: capability.communication.markitect-quarkdown-adapter
   name: Markitect Quarkdown Render Adapter
   summary: Concrete Quarkdown render/export adapter for Markitect, mapping Markitect
@@ -635,7 +637,7 @@ capabilities:
   - library import (plugin/entry-point)
   source_repo: markitect-quarkdown
   source_url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-quarkdown.yaml
+  source_index: registry/federation/cache/markitect-quarkdown.yaml
 - id: capability.communication.markitect-source-adapters
   name: Markitect Source-Format Adapters
   summary: Concrete source-format adapters (EPUB3, PDF) converting external document
@@ -654,7 +656,7 @@ capabilities:
   - library import (plugin/entry-point)
   source_repo: markitect-filter
   source_url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-filter.yaml
+  source_index: registry/federation/cache/markitect-filter.yaml
 - id: capability.communication.markitect-toolkit
   name: Markitect Markdown Toolkit And CLI
   summary: Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown
@@ -675,7 +677,7 @@ capabilities:
   - library import
   source_repo: markitect-tool
   source_url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/markitect-tool.yaml
+  source_index: registry/federation/cache/markitect-tool.yaml
 - id: capability.coordination.cross-owner-work
   name: Cross-owner coordination lifecycle
   summary: Observation, lease, wake-up, checkpoint and receipt contracts/runtime.
@@ -713,7 +715,7 @@ capabilities:
   - django template adapter
   source_repo: whynot-design
   source_url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/whynot-design.yaml
+  source_index: registry/federation/cache/whynot-design.yaml
 - id: capability.evidence.binding
   name: Evidence-to-Target Binding
   summary: Links evidence items to structured targets with relation, status, and confidence
@@ -735,7 +737,7 @@ capabilities:
   - React provider
   source_repo: evidence-binder
   source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml
+  source_index: registry/federation/cache/evidence-binder.yaml
 - id: capability.evidence.rect-registry
   name: Visual-Guide Rect Registry
   summary: Coordinates field, evidence-card, and highlight rectangles from independent
@@ -756,7 +758,7 @@ capabilities:
   - React component
   source_repo: evidence-binder
   source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml
+  source_index: registry/federation/cache/evidence-binder.yaml
 - id: capability.execution.openweight-rein
   name: Bounded open-weight agent execution
   summary: Tool loop, path guards, turn/budget limits and verified-commit result.
@@ -851,7 +853,7 @@ capabilities:
   - service API
   source_repo: feature-control
   source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
+  source_index: registry/federation/cache/feature-control.yaml
 - id: capability.feature-control.rollout
   name: Feature Rollout Control
   summary: Gradually expose features to subjects across tenants, domains, groups,
@@ -870,7 +872,7 @@ capabilities:
   - SDK
   source_repo: feature-control
   source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
+  source_index: registry/federation/cache/feature-control.yaml
 - id: capability.feature-control.visibility
   name: Feature Visibility Control
   summary: Control whether features are visible or hidden for subjects without changing
@@ -887,7 +889,7 @@ capabilities:
   - source module
   source_repo: feature-control
   source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml
+  source_index: registry/federation/cache/feature-control.yaml
 - id: capability.finance.security-budget-evidence
   name: Budget and cost evidence for security operations
   summary: Budget, commitment, spend attribution and planning-evidence consumption.
@@ -923,7 +925,7 @@ capabilities:
   - informational (specification only)
   source_repo: vantage-point
   source_url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/vantage-point.yaml
+  source_index: registry/federation/cache/vantage-point.yaml
 - id: capability.hr.workflow-catalog
   name: HR Workflow Catalog
   summary: Markdown-first registry of HR planning workflows with an iterative assessment
@@ -942,7 +944,7 @@ capabilities:
   - informational
   source_repo: human-resources
   source_url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/human-resources.yaml
+  source_index: registry/federation/cache/human-resources.yaml
 - id: capability.iam.key-cape
   name: OIDC identity and assurance
   summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.
@@ -979,7 +981,7 @@ capabilities:
   - informational
   source_repo: commerce-canon
   source_url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml
+  source_index: registry/federation/cache/commerce-canon.yaml
 - id: capability.identity.tenant-facts
   name: Tenant lifecycle and guardrail facts
   summary: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.
@@ -1035,7 +1037,7 @@ capabilities:
   - informational
   source_repo: commerce-canon
   source_url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml
+  source_index: registry/federation/cache/commerce-canon.yaml
 - id: capability.infotech.artifact-store
   name: Artifact Registry And Storage Gateway
   summary: Generic artifact registry and storage gateway for generated outputs, evidence
@@ -1055,7 +1057,7 @@ capabilities:
   - cli
   source_repo: artifact-store
   source_url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/artifact-store.yaml
+  source_index: registry/federation/cache/artifact-store.yaml
 - id: capability.infotech.canon-service
   name: Shared semantic contracts and validation
   summary: Markdown canon with library, CLI and read-only API.
@@ -1094,7 +1096,7 @@ capabilities:
   - library import (workspace link)
   source_repo: citation-engine
   source_url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/citation-engine.yaml
+  source_index: registry/federation/cache/citation-engine.yaml
 - id: capability.infotech.citation-evidence-workspace
   name: Citation Evidence Workspace
   summary: "Document-centered evidence workspace for capturing, managing, presenting,\
@@ -1113,7 +1115,7 @@ capabilities:
   - application (local dev server)
   source_repo: citation-evidence
   source_url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/citation-evidence.yaml
+  source_index: registry/federation/cache/citation-evidence.yaml
 - id: capability.infotech.config-surface-atlas
   name: Configuration Surface Atlas
   summary: "Read-first, cross-kind map and evidence layer for configuration surfaces\
@@ -1135,7 +1137,7 @@ capabilities:
   - source module
   source_repo: config-atlas
   source_url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/config-atlas.yaml
+  source_index: registry/federation/cache/config-atlas.yaml
 - id: capability.infotech.core-hub
   name: Core Hub Production Interaction Framework
   summary: Contract-first framework for cross-domain state, agent coordination, evidence,
@@ -1158,7 +1160,7 @@ capabilities:
   - cli
   source_repo: core-hub
   source_url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/core-hub.yaml
+  source_index: registry/federation/cache/core-hub.yaml
 - id: capability.infotech.email-connector
   name: Mailbox Evidence Scanner (email-connect)
   summary: Headless, provider-neutral email communication and evidence service; first
@@ -1177,7 +1179,7 @@ capabilities:
   - cli
   source_repo: email-connect
   source_url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/email-connect.yaml
+  source_index: registry/federation/cache/email-connect.yaml
 - id: capability.infotech.headless-browser
   name: Headless Browser Automation
   summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright
@@ -1236,7 +1238,7 @@ capabilities:
   - library import
   source_repo: hub-core
   source_url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/hub-core.yaml
+  source_index: registry/federation/cache/hub-core.yaml
 - id: capability.infotech.issue-tracking
   name: External issue tracker connector
   summary: CLI and Python adapters for external issue systems.
@@ -1275,7 +1277,7 @@ capabilities:
   - library import
   source_repo: open-reuse
   source_url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/open-reuse.yaml
+  source_index: registry/federation/cache/open-reuse.yaml
 - id: capability.infotech.pdf-evidence-ingest
   name: Headless PDF Evidence Ingest
   summary: "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation\
@@ -1296,7 +1298,7 @@ capabilities:
   - library import
   source_repo: evidence-source
   source_url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/evidence-source.yaml
+  source_index: registry/federation/cache/evidence-source.yaml
 - id: capability.infotech.repo-template
   name: Coulomb Repository Template
   summary: Bootstrap new git repositories with agent instructions, registry scaffold,
@@ -1316,7 +1318,7 @@ capabilities:
   - informational
   source_repo: repo-seed
   source_url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/repo-seed.yaml
+  source_index: registry/federation/cache/repo-seed.yaml
 - id: capability.infotech.runbook-tutorials
   name: Guided administrative runbooks
   summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.
@@ -1369,7 +1371,7 @@ capabilities:
   - library import
   source_repo: phase-memory
   source_url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/phase-memory.yaml
+  source_index: registry/federation/cache/phase-memory.yaml
 - id: capability.observability.security-signals
   name: Security-relevant telemetry contracts and adapters
   summary: Signal contract, platform adapters, report exporter and absence/alert rules.
@@ -1406,7 +1408,7 @@ capabilities:
   - command-line bootstrap
   source_repo: ops-hub
   source_url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/ops-hub.yaml
+  source_index: registry/federation/cache/ops-hub.yaml
 - id: capability.ops.tunnel-bridge
   name: SSH tunnel lifecycle
   summary: Named tunnels, reconnect, health and TTL-aware cert_command.
@@ -1462,10 +1464,10 @@ capabilities:
   - application (Django + Vite, local dev via docker-compose)
   source_repo: vergabe-teilnahme
   source_url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/vergabe-teilnahme.yaml
+  source_index: registry/federation/cache/vergabe-teilnahme.yaml
 - id: capability.railiance.bootstrap-sequencing
   name: Bootstrap sequencing contracts
-  summary: Bare-VM to estate sequence and handoff contract.
+  summary: Bare-VM sequencing with NetKingdom identity backup recovery handoff.
   domain: infotech
   status: draft
   owner: railiance-bootstrap
@@ -1473,6 +1475,9 @@ capabilities:
   - security
   - netkingdom
   - framework-reuse
+  - backup
+  - restore
+  - disaster-recovery
   vector: D3 / A0 / C1 / R0
   path: registry/capabilities/capability.railiance.bootstrap-sequencing.md
   consumption_modes:
@@ -1960,8 +1965,8 @@ capabilities:
   source_index: ../approval-engine/registry/indexes/capabilities.yaml
 - id: capability.security.bootstrap-recovery
   name: Guarded bootstrap and recovery preparation
-  summary: Local identity, bootstrap console, encrypted custody handoff and caller
-    tools.
+  summary: Encrypted identity backup, independent retrieval and isolated recovery
+    verification with bootstrap handoff.
   domain: infotech
   status: draft
   owner: net-kingdom
@@ -1969,6 +1974,14 @@ capabilities:
   - security
   - netkingdom
   - framework-reuse
+  - backup
+  - restore
+  - disaster-recovery
+  - age
+  - privacyidea
+  - lldap
+  - authelia
+  - keycape
   vector: D3 / A2 / C1 / R0
   path: registry/capabilities/capability.security.bootstrap-recovery.md
   consumption_modes:
@@ -2369,7 +2382,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml
 - id: capability.wiki.coordination-journal
   name: Event-Sourced Coordination Journal
   summary: An append-only, totally-ordered-per-space decision log whose current state
@@ -2390,7 +2403,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml
 - id: capability.wiki.derived-views
   name: Wiki Derived Views
   summary: "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges,\
@@ -2411,7 +2424,7 @@ capabilities:
   - informational
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml
 - id: capability.wiki.engine-typed-extensions
   name: Wiki Engine with Typed Extensions
   summary: A small-core wiki engine realizing a typed-extension framework that addresses
@@ -2431,7 +2444,7 @@ capabilities:
   - informational
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml
 - id: capability.wiki.federation-models
   name: Selectable Federation-Model Taxonomy
   summary: Federation as a plural, composable coordination axis (fork+journal, VCS-replication,
@@ -2451,7 +2464,7 @@ capabilities:
   - informational
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml
 - id: capability.wiki.overlay
   name: Overlay-Before-Mutation Write Path
   summary: Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only
@@ -2472,7 +2485,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml
 - id: capability.wiki.page-model
   name: Backend-Neutral Wiki Page Model
   summary: A Markdown-first but stretchable page model with stable identity separate
@@ -2493,7 +2506,7 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml
 - id: capability.wiki.shard-orchestration
   name: Wiki Shard Orchestration
   summary: Present a union of pages across heterogeneous wiki-shaped shards while
@@ -2513,4 +2526,4 @@ capabilities:
   - source module
   source_repo: shard-wiki
   source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
-  source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml
+  source_index: registry/federation/cache/shard-wiki.yaml

From dd00b27b4ce77180b01c5756c2a3841819fcac76 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Fri, 16 Oct 2026 21:01:43 +0200
Subject: [PATCH 35/55] fix(registry): reject owner index drift and duplicate
 discovery rows

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
---
 reuse_surface/cli.py          | 50 +++++++++++++++++--
 tests/test_index_parity.py    | 91 +++++++++++++++++++++++++++++++++++
 workplans/ADHOC-2026-10-16.md | 31 ++++++++++++
 3 files changed, 168 insertions(+), 4 deletions(-)
 create mode 100644 tests/test_index_parity.py
 create mode 100644 workplans/ADHOC-2026-10-16.md

diff --git a/reuse_surface/cli.py b/reuse_surface/cli.py
index 39ba2de..5c47322 100644
--- a/reuse_surface/cli.py
+++ b/reuse_surface/cli.py
@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import argparse
+from collections import Counter
 import json
 import sys
 from pathlib import Path
@@ -87,6 +88,7 @@ from reuse_surface.registry import (
     parse_vector,
     registry_paths,
     resolve_repo_root,
+    vectors_match,
 )
 
 
@@ -114,12 +116,48 @@ def _check_index_drift(
     repo_root: Path,
 ) -> list[str]:
     warnings: list[str] = []
-    indexed_paths = {item["path"] for item in index.get("capabilities", [])}
+    if not isinstance(index, dict) or not isinstance(index.get("capabilities"), list):
+        return ["index drift: index must contain a capabilities list"]
+    rows = []
+    for position, row in enumerate(index["capabilities"]):
+        if not isinstance(row, dict) or any(
+            not isinstance(row.get(field), str) or not row[field]
+            for field in ("id", "path")
+        ):
+            warnings.append(f"index drift: row {position} requires nonempty string id and path")
+            continue
+        rows.append(row)
+    indexed_paths = {item["path"] for item in rows}
     file_paths = {str(path.relative_to(repo_root)) for path in entry_paths}
     for path in sorted(file_paths - indexed_paths):
         warnings.append(f"index drift: entry file not indexed: {path}")
     for path in sorted(indexed_paths - file_paths):
         warnings.append(f"index drift: index references missing file: {path}")
+    for field in ("id", "path"):
+        for value, count in sorted(Counter(row[field] for row in rows).items()):
+            if count > 1:
+                warnings.append(f"index drift: duplicate {field}: {value} ({count} rows)")
+    for row in rows:
+        path = repo_root / row["path"]
+        if not path.is_file():
+            continue
+        try:
+            entry = parse_front_matter(path)
+        except (ValueError, yaml.YAMLError):
+            continue  # The entry validation pass reports malformed source.
+        # The index projects the owner entry; index-only changes cannot replace it.
+        for field in ("id", "name", "summary", "domain", "status", "owner", "tags"):
+            if row.get(field) != entry.get(field):
+                warnings.append(f"index drift: {row['path']}: {field} differs from entry")
+        availability = entry.get("availability")
+        modes = availability.get("consumption_modes") if isinstance(availability, dict) else None
+        if row.get("consumption_modes") != modes:
+            warnings.append(f"index drift: {row['path']}: consumption_modes differs from entry")
+        try:
+            if not vectors_match(row["vector"], entry):
+                warnings.append(f"index drift: {row['path']}: vector differs from entry")
+        except (KeyError, TypeError, AttributeError):
+            warnings.append(f"index drift: {row['path']}: vector cannot be compared to entry")
     return warnings
 
 
@@ -145,7 +183,7 @@ def _run_validate(
     for path in paths:
         try:
             data = parse_front_matter(path)
-        except ValueError as exc:
+        except (ValueError, yaml.YAMLError) as exc:
             errors.append(str(exc))
             continue
         for error in sorted(validator.iter_errors(data), key=lambda e: e.path):
@@ -155,8 +193,12 @@ def _run_validate(
     if not target:
         index_path = registry_paths(repo_root)["index"]
         if index_path.exists():
-            index = load_index_at(index_path)
-            warnings.extend(_check_index_drift(paths, index, repo_root))
+            try:
+                index = load_index_at(index_path)
+            except (ValueError, yaml.YAMLError) as exc:
+                errors.append(f"{index_path}: {exc}")
+            else:
+                warnings.extend(_check_index_drift(paths, index, repo_root))
         if relations and repo_root == ROOT:
             warnings.extend(check_relations())
     return errors, warnings, paths
diff --git a/tests/test_index_parity.py b/tests/test_index_parity.py
new file mode 100644
index 0000000..3a2774b
--- /dev/null
+++ b/tests/test_index_parity.py
@@ -0,0 +1,91 @@
+"""Exercise the same strict native validator used by the existing Forgejo job."""
+from __future__ import annotations
+
+import copy
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def fixture_registry(tmp_path):
+    index = yaml.safe_load((ROOT / "registry/indexes/capabilities.yaml").read_text())
+    row = copy.deepcopy(index["capabilities"][0])
+    source = ROOT / row["path"]
+    target = tmp_path / row["path"]
+    target.parent.mkdir(parents=True)
+    target.write_bytes(source.read_bytes())
+    index["capabilities"] = [row]
+    index_path = tmp_path / "registry/indexes/capabilities.yaml"
+    index_path.parent.mkdir(parents=True)
+    return index_path, index
+
+
+def validate(root):
+    return subprocess.run(
+        [sys.executable, "-m", "reuse_surface.cli", "validate", "--root", str(root),
+         "--fail-on-warnings"], cwd=ROOT, capture_output=True, text=True,
+    )
+
+
+@pytest.mark.parametrize("field,value", [
+    ("id", "capability.synthetic.stale"), ("name", "stale name"),
+    ("summary", "stale summary"), ("domain", "stale-domain"),
+    ("status", "retired"), ("owner", "wrong-owner"),
+    ("tags", ["stale"]), ("consumption_modes", ["stale"]),
+    ("vector", "D0 / A0 / C0 / R0"),
+])
+def test_existing_strict_validator_refuses_stale_projection(tmp_path, field, value):
+    path, index = fixture_registry(tmp_path)
+    path.write_text(yaml.safe_dump(index))
+    assert validate(tmp_path).returncode == 0
+    original_entry = (tmp_path / index["capabilities"][0]["path"]).read_bytes()
+    index["capabilities"][0][field] = value
+    path.write_text(yaml.safe_dump(index))
+    result = validate(tmp_path)
+    assert result.returncode == 1, result.stdout + result.stderr
+    assert f"{field} differs from entry" in result.stderr
+    assert (tmp_path / index["capabilities"][0]["path"]).read_bytes() == original_entry
+
+
+def test_duplicate_id_and_path_cannot_satisfy_exactly_once(tmp_path):
+    path, index = fixture_registry(tmp_path)
+    index["capabilities"].append(copy.deepcopy(index["capabilities"][0]))
+    path.write_text(yaml.safe_dump(index))
+    result = validate(tmp_path)
+    assert result.returncode == 1
+    assert "duplicate id:" in result.stderr
+    assert "duplicate path:" in result.stderr
+
+
+def test_equivalent_vector_whitespace_is_allowed(tmp_path):
+    path, index = fixture_registry(tmp_path)
+    index["capabilities"][0]["vector"] = index["capabilities"][0]["vector"].replace(" ", "")
+    path.write_text(yaml.safe_dump(index))
+    assert validate(tmp_path).returncode == 0
+
+
+@pytest.mark.parametrize("source", ["null", "[]", "availability: null", "availability: []", "availability: ["])
+def test_malformed_frontmatter_returns_failure_without_traceback(tmp_path, source):
+    path, index = fixture_registry(tmp_path)
+    path.write_text(yaml.safe_dump(index))
+    (tmp_path / index["capabilities"][0]["path"]).write_text("---\n" + source + "\n---\n")
+    result = validate(tmp_path)
+    assert result.returncode == 1
+    assert "Traceback" not in result.stderr
+    assert "error:" in result.stderr
+
+
+@pytest.mark.parametrize("rows", [None, {}, [None], [[]], [{}], [{"id": [], "path": "x"}], [{"id": "x", "path": None}]])
+def test_unvalidated_index_shape_returns_failure_without_traceback(tmp_path, rows):
+    path, index = fixture_registry(tmp_path)
+    index["capabilities"] = rows
+    path.write_text(yaml.safe_dump(index))
+    result = validate(tmp_path)
+    assert result.returncode == 1
+    assert "Traceback" not in result.stderr
+    assert "index drift:" in result.stderr
diff --git a/workplans/ADHOC-2026-10-16.md b/workplans/ADHOC-2026-10-16.md
new file mode 100644
index 0000000..333d601
--- /dev/null
+++ b/workplans/ADHOC-2026-10-16.md
@@ -0,0 +1,31 @@
+---
+id: REUSE-WP-ADHOC-2026-10-16
+type: workplan
+title: "Refuse owner/index drift in the existing native registry validator"
+domain: infotech
+repo: reuse-surface
+status: finished
+owner: codex
+created: "2026-10-16"
+updated: "2026-10-16"
+flavor: implementation
+---
+
+## Refuse owner/index drift in the existing native registry validator
+
+```task
+id: REUSE-WP-ADHOC-2026-10-16-T01
+status: done
+priority: medium
+```
+
+The existing strict validator accepted stale index metadata and duplicate IDs/paths. Extend its existing parity warnings and add native CLI regression tests, including malformed frontmatter/index shape without tracebacks. Existing mandatory Forgejo validation consumes this source; fleet adoption and hosted freshness are unverified.
+
+Completed 2026-10-16 under the founder's NetKingdom target implementation demand
+(CUST-WP-0080, TSA-11). Source review and exact before/after native CLI evidence:
+`the-custodian/docs/changes/netkingdom-target-2026-10-16/improvement-loop-next/`.
+The current 60-provider cohort has all 70 reviewed IDs exactly once; 3 field
+mismatches across 2 capabilities become zero with the source corrections.
+Native hosted refresh/readback and the accepted Activity/rein schedule remain
+separate gates. No production change, model call, credential access or external
+message was performed.

From 01af18964b170eaa87f8560ce9285518e8dc6d7e Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Fri, 16 Oct 2026 21:14:39 +0200
Subject: [PATCH 36/55] docs(registry): retain parity verification and
 projection bindings

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
---
 workplans/ADHOC-2026-10-16.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/workplans/ADHOC-2026-10-16.md b/workplans/ADHOC-2026-10-16.md
index 333d601..f56ca00 100644
--- a/workplans/ADHOC-2026-10-16.md
+++ b/workplans/ADHOC-2026-10-16.md
@@ -9,6 +9,7 @@ owner: codex
 created: "2026-10-16"
 updated: "2026-10-16"
 flavor: implementation
+state_hub_workstream_id: "803c5bb3-12c5-51be-9852-c6719f7c80fd"
 ---
 
 ## Refuse owner/index drift in the existing native registry validator
@@ -17,6 +18,7 @@ flavor: implementation
 id: REUSE-WP-ADHOC-2026-10-16-T01
 status: done
 priority: medium
+state_hub_task_id: "63c0e025-f7aa-5849-ac2f-61128ceb7a0e"
 ```
 
 The existing strict validator accepted stale index metadata and duplicate IDs/paths. Extend its existing parity warnings and add native CLI regression tests, including malformed frontmatter/index shape without tracebacks. Existing mandatory Forgejo validation consumes this source; fleet adoption and hosted freshness are unverified.
@@ -29,3 +31,15 @@ mismatches across 2 capabilities become zero with the source corrections.
 Native hosted refresh/readback and the accepted Activity/rein schedule remain
 separate gates. No production change, model call, credential access or external
 message was performed.
+
+Validation and publication checkpoint, 2026-10-16: 23 new native CLI cases
+passed, covering projected fields, duplicate ID/path, vector whitespace,
+malformed frontmatter and unvalidated index row shapes. Root independently
+reviewed source and passed all 30 parity/native-registry cases across its
+initial run and three required filesystem-approved reruns. The failed sandbox
+writes remain failed observations, not source defects. All three affected owner
+strict validations pass. Source commit `dd00b27` was published by the normal
+`statehub fix-consistency` backlog push; no manual push was used. Its automatic
+brief-only writeback was refused by the unchanged generated-only guard. This
+source record retains the issued workstream/task bindings; generated artifacts
+are not bundled to evade that refusal. Hosted readback remains outstanding.

From ed3c900efbe96b931747dee336bf30e92744764f Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Sun, 18 Oct 2026 21:58:34 +0200
Subject: [PATCH 37/55] Point browser discovery to the verified supervised
 managed development flow

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
---
 .../capability.infotech.headless-browser.md   | 43 ++++++++++---------
 registry/indexes/capabilities.yaml            | 17 +++-----
 2 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/registry/capabilities/capability.infotech.headless-browser.md b/registry/capabilities/capability.infotech.headless-browser.md
index 3adb61d..5ab4096 100644
--- a/registry/capabilities/capability.infotech.headless-browser.md
+++ b/registry/capabilities/capability.infotech.headless-browser.md
@@ -2,18 +2,7 @@
 id: capability.infotech.headless-browser
 name: Headless Browser Automation
 summary: >-
-  Headless browser automation, screenshots and keyboard trials through
-  rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4).
-  Published A5 local container; managed Railiance admission is pending.
-  Download the Python 3.10+ standalone client from
-  https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
-  and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`,
-  then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
-  with a fresh output directory. This endpoint was verified locally on 2026-10-13
-  and is ephemeral; it installs no browser for the caller. If unreachable,
-  follow the local container setup in the capability card or adapt its A2 source
-  examples; this is an availability gap on the existing capability.
-  Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
+  Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Human and coding-agent managed trials passed on 2026-10-18 through the existing supervised workstation connection. Use the documented kubectl port-forward to 127.0.0.1:18081, then the pinned standalone Python client preflight/trial commands. No local browser installation. Independent per-caller managed admission remains pending; availability stays A5. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
 owner: reuse-surface
 status: reviewed
 domain: infotech
@@ -34,7 +23,8 @@ maturity:
       rapp-playwright 0.1.0 is a published immutable container with a versioned
       HTTP contract and standalone Python client, independently trialled locally.
       A5 describes deployable container availability, not managed operation (A6).
-      Railiance admission is pending. Existing A2 source adaptation remains usable;
+      The supervised managed build profile has real human/agent receipts; independent
+      per-caller admission remains pending. Existing A2 source adaptation remains usable;
       no endpoint uptime or caller browser installation is implied.
 external_evidence:
   completeness:
@@ -45,8 +35,9 @@ external_evidence:
       - Identifies implemented consumers, browser engines and source entry points.
       - Gives a scoped default recommendation and a practical trial procedure.
       - Published provider client and container have independent fixture screenshots and keyboard receipts.
+      - Actual managed human and coding-agent supported-command trials passed on 2026-10-18 under the stated supervised build profile.
     broken_expectations:
-      - Managed admission and persistent platform endpoint are still pending.
+      - Independent per-caller managed admission is still pending; the supervised build connection must be established first.
       - Consumer application acceptance remains the consuming repo's responsibility.
     out_of_scope_expectations:
       - Exhaustive estate dependency inventory or comparative browser benchmark.
@@ -59,7 +50,7 @@ external_evidence:
     known_reliability_risks:
       - Browser binaries and system libraries must match the selected Playwright version.
       - Existing examples contain application-specific fixtures and assumptions.
-      - Local fixture receipts do not prove managed operation or arbitrary target compatibility.
+      - Provider fixture receipts do not prove arbitrary target compatibility or independent per-caller identity.
       - Local provider endpoints are ephemeral; check preflight for each trial.
     evidence:
       satisfied_signals:
@@ -100,7 +91,8 @@ availability:
   target_artifacts:
     - >-
       Managed Railiance deployment after platform admission, with consumer
-      access and live recovery/rollback evidence; not currently available.
+      independent per-caller access and complete recovery/rollback acceptance; the
+      supervised build pilot already has actual human/agent receipts.
   consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container]
 relations:
   depends_on: []
@@ -244,9 +236,13 @@ receipts and the fresh discovery trial use the same digest. The default fixture
 requires no external target grant. The provider supports trusted/synthetic pages,
 not hostile-page or mutually untrusted tenant execution.
 
-### Conditional managed path
+### Supervised managed development path — verified 2026-10-18
 
-Only **after platform admission, deployment and caller access are confirmed**:
+The existing private deployment was used by one actual human and one coding
+agent, each completing 14 keyboard/responsive steps with downloaded screenshots.
+This build profile uses an existing authenticated workstation connection;
+independent per-caller identity, transport and final managed admission remain open.
+Establish that existing connection, then use the same supported provider client:
 
 ```sh
 kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1
@@ -255,8 +251,15 @@ python3 rapp_playwright.py preflight
 python3 rapp_playwright.py trial --out trial-managed-01
 ```
 
-No managed deployment or successful managed invocation is claimed here. A remote
-browser's localhost belongs to the provider. Consumer applications need a
+Both managed trials passed against the deployed release digest already listed
+above. The client is byte-identical to the pinned published commit.
+[Human receipt](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/17635cb0a76e5595ec06421ab7419ae889f6d731/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/receipt.json),
+[agent receipt](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/17635cb0a76e5595ec06421ab7419ae889f6d731/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/receipt.json),
+and [profile/commands](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/17635cb0a76e5595ec06421ab7419ae889f6d731/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md)
+state the exact scope. Use a fresh output directory; keep the run capability
+private. Do not distribute a kubeconfig or treat this receipt as a broader identity
+acceptance. Stop the port-forward with Ctrl-C when finished. A remote browser's
+localhost belongs to the provider. Consumer applications need a
 provider-reachable, explicitly allowed origin; the browser API tunnel does not
 forward a workstation app. See the provider contract before running a target
 scenario.
diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml
index fecdaac..4856d8c 100644
--- a/registry/indexes/capabilities.yaml
+++ b/registry/indexes/capabilities.yaml
@@ -1,19 +1,16 @@
 version: 1
-updated: '2026-10-14'
+updated: '2026-10-18'
 domain: helix_forge
 capabilities:
 - id: capability.infotech.headless-browser
   name: Headless Browser Automation
   summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright
-    0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container;
-    managed Railiance admission is pending. Download the Python 3.10+ standalone client
-    from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
-    and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then
-    `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
-    with a fresh output directory. This endpoint was verified locally on 2026-10-13
-    and is ephemeral; it installs no browser for the caller. If unreachable, follow
-    the local container setup in the capability card or adapt its A2 source examples;
-    this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.'
+    0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Human and coding-agent managed
+    trials passed on 2026-10-18 through the existing supervised workstation connection.
+    Use the documented kubectl port-forward to 127.0.0.1:18081, then the pinned standalone
+    Python client preflight/trial commands. No local browser installation. Independent
+    per-caller managed admission remains pending; availability stays A5. Contract:
+    https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.'
   vector: D3 / A5 / C2 / R2
   domain: infotech
   status: reviewed

From be5c006a44acf463655f53d3858999e9245f7964 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Mon, 19 Oct 2026 13:53:05 +0200
Subject: [PATCH 38/55] registry: federate web-fetcher
 (capability.infotech.provenance-fetch)

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 153021@bnt-lap001
Assistant-Session: 46917be4-6400-4106-b8b7-61953a0caf24
---
 registry/federation/sources.yaml |  5 +++
 registry/indexes/federated.yaml  | 62 +++++++++++++++++++++++---------
 2 files changed, 51 insertions(+), 16 deletions(-)

diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml
index 02a3e22..4a8cd06 100644
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -551,6 +551,11 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: web-fetcher
+  index: ../web-fetcher/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: whitehat-security
   index: ../whitehat-security/registry/indexes/capabilities.yaml
   enabled: true
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index ba83e2f..020ad40 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-10-16'
+updated: '2026-10-19'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -327,6 +327,9 @@ sources:
   count: 1
   url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/vergabe-teilnahme.yaml
+- repo: web-fetcher
+  count: 1
+  index: ../web-fetcher/registry/indexes/capabilities.yaml
 - repo: whitehat-security
   count: 1
   index: ../whitehat-security/registry/indexes/capabilities.yaml
@@ -1183,15 +1186,12 @@ capabilities:
 - id: capability.infotech.headless-browser
   name: Headless Browser Automation
   summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright
-    0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container;
-    managed Railiance admission is pending. Download the Python 3.10+ standalone client
-    from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
-    and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then
-    `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
-    with a fresh output directory. This endpoint was verified locally on 2026-10-13
-    and is ephemeral; it installs no browser for the caller. If unreachable, follow
-    the local container setup in the capability card or adapt its A2 source examples;
-    this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.'
+    0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Human and coding-agent managed
+    trials passed on 2026-10-18 through the existing supervised workstation connection.
+    Use the documented kubectl port-forward to 127.0.0.1:18081, then the pinned standalone
+    Python client preflight/trial commands. No local browser installation. Independent
+    per-caller managed admission remains pending; availability stays A5. Contract:
+    https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.'
   vector: D3 / A5 / C2 / R2
   domain: infotech
   status: reviewed
@@ -1299,6 +1299,39 @@ capabilities:
   source_repo: evidence-source
   source_url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/evidence-source.yaml
+- id: capability.infotech.provenance-fetch
+  name: Provenance-first Web and API Data Fetching
+  summary: Standard-library Python fetcher that turns declarative JSON specs into
+    Observation records carrying value, source, URL, source publication time, retrieval
+    time and payload SHA-256. Adapters for Eurostat JSON-stat, generic JSON, CSV and
+    wide XLSX endpoints; missing data is an explicit not_found, never estimated. Optional
+    content-addressed cache replays a run from the exact bytes it used.
+  domain: infotech
+  status: draft
+  owner: web-fetcher
+  tags:
+  - fetch
+  - http
+  - api
+  - provenance
+  - research
+  - statistics
+  - eurostat
+  - csv
+  - json
+  - xlsx
+  - cache
+  - replay
+  - data-ingestion
+  - stdlib
+  vector: D2 / A2 / C1 / R1
+  path: registry/capabilities/capability.infotech.provenance-fetch.md
+  consumption_modes:
+  - Python library
+  - cli
+  - source
+  source_repo: web-fetcher
+  source_index: ../web-fetcher/registry/indexes/capabilities.yaml
 - id: capability.infotech.repo-template
   name: Coulomb Repository Template
   summary: Bootstrap new git repositories with agent instructions, registry scaffold,
@@ -1467,7 +1500,7 @@ capabilities:
   source_index: registry/federation/cache/vergabe-teilnahme.yaml
 - id: capability.railiance.bootstrap-sequencing
   name: Bootstrap sequencing contracts
-  summary: Bare-VM sequencing with NetKingdom identity backup recovery handoff.
+  summary: Bare-VM to estate sequence and handoff contract.
   domain: infotech
   status: draft
   owner: railiance-bootstrap
@@ -1475,9 +1508,6 @@ capabilities:
   - security
   - netkingdom
   - framework-reuse
-  - backup
-  - restore
-  - disaster-recovery
   vector: D3 / A0 / C1 / R0
   path: registry/capabilities/capability.railiance.bootstrap-sequencing.md
   consumption_modes:
@@ -1965,8 +1995,8 @@ capabilities:
   source_index: ../approval-engine/registry/indexes/capabilities.yaml
 - id: capability.security.bootstrap-recovery
   name: Guarded bootstrap and recovery preparation
-  summary: Encrypted identity backup, independent retrieval and isolated recovery
-    verification with bootstrap handoff.
+  summary: Guarded bootstrap custody, encrypted identity backup capture, independent
+    retrieval and isolated recovery verification.
   domain: infotech
   status: draft
   owner: net-kingdom

From 307fcaf9e5b6ed84089de12266ca5fafd1dac2a9 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Mon, 19 Oct 2026 14:26:35 +0200
Subject: [PATCH 39/55] registry: refresh web-fetcher entry in federated index
 (v0.2.0, D2/A3/C2/R2)

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 153021@bnt-lap001
Assistant-Session: 46917be4-6400-4106-b8b7-61953a0caf24
---
 registry/indexes/federated.yaml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 020ad40..46ee10f 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1304,8 +1304,10 @@ capabilities:
   summary: Standard-library Python fetcher that turns declarative JSON specs into
     Observation records carrying value, source, URL, source publication time, retrieval
     time and payload SHA-256. Adapters for Eurostat JSON-stat, generic JSON, CSV and
-    wide XLSX endpoints; missing data is an explicit not_found, never estimated. Optional
-    content-addressed cache replays a run from the exact bytes it used.
+    wide XLSX endpoints; missing data is an explicit not_found, never estimated, and
+    values without a source are refused. A content-addressed cache stores the exact
+    bytes of a run and replays it offline. Tagged release v0.2.0, pip-installable
+    from Forgejo.
   domain: infotech
   status: draft
   owner: web-fetcher
@@ -1324,7 +1326,7 @@ capabilities:
   - replay
   - data-ingestion
   - stdlib
-  vector: D2 / A2 / C1 / R1
+  vector: D2 / A3 / C2 / R2
   path: registry/capabilities/capability.infotech.provenance-fetch.md
   consumption_modes:
   - Python library

From 1ed296d33b376371422bd0fccf33925754dbb134 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 00:03:22 +0200
Subject: [PATCH 40/55] workplan(REUSE-WP-0025): qualify T03 wait as
 needs_human

T03 waits on owner review, credential/rollout disposition and a platform
image deploy, none of which an agent can resolve. Clears fix-consistency
C-39. Also carries the refreshed custodian brief and work records.

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 803894@bnt-lap001
Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3
---
 .custodian-brief.md                                       | 8 ++++++--
 WORK-RECORDS.md                                           | 6 ++++++
 workplans/REUSE-WP-0025-private-source-reader-boundary.md | 3 ++-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/.custodian-brief.md b/.custodian-brief.md
index ade9bcf..78d1e0d 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,12 +2,16 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-13 18:50 UTC  
+**Last synced:** 2026-10-16 19:10 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
 
-*(none — repo may need first-session setup)*
+### Bind private source reader to consented metadata URLs
+Progress: 2/3 done  |  workplan_id: `23c7bcf5-5f5d-524f-a06e-be5247ae1a98`
+
+**Open tasks:**
+- ! Review, publish and verify deployed consumer  `789bb918`
 
 ---
 ## MCP Orientation (when available)
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index e2a1123..d9307d7 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -9,13 +9,19 @@
 | Kind | ID | Status | Lane | Source |
 | --- | --- | --- | --- | --- |
 | workplan | ADHOC-2026-10-13 | finished | — | workplans/ADHOC-2026-10-13.md |
+| workplan | REUSE-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
 | workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | workplan | REUSE-WP-0024 | finished | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| workplan | REUSE-WP-0025 | blocked | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
 | task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
+| task | REUSE-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
 | task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | task | REUSE-WP-0024-T01 | done | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
 | task | REUSE-WP-0024-T02 | done | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
 | task | REUSE-WP-0024-T03 | done | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
+| task | REUSE-WP-0025-T01 | done | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
+| task | REUSE-WP-0025-T02 | done | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
+| task | REUSE-WP-0025-T03 | wait | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
 | intake | REUSE-IN-0001 | closed | green | intakes/REUSE-IN-0001-headless-browser-runnable-answer.md |
diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
index ff13038..76f0dea 100644
--- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -7,7 +7,7 @@ repo: reuse-surface
 status: blocked
 owner: reuse-surface-owner-preparation-worker
 created: "2026-10-15"
-updated: "2026-10-15"
+updated: "2026-10-21"
 flavor: implementation
 depends_on: [CUST-WP-0081]
 state_hub_workstream_id: "23c7bcf5-5f5d-524f-a06e-be5247ae1a98"
@@ -58,6 +58,7 @@ not live authenticated fetch receipts.
 id: REUSE-WP-0025-T03
 status: wait
 priority: high
+needs_human: true
 state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
 ```
 

From 2d0e712baefdb51a19e36e20930bd6601283aa8c Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 00:12:08 +0200
Subject: [PATCH 41/55] registry: federate gated-executor
 (capability.security.exact-approval-execution)

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 605711@bnt-lap001
Assistant-Session: 1f5e2256-181f-49ed-b7b1-a1c34bf37a61
---
 registry/federation/sources.yaml |  5 +++++
 registry/indexes/federated.yaml  | 26 +++++++++++++++++++++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml
index 4a8cd06..1476bf4 100644
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -145,6 +145,11 @@ sources:
   enabled: true
   required: true
   domain: infotech
+- repo: gated-executor
+  index: ../gated-executor/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: glas-harness
   index: ../glas-harness/registry/indexes/capabilities.yaml
   enabled: true
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 46ee10f..f6222ee 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-10-19'
+updated: '2026-10-21'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -88,6 +88,9 @@ sources:
 - repo: gate-house
   count: 1
   index: ../gate-house/registry/indexes/capabilities.yaml
+- repo: gated-executor
+  count: 1
+  index: ../gated-executor/registry/indexes/capabilities.yaml
 - repo: glas-harness
   count: 1
   index: ../glas-harness/registry/indexes/capabilities.yaml
@@ -2106,6 +2109,27 @@ capabilities:
   - source
   source_repo: net-kingdom
   source_index: ../net-kingdom/registry/indexes/capabilities.yaml
+- id: capability.security.exact-approval-execution
+  name: Exact-approval privileged execution
+  summary: gexec runs a privileged action only under a supervisor signature bound
+    to its digest, agent, target, single-use nonce and expiry; receipts for every
+    outcome.
+  domain: infotech
+  status: draft
+  owner: gated-executor
+  tags:
+  - security
+  - approval
+  - executor
+  - supervised-agents
+  - receipts
+  - ssh-signature
+  vector: D4 / A3 / C3 / R2
+  path: registry/capabilities/capability.security.exact-approval-execution.md
+  consumption_modes:
+  - CLI
+  source_repo: gated-executor
+  source_index: ../gated-executor/registry/indexes/capabilities.yaml
 - id: capability.security.forge-secret-prevention
   name: Independent introduced-history secret prevention
   summary: Pinned receive adapter, lifecycle template and fail-closed scan.

From 3670a7f48fcec5eaae991c0a6152694c6dc0d531 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 00:25:50 +0200
Subject: [PATCH 42/55] workplan(REUSE-WP-0025): route T03 human gate to hub
 decision 81c8535a

Clears fix-consistency C-39 (needs_human without decision_id).

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 803894@bnt-lap001
Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3
---
 workplans/REUSE-WP-0025-private-source-reader-boundary.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
index 76f0dea..671f53d 100644
--- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -60,6 +60,7 @@ status: wait
 priority: high
 needs_human: true
 state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
+decision_id: "81c8535a-e0c3-4cb6-9412-bf5ce7696b3d"
 ```
 
 Owner review and exact credential/rollout disposition remain pending. Platform/apps

From be7e11ff1bc252cc2e7b65b9ca9b77a443076693 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 00:27:05 +0200
Subject: [PATCH 43/55] workplan(REUSE-WP-0025): add T03 intervention_note for
 hub sync

The hub requires intervention_note whenever needs_human is set; without
it the C-41 wait-qualifier sync was rejected with 422.

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 803894@bnt-lap001
Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3
---
 workplans/REUSE-WP-0025-private-source-reader-boundary.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
index 671f53d..d84b29d 100644
--- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -59,6 +59,7 @@ id: REUSE-WP-0025-T03
 status: wait
 priority: high
 needs_human: true
+intervention_note: "Owner approval of reader fix, credential binding and rollout (decision 81c8535a)"
 state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
 decision_id: "81c8535a-e0c3-4cb6-9412-bf5ce7696b3d"
 ```

From 609dacb2eebec9208a4d36ecd5fea977b79cde99 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 00:54:37 +0200
Subject: [PATCH 44/55] workplan(REUSE-WP-0025): record approval of T03 reader
 fix, credential 2A and rollout

Decision 81c8535a resolved: native boundary fix, dedicated read-only
Forgejo machine user with read:repository PAT via OpenBao/ESO, and the
platform/apps rollout. T03 stays waiting on execution.

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 803894@bnt-lap001
Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3
---
 .../REUSE-WP-0025-private-source-reader-boundary.md | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
index d84b29d..1a19065 100644
--- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -59,7 +59,8 @@ id: REUSE-WP-0025-T03
 status: wait
 priority: high
 needs_human: true
-intervention_note: "Owner approval of reader fix, credential binding and rollout (decision 81c8535a)"
+intervention_note: "Approved (81c8535a): create reuse-surface-reader Forgejo bot + read:repository PAT into OpenBao/ESO; platform/apps rollout"
+blocking_reason: "Execution of approved credential provisioning and platform/apps image rollout"
 state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
 decision_id: "81c8535a-e0c3-4cb6-9412-bf5ce7696b3d"
 ```
@@ -71,3 +72,13 @@ the fix plus the exact reader allowlist. Then run helper inside the hub environm
 with the owner-provided packets, verify all seven sources fresh, and hand a
 sanitized receipt to the custodian for registration and final 70-capability audit.
 No new PAT is delivered to the current baseline consumer.
+
+2026-10-21: decision 81c8535a resolved by Bernd — approved (1) the native
+boundary fix, (2A) a dedicated Forgejo machine user (e.g. `reuse-surface-reader`)
+with read access to exactly the seven consented repos and a `read:repository`
+PAT on its own OpenBao KV path, delivered via ESO as
+`REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` and allowlisted to the 14 commit-pinned
+URLs, and (3) the platform/apps rollout as described above. Remaining: create the
+bot user and token (human/operator — agents do not handle the secret value), roll
+out, run the helper, hand over the receipt. Follow-up: define how allowlist pins
+are refreshed and re-approved when the source repos update their metadata.

From 39583d0b85a757563cb7a007a0453758f7e19964 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 00:58:33 +0200
Subject: [PATCH 45/55] workplan(REUSE-WP-0025): T03 waits on railiance-apps
 rollout reply

Decision 81c8535a is resolved; the remaining gate is the requested
platform rollout (hub message f8f142bc). Clears C-40. Carries the
refreshed custodian brief.

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 803894@bnt-lap001
Assistant-Session: 61bf70c2-4ce2-400b-9d01-466bbd041ef3
---
 .custodian-brief.md                                       | 3 ++-
 workplans/REUSE-WP-0025-private-source-reader-boundary.md | 8 ++++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.custodian-brief.md b/.custodian-brief.md
index 78d1e0d..de13ba0 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-16 19:10 UTC  
+**Last synced:** 2026-10-20 22:55 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,6 +12,7 @@ Progress: 2/3 done  |  workplan_id: `23c7bcf5-5f5d-524f-a06e-be5247ae1a98`
 
 **Open tasks:**
 - ! Review, publish and verify deployed consumer  `789bb918`
+  *(wait: Execution of approved credential provisioning and platform/apps image rollout)*
 
 ---
 ## MCP Orientation (when available)
diff --git a/workplans/REUSE-WP-0025-private-source-reader-boundary.md b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
index 1a19065..97d2e66 100644
--- a/workplans/REUSE-WP-0025-private-source-reader-boundary.md
+++ b/workplans/REUSE-WP-0025-private-source-reader-boundary.md
@@ -58,11 +58,9 @@ not live authenticated fetch receipts.
 id: REUSE-WP-0025-T03
 status: wait
 priority: high
-needs_human: true
-intervention_note: "Approved (81c8535a): create reuse-surface-reader Forgejo bot + read:repository PAT into OpenBao/ESO; platform/apps rollout"
-blocking_reason: "Execution of approved credential provisioning and platform/apps image rollout"
+blocked_on: message-from:railiance-apps
+blocking_reason: "Approved rollout requested from railiance-apps (msg f8f142bc); prerequisite: operator creates reuse-surface-reader bot + PAT in OpenBao"
 state_hub_task_id: "789bb918-4848-5bdf-bfd4-8ee42877addb"
-decision_id: "81c8535a-e0c3-4cb6-9412-bf5ce7696b3d"
 ```
 
 Owner review and exact credential/rollout disposition remain pending. Platform/apps
@@ -82,3 +80,5 @@ URLs, and (3) the platform/apps rollout as described above. Remaining: create th
 bot user and token (human/operator — agents do not handle the secret value), roll
 out, run the helper, hand over the receipt. Follow-up: define how allowlist pins
 are refreshed and re-approved when the source repos update their metadata.
+Rollout requested from railiance-apps via hub message f8f142bc; T03 now waits
+on that reply (image digest, Helm revision, sanitized helper receipt).

From b7b66e7d636377b83b7e12e71f0f631735d0b965 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 08:47:36 +0200
Subject: [PATCH 46/55] REUSE-WP-0026: wave-2 resource right-sizing receiving
 workplan

Receiving workplan for the 2026-10-21 node allocation review
(RESOURCE-WP-0008-T03 / CUST-WP-0071-T03). Wave-2 apply is human-gated;
no manifest changes.

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
---
 ...USE-WP-0026-wave2-resource-right-sizing.md | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 workplans/REUSE-WP-0026-wave2-resource-right-sizing.md

diff --git a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
new file mode 100644
index 0000000..ac95e2d
--- /dev/null
+++ b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
@@ -0,0 +1,53 @@
+---
+id: REUSE-WP-0026
+type: workplan
+title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review"
+domain: infotech
+repo: reuse-surface
+status: ready
+flavor: implementation
+owner: claude
+created: "2026-10-21"
+updated: "2026-10-21"
+related:
+  - CUST-WP-0071
+  - RESOURCE-WP-0008
+---
+
+# REUSE-WP-0026 — Wave-2 resource right-sizing from the 2026-10-21 allocation review
+
+Receiving workplan in `reuse-surface` for the wave-2 request changes below.
+
+Origin: the 2026-10-21 node allocation review (`RESOURCE-WP-0008-T03`, feeding `CUST-WP-0071-T03`). Per the founder's 2026-10-21 delivery interview (`the-custodian/docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md`) the small adjustments form wave 2: one receiving task per owner repo, applied later in a batch. Applying wave 2 needs a separate founder approval, so every cluster-write task here is a human-gated `wait`. This file changes no manifest.
+
+## Apply the reviewed request changes
+
+```task
+id: REUSE-WP-0026-T01
+status: wait
+priority: medium
+needs_human: true
+blocking_reason: "Wave-2 cluster write; founder approval for wave 2 not yet given (2026-10-21 interview)"
+```
+
+Values are pod-aggregate figures from the budget file (7-day window ending 2026-10-21T06:08Z). Limits stay unchanged unless stated.
+
+| Workload (ns/name) | Pods | CPU request | CPU limit | CPU p95/peak 7d (m) | Memory request | Memory limit | Mem p95/peak (Mi) | Throttle | Action |
+|---|---:|---:|---:|---:|---:|---:|---:|---:|---|
+| `reuse/reuse-surface` | 2 | 110m → **10m** | 550m | 2.1/10.2 | 288Mi → **80Mi** | 576Mi | 56.2/57.0 | 0.0 | decrease + memory down |
+
+Source and container detail:
+
+- `reuse/reuse-surface`: two pods from `railiance-apps/charts/reuse-surface/values.yaml`: main `resources` (100m/256Mi) and the second component's `resources` (10m/32Mi) — the chart lives in railiance-apps. Split the 10m/80Mi total as 5m/48Mi main and 5m/32Mi second, or by per-pod p95.
+
+Evidence: resource-control `docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.md` (+ `.json`, commit `3d9b1bd`). Rule: CPU = max(floor, p95x1.5, peakx0.5) rounded up to 5m; memory request = 7d p95 working set x1.15 (only when the change is at least 64Mi).
+
+Steps:
+
+1. Map the pod-aggregate proposal onto the named container(s) in the source file; where a workload has several containers or pods, split by the per-pod figures in `2026-10-21-workload-usage.json` and keep the sum at the proposed value.
+2. Prepare the source change as a reviewed commit (no push, no sync) and record the before values here.
+3. Apply only inside the batched wave-2 rollout, after founder approval, through the owner's normal deploy path (ArgoCD sync or documented helm/kubectl apply).
+
+Verification: `kubectl -n  get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.
+
+Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.

From 6dce7fbc55e7f7b781a82c4d72be6b9717107802 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 09:12:07 +0200
Subject: [PATCH 47/55] chore: refresh federated capability index and generated
 brief

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
---
 .custodian-brief.md             | 4 ++--
 registry/indexes/federated.yaml | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/.custodian-brief.md b/.custodian-brief.md
index de13ba0..bc47c1f 100644
--- a/.custodian-brief.md
+++ b/.custodian-brief.md
@@ -2,7 +2,7 @@
 # Custodian Brief — reuse-surface
 
 **Domain:** infotech  
-**Last synced:** 2026-10-20 22:55 UTC  
+**Last synced:** 2026-10-20 22:59 UTC  
 **State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
 
 ## Active Workstreams
@@ -12,7 +12,7 @@ Progress: 2/3 done  |  workplan_id: `23c7bcf5-5f5d-524f-a06e-be5247ae1a98`
 
 **Open tasks:**
 - ! Review, publish and verify deployed consumer  `789bb918`
-  *(wait: Execution of approved credential provisioning and platform/apps image rollout)*
+  *(wait: Approved rollout requested from railiance-apps (msg f8f142bc); prerequisite: operator creates reuse-surface-reader bot + PAT in OpenBao)*
 
 ---
 ## MCP Orientation (when available)
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index f6222ee..fa5d890 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -2060,8 +2060,10 @@ capabilities:
   source_index: ../ops-warden/registry/indexes/capabilities.yaml
 - id: capability.security.credential-lifecycle
   name: Cataloged credential lifecycle
-  summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification,
-    delivery and revoke.
+  summary: Decision-gated CLI for cataloged OpenBao lanes covering catalog, plan,
+    exact metadata apply, provisioning, verification, exec delivery (exec-env/npm-config/exec-file),
+    wrapped handoff, rotate, revoke and lifecycle, with founder-signed trust admission
+    and a local evidence outbox.
   domain: infotech
   status: draft
   owner: secrets-engine

From b548e8eb3f21346590b92c61254ffca2a4d1c4aa Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 12:30:18 +0200
Subject: [PATCH 48/55] chore(consistency): write back State Hub ids

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
---
 WORK-RECORDS.md                                        | 2 ++
 workplans/REUSE-WP-0026-wave2-resource-right-sizing.md | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index d9307d7..b5eb2a3 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -13,6 +13,7 @@
 | workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | workplan | REUSE-WP-0024 | finished | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
 | workplan | REUSE-WP-0025 | blocked | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
+| workplan | REUSE-WP-0026 | ready | — | workplans/REUSE-WP-0026-wave2-resource-right-sizing.md |
 | task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | REUSE-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
@@ -24,4 +25,5 @@
 | task | REUSE-WP-0025-T01 | done | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
 | task | REUSE-WP-0025-T02 | done | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
 | task | REUSE-WP-0025-T03 | wait | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
+| task | REUSE-WP-0026-T01 | wait | — | workplans/REUSE-WP-0026-wave2-resource-right-sizing.md |
 | intake | REUSE-IN-0001 | closed | green | intakes/REUSE-IN-0001-headless-browser-runnable-answer.md |
diff --git a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
index ac95e2d..f553ec5 100644
--- a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
+++ b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
@@ -12,6 +12,7 @@ updated: "2026-10-21"
 related:
   - CUST-WP-0071
   - RESOURCE-WP-0008
+state_hub_workstream_id: "d0b06425-2d20-5816-bd09-9e9bec846236"
 ---
 
 # REUSE-WP-0026 — Wave-2 resource right-sizing from the 2026-10-21 allocation review
@@ -28,6 +29,7 @@ status: wait
 priority: medium
 needs_human: true
 blocking_reason: "Wave-2 cluster write; founder approval for wave 2 not yet given (2026-10-21 interview)"
+state_hub_task_id: "2fd47858-94d8-5a57-96f9-35b25d54bb1d"
 ```
 
 Values are pod-aggregate figures from the budget file (7-day window ending 2026-10-21T06:08Z). Limits stay unchanged unless stated.

From da02173a81c08d15dc113e4dc55d2e41c484340e Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 12:31:38 +0200
Subject: [PATCH 49/55] chore: keep generated orientation brief local

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 8340@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
---
 .custodian-brief.md | 23 -----------------------
 .gitignore          |  3 +++
 SCOPE.md            |  7 ++++++-
 3 files changed, 9 insertions(+), 24 deletions(-)
 delete mode 100644 .custodian-brief.md

diff --git a/.custodian-brief.md b/.custodian-brief.md
deleted file mode 100644
index bc47c1f..0000000
--- a/.custodian-brief.md
+++ /dev/null
@@ -1,23 +0,0 @@
-
-# Custodian Brief — reuse-surface
-
-**Domain:** infotech  
-**Last synced:** 2026-10-20 22:59 UTC  
-**State Hub:** http://127.0.0.1:8000 *(adjust if running on a remote machine)*
-
-## Active Workstreams
-
-### Bind private source reader to consented metadata URLs
-Progress: 2/3 done  |  workplan_id: `23c7bcf5-5f5d-524f-a06e-be5247ae1a98`
-
-**Open tasks:**
-- ! Review, publish and verify deployed consumer  `789bb918`
-  *(wait: Approved rollout requested from railiance-apps (msg f8f142bc); prerequisite: operator creates reuse-surface-reader bot + PAT in OpenBao)*
-
----
-## MCP Orientation (when available)
-
-If the state-hub MCP server is reachable, call:
-`get_domain_summary("infotech")`
-This provides richer cross-domain context.
-If the MCP call fails, use this file as your orientation source.
diff --git a/.gitignore b/.gitignore
index 65b4862..c701604 100644
--- a/.gitignore
+++ b/.gitignore
@@ -182,3 +182,6 @@ cython_debug/
 # PyPI configuration file
 .pypirc
 
+
+# Local State Hub orientation snapshot; authored work records remain tracked.
+/.custodian-brief.md
diff --git a/SCOPE.md b/SCOPE.md
index f7b6f73..40cb4f4 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -313,4 +313,9 @@ reuse-surface/
 - Graph explorer: docs/graph/index.html
 - CLI reference: tools/README.md
 - Agent instructions: AGENTS.md
-- Workplans: workplans/
\ No newline at end of file
+- Workplans: workplans/
+## Local orientation brief policy — 2026-10-21
+
+`.custodian-brief.md` is a local, ignored State Hub orientation snapshot. Refreshing
+it does not require a Git commit. Authored workplans and the generated
+WORK-RECORDS index keep their existing source and staged-generation contracts.

From 7df9f2d3ab3952353d0fa11cf02e32a457538cd0 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 21 Oct 2026 23:37:31 +0200
Subject: [PATCH 50/55] Federate the release-registry capability index.

capability.infotech.release-coverage is composed from the local checkout
into the federated index.

Assistant: grok
Assistant-Session: 01a15f9f-3d77-7d21-911b-d93c86f9d14f
---
 registry/federation/sources.yaml |  5 +++++
 registry/indexes/federated.yaml  | 23 +++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/registry/federation/sources.yaml b/registry/federation/sources.yaml
index 1476bf4..c0fab94 100644
--- a/registry/federation/sources.yaml
+++ b/registry/federation/sources.yaml
@@ -463,6 +463,11 @@ sources:
   domain: helix_forge
   cache_ttl_seconds: 86400
   auth_header: Authorization
+- repo: release-registry
+  index: ../release-registry/registry/indexes/capabilities.yaml
+  enabled: true
+  required: true
+  domain: infotech
 - repo: resource-control
   index: ../resource-control/registry/indexes/capabilities.yaml
   enabled: true
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index fa5d890..a35e963 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -275,6 +275,9 @@ sources:
   count: 1
   url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
   cache: registry/federation/cache/repo-seed.yaml
+- repo: release-registry
+  count: 1
+  index: ../release-registry/registry/indexes/capabilities.yaml
 - repo: resource-control
   count: 1
   index: ../resource-control/registry/indexes/capabilities.yaml
@@ -1337,6 +1340,26 @@ capabilities:
   - source
   source_repo: web-fetcher
   source_index: ../web-fetcher/registry/indexes/capabilities.yaml
+- id: capability.infotech.release-coverage
+  name: Release-unit coverage and pin check
+  summary: Compose owner release-unit declarations and check live workloads for coverage
+    and pin drift.
+  domain: infotech
+  status: draft
+  owner: release-registry
+  tags:
+  - release
+  - coverage
+  - kubernetes
+  - governance
+  - operations
+  vector: D3 / A2 / C2 / R0
+  path: registry/capabilities/capability.infotech.release-coverage.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: release-registry
+  source_index: ../release-registry/registry/indexes/capabilities.yaml
 - id: capability.infotech.repo-template
   name: Coulomb Repository Template
   summary: Bootstrap new git repositories with agent instructions, registry scaffold,

From b2c216386b9f5770f39cc31df55311b03fa082bf Mon Sep 17 00:00:00 2001
From: custodian-sync 
Date: Wed, 21 Oct 2026 23:38:04 +0200
Subject: [PATCH 51/55] chore(consistency): renormalize lifecycle state [auto]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Updated by fix-consistency on 2026-10-21:
  - workplan status: ready → active

Assistant: grok
Assistant-Session: 01a15f9f-3d77-7d21-911b-d93c86f9d14f
---
 workplans/REUSE-WP-0026-wave2-resource-right-sizing.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
index f553ec5..34aaa41 100644
--- a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
+++ b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review"
 domain: infotech
 repo: reuse-surface
-status: ready
+status: active
 flavor: implementation
 owner: claude
 created: "2026-10-21"

From 94b6ed50c37f0616907b85499e4cd81490441ab4 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Thu, 22 Oct 2026 00:06:56 +0200
Subject: [PATCH 52/55] REUSE-WP-0026-T01: record wave-2 preparation (not
 applied)

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
---
 workplans/REUSE-WP-0026-wave2-resource-right-sizing.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
index 34aaa41..c9052d3 100644
--- a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
+++ b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
@@ -42,6 +42,8 @@ Source and container detail:
 
 - `reuse/reuse-surface`: two pods from `railiance-apps/charts/reuse-surface/values.yaml`: main `resources` (100m/256Mi) and the second component's `resources` (10m/32Mi) — the chart lives in railiance-apps. Split the 10m/80Mi total as 5m/48Mi main and 5m/32Mi second, or by per-pod p95.
 
+**Prepared 2026-10-21 (wave-2 worker W1a; not applied).** Live owner is Helm release `reuse` (rev 11) from railiance-apps. Change: railiance-apps `b7fb7b2`, `helm/reuse-surface-values.yaml`. Split by per-pod p95: main 100m/256Mi → 5m/64Mi (p95 about 51Mi, so 48Mi would have sat below the working set); landing 10m/32Mi → 5m/16Mi. Total 10m/80Mi, limits unchanged. The full render against live shows only `resources.requests` on both Deployments. Apply: `cd railiance-apps && make reuse-deploy`. RollingUpdate.
+
 Evidence: resource-control `docs/evidence/2026-10-21-node-allocation-review/2026-10-21-node-budget.md` (+ `.json`, commit `3d9b1bd`). Rule: CPU = max(floor, p95x1.5, peakx0.5) rounded up to 5m; memory request = 7d p95 working set x1.15 (only when the change is at least 64Mi).
 
 Steps:

From bf30d5e988dd38921eb43902b27cca24f4e760ef Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Thu, 22 Oct 2026 00:50:27 +0200
Subject: [PATCH 53/55] Wave-2 right-sizing applied 2026-10-22 (CUST-WP-0071)

Co-Authored-By: Claude Opus 5.5 

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 276069@bnt-lap001
Assistant-Session: 2e192b3d-b3e8-4403-94d4-d55a2c8b476c
---
 workplans/REUSE-WP-0026-wave2-resource-right-sizing.md | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
index c9052d3..8258279 100644
--- a/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
+++ b/workplans/REUSE-WP-0026-wave2-resource-right-sizing.md
@@ -4,7 +4,7 @@ type: workplan
 title: "Wave-2 resource right-sizing from the 2026-10-21 allocation review"
 domain: infotech
 repo: reuse-surface
-status: active
+status: finished
 flavor: implementation
 owner: claude
 created: "2026-10-21"
@@ -25,10 +25,8 @@ Origin: the 2026-10-21 node allocation review (`RESOURCE-WP-0008-T03`, feeding `
 
 ```task
 id: REUSE-WP-0026-T01
-status: wait
+status: done
 priority: medium
-needs_human: true
-blocking_reason: "Wave-2 cluster write; founder approval for wave 2 not yet given (2026-10-21 interview)"
 state_hub_task_id: "2fd47858-94d8-5a57-96f9-35b25d54bb1d"
 ```
 
@@ -55,3 +53,7 @@ Steps:
 Verification: `kubectl -n  get pod -o jsonpath='{..resources}'` shows the new requests; pods Ready with no new restarts or OOMKilled over 24h; for CPU decreases the throttle ratio and request latency stay at or below the 7d baseline; node request total drops by the expected delta.
 
 Rollback: revert the source commit and re-sync/re-apply; the before values in the table above are the rollback target. Keep before/after `kubectl get -o yaml` captures as the receipt.
+
+## Applied — 2026-10-22 (REUSE-WP-0026-T01)
+
+Applied under the founder's wave-2 authorization (the-custodian docs/decisions/2026-10-21-cust-wp-0071-delivery-interview.md), after a full-render diff against live that showed resources only. railiance-apps `make reuse-deploy`, Helm revision 12; main and landing are Ready. Evidence: the-custodian docs/evidence/2026-10-22-wave2-apply.md.

From cb1940f2bec60722372afc00a764f5b5d111d62d Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Fri, 23 Oct 2026 15:50:04 +0200
Subject: [PATCH 54/55] Declare the live release units for this owner.

The claims name the workloads covered by RELREG-WP-0004. Each pin is a digest the live object already shows.

Assistant: grok
Assistant-Session: 01a16880-25e0-7031-b553-a1e0321ff397
---
 registry/release-units/reuse-surface.yaml | 50 +++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 registry/release-units/reuse-surface.yaml

diff --git a/registry/release-units/reuse-surface.yaml b/registry/release-units/reuse-surface.yaml
new file mode 100644
index 0000000..4888cf4
--- /dev/null
+++ b/registry/release-units/reuse-surface.yaml
@@ -0,0 +1,50 @@
+# No owner classification file. Recorded internal/medium for this wave.
+kind: release-unit
+unit_id: reuse-surface
+owner: reuse-surface
+contract_version: 1.0.0
+data_classification: internal
+criticality: medium
+composition:
+  purpose: Covers the live reuse-surface workloads as one release unit.
+  member_repos:
+  - repo: reuse-surface
+    role: rollout owner
+    deployables:
+    - reuse-surface
+    - reuse-surface-landing
+rollout_contract:
+  default_mode: helm-upgrade-install
+smoke_contract:
+  required:
+  - workload-ready
+rollback_contract:
+  order:
+  - owner-rollback
+workloads:
+- kind: Deployment
+  namespace: reuse
+  name: reuse-surface
+- kind: Deployment
+  namespace: reuse
+  name: reuse-surface-landing
+pins:
+  component:
+    name: ocm.railiance.dev/reuse-surface
+    version: live
+  resources:
+  - name: reuse-surface
+    type: ociImage
+    version: live
+    digest:
+      hashAlgorithm: SHA-256
+      normalisationAlgorithm: ociArtifactDigest/v1
+      value: sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0
+  sources:
+  - name: reuse-surface
+    type: git
+    version: live
+    digest:
+      hashAlgorithm: SHA-1
+      normalisationAlgorithm: gitCommit/v1
+      value: bf30d5e988dd38921eb43902b27cca24f4e760ef

From c4c40b466faa339e2e04bd71b3cc2241f1163d82 Mon Sep 17 00:00:00 2001
From: tegwick 
Date: Wed, 28 Oct 2026 00:11:37 +0100
Subject: [PATCH 55/55] Adopt staged WORK-RECORDS generation and catch the
 index up.

REUSE-WP-0026 finished in bf30d5e without the generated index. The opt-in
lets the pre-commit hook rebuild WORK-RECORDS.md in the same commit as
the workplan it indexes.

Assistant: grok
Assistant-Session: 01a17f9d-fe9d-7d72-9a22-6304f1a2a790
---
 .generated-work-records.json |  1 +
 .generated-work-records.mk   |  8 ++++++++
 SCOPE.md                     | 13 +++++++++++++
 WORK-RECORDS.md              |  4 ++--
 4 files changed, 24 insertions(+), 2 deletions(-)
 create mode 100644 .generated-work-records.json
 create mode 100644 .generated-work-records.mk

diff --git a/.generated-work-records.json b/.generated-work-records.json
new file mode 100644
index 0000000..4946f68
--- /dev/null
+++ b/.generated-work-records.json
@@ -0,0 +1 @@
+{"version":1,"repo_slug":"reuse-surface"}
diff --git a/.generated-work-records.mk b/.generated-work-records.mk
new file mode 100644
index 0000000..8996bf4
--- /dev/null
+++ b/.generated-work-records.mk
@@ -0,0 +1,8 @@
+# Explicit opt-in recipe; no environment files or external make includes.
+CUSTODIAN_SOURCE ?= /home/worsch/the-custodian
+GENERATED_REPO_SLUG ?= reuse-surface
+.PHONY: generated-work-records generated-work-records-check
+generated-work-records:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)"
+generated-work-records-check:
+	python3 "$(CUSTODIAN_SOURCE)/scripts/generate_staged_work_records.py" --repo . --repo-slug "$(GENERATED_REPO_SLUG)" --check
diff --git a/SCOPE.md b/SCOPE.md
index 40cb4f4..6c50b4b 100644
--- a/SCOPE.md
+++ b/SCOPE.md
@@ -314,6 +314,19 @@ reuse-surface/
 - CLI reference: tools/README.md
 - Agent instructions: AGENTS.md
 - Workplans: workplans/
+
+## Generated work-record index
+
+This repository opts into staged-source WORK-RECORDS.md generation through
+`.generated-work-records.json` and the isolated `.generated-work-records.mk`
+recipe. `make generated-work-records` reuses the State Hub renderer through
+the Custodian adapter; `make generated-work-records-check` verifies byte-exact
+agreement with staged Markdown. The pre-commit hook uses the isolated recipe,
+preserves unstaged index edits by refusing them, and retains the generated-only
+commit guard. It does not contact the hub, alter workplan statuses, or grant
+deployment authority. This consumes shared tooling; it does not make this
+repository the provider of the generator capability.
+
 ## Local orientation brief policy — 2026-10-21
 
 `.custodian-brief.md` is a local, ignored State Hub orientation snapshot. Refreshing
diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md
index b5eb2a3..523619f 100644
--- a/WORK-RECORDS.md
+++ b/WORK-RECORDS.md
@@ -13,7 +13,7 @@
 | workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
 | workplan | REUSE-WP-0024 | finished | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
 | workplan | REUSE-WP-0025 | blocked | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
-| workplan | REUSE-WP-0026 | ready | — | workplans/REUSE-WP-0026-wave2-resource-right-sizing.md |
+| workplan | REUSE-WP-0026 | finished | — | workplans/REUSE-WP-0026-wave2-resource-right-sizing.md |
 | task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
 | task | REUSE-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
@@ -25,5 +25,5 @@
 | task | REUSE-WP-0025-T01 | done | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
 | task | REUSE-WP-0025-T02 | done | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
 | task | REUSE-WP-0025-T03 | wait | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
-| task | REUSE-WP-0026-T01 | wait | — | workplans/REUSE-WP-0026-wave2-resource-right-sizing.md |
+| task | REUSE-WP-0026-T01 | done | — | workplans/REUSE-WP-0026-wave2-resource-right-sizing.md |
 | intake | REUSE-IN-0001 | closed | green | intakes/REUSE-IN-0001-headless-browser-runnable-answer.md |