reuse-surface/docs/NetKingdomSecurityDiscovery.md

NetKingdom security capability discovery

The workstation federation includes 70 reviewed security and supporting capabilities from 60 sibling repositories. Two additional inspected repositories are nonproviders: rapp-secrets-engine is retired and rapp-forgejo is a placeholder without a package declaration. The owner capability entries are the reusable source; the architecture assessment is in the-custodian CUST-WP-0081.

Local discovery

From a reuse-surface checkout beside those repositories:

reuse-surface federation compose
reuse-surface plan-check --intent "bound approval consumption before credential delivery" --no-llm
reuse-surface plan-check --intent "deterministic posture feedback evidence expiry" --no-llm

The source manifest uses relative sibling paths for the reviewed cohort and requires their indexes to exist. Other federation sources are preserved. A missing sibling is a composition error rather than silent loss of a reviewed capability. The composed local index supports planning; it is not a runtime readiness or authorization grant. reuse-surface query searches this repository's own index, while plan-check uses the composed federation.

Hosted discovery

reuse-surface plan-check --hub-url https://reuse.coulomb.social --intent "bound approval consumption" --no-llm

As checked on 2026-10-14, all 60 source registry commits are published, while the hosted hub contains 32 of the 70 reviewed capabilities. Thirty-eight new owner registrations remain pending scoped write access: the normal Warden lane was allowed by the PDP but OpenBao refused the current caller with HTTP 403. Seven of those indexes also require admitted private-source read access; anonymous retrieval returns 404. Do not change repository visibility or reuse another workload's credential to make discovery pass.

The seven private sources are rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-telemetry, rapp-tenant-engine, rapp-user-engine and rapp-sbom-nexus. Hosted registration supports an auth_env reference to a credential already configured at the hub. Source-owner approval, scoped read provisioning and a successful native fetch must precede their registration. Thirty-one public-source registrations are otherwise ready.

The exact registration plan, source commits, raw retrieval results and local/hosted verification receipts are retained in the-custodian at docs/assessments/netkingdom-2026-10-14/. Existing IDs were preserved where valid; the copied Secrets Engine repository-template entry was removed. Registry C/R values retained from older entries remain owner assessments, not renewed evidence.