docs(reuse): establish reviewed NetKingdom security capabilities

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a137ca-5c77-7a71-b9ae-23ad9b0b5684

registry/capabilities/capability.infotech.runbook-tutorials.md

@@ -1,18 +1,100 @@
 ---
 id: capability.infotech.runbook-tutorials
-name: Runbook-tutorial engine
-summary: Engine, local UI and CLI for guided, parameterized operator runbooks: pack specification and validators, runs with evidence and locked records, maturity, attribute sets, projects and whole-project runs. Packs live in the repos that own the procedure.
 owner: runbook-tutorials
-status: active
+status: draft
 domain: infotech
+maturity:
+  discovery:
+    current: D3
+    target: D5
+    confidence: medium
+    rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
+      are documented; no exhaustive or generalized maturity claim.
+  availability:
+    current: A2
+    target: A2
+    confidence: medium
+    rationale: 'Source interface assessed 2026-10-14: Pack schema, loader, local UI/CLI,
+      gates, verification and rollback evidence. Availability describes the delivery
+      form, not production acceptance. Owner supplies procedures; UI progress is not
+      runtime approval.'
+external_evidence:
+  completeness:
+    level: C1
+    confidence: low
+    basis: Source artifacts establish a bounded capability; no independent consumer-completeness
+      assessment in this review.
+  reliability:
+    level: R0
+    confidence: low
+    basis: No longitudinal consumer reliability measurement established by this review.
+name: Guided administrative runbooks
+summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.
 tags:
-  - runbook
-  - tutorial
-  - operator
-  - guided
+- security
+- netkingdom
+- framework-reuse
+discovery:
+  intent: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence
+  includes:
+  - Pack schema, loader, local UI/CLI, gates, verification and rollback evidence
+  excludes:
+  - Owner supplies procedures; UI progress is not runtime approval
+  use_cases:
+  - 'U05: Operator provisions and delivers a scoped workload credential through the
+    approved owner lane'
+  - 'U10: Operator recovers identity, custody or data with independently held recovery
+    material'
+  - 'U14: Framework adopter validates and reuses selected contracts, tools and reference
+    compositions'
+availability:
+  current_level: A2
+  target_level: A2
+  current_artifacts:
+  - SCOPE.md
+  - docs/pack-spec.md
+  consumption_modes:
+  - CLI
+  - source
+relations:
+  related_to:
+  - capability.security.iam-tooling-suite
+evidence:
+  documentation:
+  - SCOPE.md
+  - docs/pack-spec.md
+consumer_guidance:
+  recommended_for:
+  - Operator provisions and delivers a scoped workload credential through the approved
+    owner lane
+  - Operator recovers identity, custody or data with independently held recovery material
+  - Framework adopter validates and reuses selected contracts, tools and reference
+    compositions
+  not_recommended_for:
+  - Owner supplies procedures; UI progress is not runtime approval
+  known_limitations:
+  - Owner supplies procedures; UI progress is not runtime approval
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
 ---
 
-Working: specifications `runbook-pack/v0.1` and `v0.2` with validators, the engine and local UI, projects and project templates, and the `rtut`
-CLI (see `SCOPE.md`). Not built by decision: execution of steps, a cross-repository pack index, a feedback assistant (`workplans/RBT-WP-0006`).
-Only the NetKingdom repository provides packs so far, and its three v0.2 packs have not had their first attended run, so this capability is
-`active` but has no operational evidence yet. The fleet maturity vector is not assessed here: it needs the fleet's assessment method.
+# Guided administrative runbooks
+
+Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.
+
+## Reuse boundary
+
+Owner supplies procedures; UI progress is not runtime approval.
+
+## Supported use cases
+
+- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
+- U10: Operator recovers identity, custody or data with independently held recovery material
+- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions
+
+## Evidence and integration
+
+- [SCOPE.md](../../SCOPE.md)
+- [docs/pack-spec.md](../../docs/pack-spec.md)
+
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

registry/indexes/capabilities.yaml

@@ -1,13 +1,19 @@
 version: 1
-updated: '2026-09-29'
+updated: '2026-10-14'
 domain: infotech
 capabilities:
-  - id: capability.infotech.runbook-tutorials
-    name: Runbook-tutorial engine
-    summary: Engine, local UI and CLI for guided, parameterized operator runbooks; packs live in the repos that own the procedure.
-    domain: infotech
-    status: active
-    owner: runbook-tutorials
-    path: registry/capabilities/capability.infotech.runbook-tutorials.md
-    tags: [runbook, tutorial, operator, guided]
-    consumption_modes: [git clone, cli]
+- id: capability.infotech.runbook-tutorials
+  name: Guided administrative runbooks
+  summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.
+  domain: infotech
+  status: draft
+  owner: runbook-tutorials
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.infotech.runbook-tutorials.md
+  consumption_modes:
+  - CLI
+  - source