diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/capabilities/capability.railiance.security-consumption-contracts.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/capabilities/capability.railiance.security-consumption-contracts.md new file mode 100644 index 00000000..d6314645 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/capabilities/capability.railiance.security-consumption-contracts.md @@ -0,0 +1,100 @@ +--- +id: capability.railiance.security-consumption-contracts +owner: railiance-master +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Rail/rapp/reef boundaries, exposure + and security consumption contracts. Availability describes the delivery form, + not production acceptance. Architecture declarations do not prove implementation + or production admission.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Platform security consumption architecture +summary: Rail/rapp/reef boundaries, exposure and security consumption contracts. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Rail/rapp/reef boundaries, exposure and security consumption contracts + includes: + - Rail/rapp/reef boundaries, exposure and security consumption contracts + excludes: + - Architecture declarations do not prove implementation or production admission + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + - docs/netkingdom-security-consumption-contract.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - docs/netkingdom-security-consumption-contract.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Architecture declarations do not prove implementation or production admission + known_limitations: + - Architecture declarations do not prove implementation or production admission + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Platform security consumption architecture + +Rail/rapp/reef boundaries, exposure and security consumption contracts. + +## Reuse boundary + +Architecture declarations do not prove implementation or production admission. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/netkingdom-security-consumption-contract.md](../../docs/netkingdom-security-consumption-contract.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..3f3b854f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.security-consumption-contracts + name: Platform security consumption architecture + summary: Rail/rapp/reef boundaries, exposure and security consumption contracts. + domain: infotech + status: draft + owner: railiance-master + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.security-consumption-contracts.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/capabilities/capability.railiance.platform-services.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/capabilities/capability.railiance.platform-services.md new file mode 100644 index 00000000..f0d04ad1 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/capabilities/capability.railiance.platform-services.md @@ -0,0 +1,135 @@ +--- +id: capability.railiance.platform-services +name: Secret custody and platform data services +summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts. +owner: railiance-platform +status: draft +domain: financials +tags: +- railiance +- platform +- secrets +- postgres +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: SCOPE.md places this repo precisely at S3 in the Railiance OAS Stack, + scoped to shared cluster services (PostgreSQL HA, Valkey, secrets, identity + integration, object storage). + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: OpenBao policy/custody, consumer + grants, secret delivery and database/backup contracts. Availability describes + the delivery form, not production acceptance. Package ownership is split to + rapp repos; caches and object services are demand-led.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - OpenBao/Vault secret-management apply/verify scripting + - credential-change tooling + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - no top-level packaging; scripts/tools have no unified install path +discovery: + intent: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts + includes: + - OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts + excludes: + - Package ownership is split to rapp repos; caches and object services are demand-led + assumptions: [] + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + - docs/openbao.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.railiance.openbao-package + - capability.railiance.postgres-isolation-recovery + - capability.iam.key-cape + - capability.security.credential-lifecycle +evidence: + documentation: + - SCOPE.md + - docs/openbao.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Owner inventories, rotates, revokes and detects exposure of credentials + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Package ownership is split to rapp repos; caches and object services are demand-led + known_limitations: + - Package ownership is split to rapp repos; caches and object services are demand-led + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# Secret custody and platform data services + +OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts. + +## Reuse boundary + +Package ownership is split to rapp repos; caches and object services are demand-led. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U07: Owner inventories, rotates, revokes and detects exposure of credentials +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/openbao.md](../../docs/openbao.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..c0c1c732 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml @@ -0,0 +1,24 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.platform-services + name: Secret custody and platform data services + summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts. + domain: financials + status: draft + owner: railiance-platform + tags: + - railiance + - platform + - secrets + - postgres + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.platform-services.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/capabilities/capability.observability.security-signals.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/capabilities/capability.observability.security-signals.md new file mode 100644 index 00000000..b9f6196d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/capabilities/capability.observability.security-signals.md @@ -0,0 +1,99 @@ +--- +id: capability.observability.security-signals +owner: railiance-telemetry +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Signal contract, platform adapters, + report exporter and absence/alert rules. Availability describes the delivery + form, not production acceptance. Reference receiver is not a second production + plane; end-to-end delivery acceptance pending.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security-relevant telemetry contracts and adapters +summary: Signal contract, platform adapters, report exporter and absence/alert rules. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Signal contract, platform adapters, report exporter and absence/alert rules + includes: + - Signal contract, platform adapters, report exporter and absence/alert rules + excludes: + - Reference receiver is not a second production plane; end-to-end delivery acceptance + pending + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.railiance.telemetry-package + - capability.audit.event-retain + - capability.security.posture-assessment +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Reference receiver is not a second production plane; end-to-end delivery acceptance + pending + known_limitations: + - Reference receiver is not a second production plane; end-to-end delivery acceptance + pending + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security-relevant telemetry contracts and adapters + +Signal contract, platform adapters, report exporter and absence/alert rules. + +## Reuse boundary + +Reference receiver is not a second production plane; end-to-end delivery acceptance pending. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..e6177b67 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.observability.security-signals + name: Security-relevant telemetry contracts and adapters + summary: Signal contract, platform adapters, report exporter and absence/alert rules. + domain: infotech + status: draft + owner: railiance-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.observability.security-signals.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/capabilities/capability.railiance.openbao-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/capabilities/capability.railiance.openbao-package.md new file mode 100644 index 00000000..a22d7b6d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/capabilities/capability.railiance.openbao-package.md @@ -0,0 +1,103 @@ +--- +id: capability.railiance.openbao-package +owner: rapp-openbao +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Helm values, package deploy/status/smoke/rollback + and custody boundary. Availability describes the delivery form, not production + acceptance. Platform owns grants/policies; retained S3 handoff and recovery + acceptance remain explicit.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Managed OpenBao deployment package +summary: Helm values, package deploy/status/smoke/rollback and custody boundary. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Helm values, package deploy/status/smoke/rollback and custody boundary + includes: + - Helm values, package deploy/status/smoke/rollback and custody boundary + excludes: + - Platform owns grants/policies; retained S3 handoff and recovery acceptance remain + explicit + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - README.md + - docs/retained-s3-handoff.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md + - docs/retained-s3-handoff.md +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Platform owns grants/policies; retained S3 handoff and recovery acceptance remain + explicit + known_limitations: + - Platform owns grants/policies; retained S3 handoff and recovery acceptance remain + explicit + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Managed OpenBao deployment package + +Helm values, package deploy/status/smoke/rollback and custody boundary. + +## Reuse boundary + +Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [README.md](../../README.md) +- [docs/retained-s3-handoff.md](../../docs/retained-s3-handoff.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..86fe387d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.openbao-package + name: Managed OpenBao deployment package + summary: Helm values, package deploy/status/smoke/rollback and custody boundary. + domain: infotech + status: draft + owner: rapp-openbao + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.openbao-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/capabilities/capability.railiance.browser-verification.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/capabilities/capability.railiance.browser-verification.md new file mode 100644 index 00000000..0715180a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/capabilities/capability.railiance.browser-verification.md @@ -0,0 +1,94 @@ +--- +id: capability.railiance.browser-verification +owner: rapp-playwright +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Bounded jobs, cancellation, + artifacts, origin checks and restart receipts. Availability describes the delivery + form, not production acceptance. Pilot deployed; human/agent authentication + and per-caller self-service connectivity pending.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Managed browser verification pilot +summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Bounded jobs, cancellation, artifacts, origin checks and restart receipts + includes: + - Bounded jobs, cancellation, artifacts, origin checks and restart receipts + excludes: + - Pilot deployed; human/agent authentication and per-caller self-service connectivity + pending + use_cases: + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Human signs in with MFA and manages account or factor recovery + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Pilot deployed; human/agent authentication and per-caller self-service connectivity + pending + known_limitations: + - Pilot deployed; human/agent authentication and per-caller self-service connectivity + pending + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Managed browser verification pilot + +Bounded jobs, cancellation, artifacts, origin checks and restart receipts. + +## Reuse boundary + +Pilot deployed; human/agent authentication and per-caller self-service connectivity pending. + +## Supported use cases + +- U02: Human signs in with MFA and manages account or factor recovery +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..04a2fe55 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.browser-verification + name: Managed browser verification pilot + summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts. + domain: infotech + status: draft + owner: rapp-playwright + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.railiance.browser-verification.md + consumption_modes: + - HTTP API + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/capabilities/capability.railiance.policy-publication-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/capabilities/capability.railiance.policy-publication-package.md new file mode 100644 index 00000000..ea8a3b76 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/capabilities/capability.railiance.policy-publication-package.md @@ -0,0 +1,94 @@ +--- +id: capability.railiance.policy-publication-package +owner: rapp-policy-nexus +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Immutable image, non-root/read-only + runtime and approved TLS exposure. Availability describes the delivery form, + not production acceptance. No policy authoring or DNS/issuer administration.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Policy publication runtime package +summary: Immutable image, non-root/read-only runtime and approved TLS exposure. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Immutable image, non-root/read-only runtime and approved TLS exposure + includes: + - Immutable image, non-root/read-only runtime and approved TLS exposure + excludes: + - No policy authoring or DNS/issuer administration + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + wraps: + - capability.security.policy-publication +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - No policy authoring or DNS/issuer administration + known_limitations: + - No policy authoring or DNS/issuer administration + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Policy publication runtime package + +Immutable image, non-root/read-only runtime and approved TLS exposure. + +## Reuse boundary + +No policy authoring or DNS/issuer administration. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..02475636 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.policy-publication-package + name: Policy publication runtime package + summary: Immutable image, non-root/read-only runtime and approved TLS exposure. + domain: infotech + status: draft + owner: rapp-policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.policy-publication-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/capabilities/capability.railiance.postgres-isolation-recovery.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/capabilities/capability.railiance.postgres-isolation-recovery.md new file mode 100644 index 00000000..77a143bd --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/capabilities/capability.railiance.postgres-isolation-recovery.md @@ -0,0 +1,99 @@ +--- +id: capability.railiance.postgres-isolation-recovery +owner: rapp-postgres +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CNPG cells, per-consumer roles, + negative isolation tests and backup/restore procedures. Availability describes + the delivery form, not production acceptance. Host-loss proof and consumer schemas + stay with their owners.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Database isolation and recovery package +summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures + includes: + - CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures + excludes: + - Host-loss proof and consumer schemas stay with their owners + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Host-loss proof and consumer schemas stay with their owners + known_limitations: + - Host-loss proof and consumer schemas stay with their owners + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Database isolation and recovery package + +CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures. + +## Reuse boundary + +Host-loss proof and consumer schemas stay with their owners. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..399dc435 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.postgres-isolation-recovery + name: Database isolation and recovery package + summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures. + domain: infotech + status: draft + owner: rapp-postgres + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.postgres-isolation-recovery.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/capabilities/capability.railiance.telemetry-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/capabilities/capability.railiance.telemetry-package.md new file mode 100644 index 00000000..ccd9ff65 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/capabilities/capability.railiance.telemetry-package.md @@ -0,0 +1,100 @@ +--- +id: capability.railiance.telemetry-package +owner: rapp-telemetry +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Prometheus, Alertmanager and + Grafana package with isolated restore evidence. Availability describes the delivery + form, not production acceptance. Private installation only; recurring recovery + capture and audited confirmation pending.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Private monitoring package +summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Prometheus, Alertmanager and Grafana package with isolated restore evidence + includes: + - Prometheus, Alertmanager and Grafana package with isolated restore evidence + excludes: + - Private installation only; recurring recovery capture and audited confirmation + pending + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.observability.security-signals + - capability.railiance.kubernetes-rail + - capability.railiance.substrate-bindings +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Operator recovers identity, custody or data with independently held recovery material + not_recommended_for: + - Private installation only; recurring recovery capture and audited confirmation + pending + known_limitations: + - Private installation only; recurring recovery capture and audited confirmation + pending + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Private monitoring package + +Prometheus, Alertmanager and Grafana package with isolated restore evidence. + +## Reuse boundary + +Private installation only; recurring recovery capture and audited confirmation pending. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..244ede7a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.telemetry-package + name: Private monitoring package + summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence. + domain: infotech + status: draft + owner: rapp-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.telemetry-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/capabilities/capability.railiance.tenant-engine-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/capabilities/capability.railiance.tenant-engine-package.md new file mode 100644 index 00000000..99dcfd8d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/capabilities/capability.railiance.tenant-engine-package.md @@ -0,0 +1,94 @@ +--- +id: capability.railiance.tenant-engine-package +owner: rapp-tenant-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Package declaration, smoke and + rollback. Availability describes the delivery form, not production acceptance. + No tenant-domain ownership or credential values.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Tenant Engine runtime package +summary: Package declaration, smoke and rollback. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Package declaration, smoke and rollback + includes: + - Package declaration, smoke and rollback + excludes: + - No tenant-domain ownership or credential values + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + wraps: + - capability.identity.tenant-facts +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - No tenant-domain ownership or credential values + known_limitations: + - No tenant-domain ownership or credential values + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Tenant Engine runtime package + +Package declaration, smoke and rollback. + +## Reuse boundary + +No tenant-domain ownership or credential values. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..ce3a1f48 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.tenant-engine-package + name: Tenant Engine runtime package + summary: Package declaration, smoke and rollback. + domain: infotech + status: draft + owner: rapp-tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.tenant-engine-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/capabilities/capability.railiance.user-engine-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/capabilities/capability.railiance.user-engine-package.md new file mode 100644 index 00000000..24d262d7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/capabilities/capability.railiance.user-engine-package.md @@ -0,0 +1,97 @@ +--- +id: capability.railiance.user-engine-package +owner: rapp-user-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Pinned deployment, dedicated + CNPG, ExternalSecret references and rollback. Availability describes the delivery + form, not production acceptance. Domain, identity, PDP and custody authority + are separate.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: User Engine runtime package +summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback + includes: + - Pinned deployment, dedicated CNPG, ExternalSecret references and rollback + excludes: + - Domain, identity, PDP and custody authority are separate + use_cases: + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + wraps: + - capability.identity.user-engine +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Human signs in with MFA and manages account or factor recovery + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Domain, identity, PDP and custody authority are separate + known_limitations: + - Domain, identity, PDP and custody authority are separate + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# User Engine runtime package + +Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. + +## Reuse boundary + +Domain, identity, PDP and custody authority are separate. + +## Supported use cases + +- U02: Human signs in with MFA and manages account or factor recovery +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..8c97564e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.user-engine-package + name: User Engine runtime package + summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. + domain: infotech + status: draft + owner: rapp-user-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.user-engine-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/capabilities/capability.railiance.substrate-bindings.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/capabilities/capability.railiance.substrate-bindings.md new file mode 100644 index 00000000..c7d11228 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/capabilities/capability.railiance.substrate-bindings.md @@ -0,0 +1,91 @@ +--- +id: capability.railiance.substrate-bindings +owner: reef-railiance +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Grouped home-reef identity, + topology and placement declarations. Availability describes the delivery form, + not production acceptance. Declarations are not automatic placement or authorization.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Substrate topology and bindings +summary: Grouped home-reef identity, topology and placement declarations. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Grouped home-reef identity, topology and placement declarations + includes: + - Grouped home-reef identity, topology and placement declarations + excludes: + - Declarations are not automatic placement or authorization + use_cases: + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Declarations are not automatic placement or authorization + known_limitations: + - Declarations are not automatic placement or authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Substrate topology and bindings + +Grouped home-reef identity, topology and placement declarations. + +## Reuse boundary + +Declarations are not automatic placement or authorization. + +## Supported use cases + +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..ae1f1a9b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.substrate-bindings + name: Substrate topology and bindings + summary: Grouped home-reef identity, topology and placement declarations. + domain: infotech + status: draft + owner: reef-railiance + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.substrate-bindings.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/capabilities/capability.execution.scheduled-agent-rein.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/capabilities/capability.execution.scheduled-agent-rein.md new file mode 100644 index 00000000..8b92ffb6 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/capabilities/capability.execution.scheduled-agent-rein.md @@ -0,0 +1,93 @@ +--- +id: capability.execution.scheduled-agent-rein +owner: rein-aharness +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Activity Core lease claim/heartbeat + and Glas profile execution. Availability describes the delivery form, not production + acceptance. Legacy paths are time-gated; task success is not privileged authority.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Scheduled agent intake and harness routing +summary: Activity Core lease claim/heartbeat and Glas profile execution. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Activity Core lease claim/heartbeat and Glas profile execution + includes: + - Activity Core lease claim/heartbeat and Glas profile execution + excludes: + - Legacy paths are time-gated; task success is not privileged authority + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - Legacy paths are time-gated; task success is not privileged authority + known_limitations: + - Legacy paths are time-gated; task success is not privileged authority + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Scheduled agent intake and harness routing + +Activity Core lease claim/heartbeat and Glas profile execution. + +## Reuse boundary + +Legacy paths are time-gated; task success is not privileged authority. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..1fc474b1 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.execution.scheduled-agent-rein + name: Scheduled agent intake and harness routing + summary: Activity Core lease claim/heartbeat and Glas profile execution. + domain: infotech + status: draft + owner: rein-aharness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.scheduled-agent-rein.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/capabilities/capability.execution.openweight-rein.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/capabilities/capability.execution.openweight-rein.md new file mode 100644 index 00000000..919f8c6f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/capabilities/capability.execution.openweight-rein.md @@ -0,0 +1,89 @@ +--- +id: capability.execution.openweight-rein +owner: rein-openweights +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Tool loop, path guards, turn/budget + limits and verified-commit result. Availability describes the delivery form, + not production acceptance. Provider credential acquisition and runtime authority + need separate custody controls.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Bounded open-weight agent execution +summary: Tool loop, path guards, turn/budget limits and verified-commit result. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Tool loop, path guards, turn/budget limits and verified-commit result + includes: + - Tool loop, path guards, turn/budget limits and verified-commit result + excludes: + - Provider credential acquisition and runtime authority need separate custody controls + use_cases: + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - Provider credential acquisition and runtime authority need separate custody controls + known_limitations: + - Provider credential acquisition and runtime authority need separate custody controls + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Bounded open-weight agent execution + +Tool loop, path guards, turn/budget limits and verified-commit result. + +## Reuse boundary + +Provider credential acquisition and runtime authority need separate custody controls. + +## Supported use cases + +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..cf267ccb --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.execution.openweight-rein + name: Bounded open-weight agent execution + summary: Tool loop, path guards, turn/budget limits and verified-commit result. + domain: infotech + status: draft + owner: rein-openweights + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.openweight-rein.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/capabilities/capability.security.repository-secret-prevention.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/capabilities/capability.security.repository-secret-prevention.md new file mode 100644 index 00000000..678ef7bc --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/capabilities/capability.security.repository-secret-prevention.md @@ -0,0 +1,96 @@ +--- +id: capability.security.repository-secret-prevention +owner: repo-manager +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Repository observation plus + pinned staged-blob scanner and hook integration. Availability describes the + delivery form, not production acceptance. Local hooks are bypassable; coverage + is exact-checkout scoped.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Repository metadata and staged-secret prevention +summary: Repository observation plus pinned staged-blob scanner and hook integration. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Repository observation plus pinned staged-blob scanner and hook integration + includes: + - Repository observation plus pinned staged-blob scanner and hook integration + excludes: + - Local hooks are bypassable; coverage is exact-checkout scoped + use_cases: + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.railiance.forge-infrastructure + - capability.infotech.sbom-management + - capability.statehub.workstream-coordinate +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Owner inventories, rotates, revokes and detects exposure of credentials + - Developer builds and publishes through controlled source, dependency and runner + paths + not_recommended_for: + - Local hooks are bypassable; coverage is exact-checkout scoped + known_limitations: + - Local hooks are bypassable; coverage is exact-checkout scoped + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Repository metadata and staged-secret prevention + +Repository observation plus pinned staged-blob scanner and hook integration. + +## Reuse boundary + +Local hooks are bypassable; coverage is exact-checkout scoped. + +## Supported use cases + +- U07: Owner inventories, rotates, revokes and detects exposure of credentials +- U12: Developer builds and publishes through controlled source, dependency and runner paths + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..477c1751 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.repository-secret-prevention + name: Repository metadata and staged-secret prevention + summary: Repository observation plus pinned staged-blob scanner and hook integration. + domain: infotech + status: draft + owner: repo-manager + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.repository-secret-prevention.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/capabilities/capability.resources.security-capacity.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/capabilities/capability.resources.security-capacity.md new file mode 100644 index 00000000..b520e4b2 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/capabilities/capability.resources.security-capacity.md @@ -0,0 +1,100 @@ +--- +id: capability.resources.security-capacity +owner: resource-control +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Provider-neutral inventory, + procurement evidence and optimization reports. Availability describes the delivery + form, not production acceptance. No payment authority or irreversible procurement; + metrics do not prove usable runtime capacity.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Capacity and recovery resource planning +summary: Provider-neutral inventory, procurement evidence and optimization reports. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Provider-neutral inventory, procurement evidence and optimization reports + includes: + - Provider-neutral inventory, procurement evidence and optimization reports + excludes: + - No payment authority or irreversible procurement; metrics do not prove usable + runtime capacity + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - No payment authority or irreversible procurement; metrics do not prove usable + runtime capacity + known_limitations: + - No payment authority or irreversible procurement; metrics do not prove usable + runtime capacity + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Capacity and recovery resource planning + +Provider-neutral inventory, procurement evidence and optimization reports. + +## Reuse boundary + +No payment authority or irreversible procurement; metrics do not prove usable runtime capacity. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..3f7aa93a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.resources.security-capacity + name: Capacity and recovery resource planning + summary: Provider-neutral inventory, procurement evidence and optimization reports. + domain: infotech + status: draft + owner: resource-control + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.resources.security-capacity.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.infotech.headless-browser.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.infotech.headless-browser.md new file mode 100644 index 00000000..3adb61d5 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.infotech.headless-browser.md @@ -0,0 +1,334 @@ +--- +id: capability.infotech.headless-browser +name: Headless Browser Automation +summary: >- + Headless browser automation, screenshots and keyboard trials through + rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). + Published A5 local container; managed Railiance admission is pending. + Download the Python 3.10+ standalone client from + https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, + then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, + follow the local container setup in the capability card or adapt its A2 source + examples; this is an availability gap on the existing capability. + Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md. +owner: reuse-surface +status: reviewed +domain: infotech +tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer] +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: > + Inspected four implemented Playwright consumers and separated optional + dependencies and plans from usage. No comprehensive alternatives benchmark. + availability: + current: A5 + target: A6 + confidence: medium + rationale: > + rapp-playwright 0.1.0 is a published immutable container with a versioned + HTTP contract and standalone Python client, independently trialled locally. + A5 describes deployable container availability, not managed operation (A6). + Railiance admission is pending. Existing A2 source adaptation remains usable; + no endpoint uptime or caller browser installation is implied. +external_evidence: + completeness: + level: C2 + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - Identifies implemented consumers, browser engines and source entry points. + - Gives a scoped default recommendation and a practical trial procedure. + - Published provider client and container have independent fixture screenshots and keyboard receipts. + broken_expectations: + - Managed admission and persistent platform endpoint are still pending. + - Consumer application acceptance remains the consuming repo's responsibility. + out_of_scope_expectations: + - Exhaustive estate dependency inventory or comparative browser benchmark. + - Browser service implementation or operation by reuse-surface. + - Mandatory estate-wide technology policy. + reliability: + level: R2 + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - Browser binaries and system libraries must match the selected Playwright version. + - Existing examples contain application-specific fixtures and assumptions. + - Local fixture receipts do not prove managed operation or arbitrary target compatibility. + - Local provider endpoints are ephemeral; check preflight for each trial. + evidence: + satisfied_signals: + - frontend-patterns navigation-history records a completed Chromium/Firefox experiment. + - rapp-playwright independent final-release trial passed 14 steps across desktop and narrow viewports. + - Independent provider evidence includes wrong-token, failed assertion and unavailable-service checks. +discovery: + intent: > + Help a worker select and reuse existing headless browser tooling instead of + independently introducing another automation stack. + includes: + - Playwright automation with headless Chromium as the default starting point. + - JavaScript UI tests, screenshots and page extraction examples. + - Python visual-check example and Firefox experiment evidence. + - Published rapp-playwright container, Python client and bounded HTTP fixture trials. + excludes: + - Browser hosting or workstation provisioning by reuse-surface. + - Credential provisioning and permission to automate external targets. + - Claims that a dependency declaration or a workplan proves executed browser usage. + assumptions: + - Source-adaptation consumers install matching browsers; provider clients need only Python 3.10+. + - Provider consumers establish an available endpoint and run preflight before a trial. + use_cases: + - Find which working repos already use a headless browser and where to start reusing it. + - Run a local UI assertion and screenshot in a target repo before adopting the tooling. +availability: + current_level: A5 + target_level: A6 + current_artifacts: + - forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 + - https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json + - ../whynot-design/playwright.config.mjs + - ../whynot-design/tests/visual/ui-kit.spec.mjs + - ../coulomb-social/scripts/test-usecase-browser.mjs + - ../core-hub/scripts/check_console_visual.py + - ../frontend-patterns/research/experiments/navigation-history/experiment.mjs + target_artifacts: + - >- + Managed Railiance deployment after platform admission, with consumer + access and live recovery/rollback evidence; not currently available. + consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container] +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - https://playwright.dev/docs/browsers + - ../frontend-patterns/research/experiments/navigation-history/README.md + - ../test-driver/SCOPE.md + - ../testdrive-jsui/pyproject.toml + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md + - intakes/REUSE-IN-0001-headless-browser-runnable-answer.md + tests: + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md + - docs/evidence/2026-10-13-browser-discovery.md + - ../whynot-design/tests/visual/ui-kit.spec.mjs + - ../coulomb-social/scripts/test-usecase-browser.mjs + - ../core-hub/scripts/check_console_visual.py + - ../frontend-patterns/research/experiments/navigation-history/result.json + consumer_feedback: + - >- + 2026-10-13 content-explorer, REUSE-IN-0001: published source examples did not + provide a verified runnable path for screenshots and keyboard interaction. + The false-new plan-check verdict is a registry discovery issue, not evidence + that a new browser stack is needed. Browser delivery belongs to the provider. +consumer_guidance: + recommended_for: + - Use Playwright with headless Chromium for a new repo's general UI automation trial. + - Reuse whynot-design for JavaScript visual tests and core-hub for Python visual checks. + - Reuse coulomb-social for JavaScript browser scripts and frontend-patterns for multi-engine experiments. + - >- + For bounded screenshot and keyboard jobs, use the published rapp-playwright + Python client against an available local provider and run preflight first. + Use the immutable container to reproduce the provider; managed Railiance + access requires admission and a working tunnel before consumption. + not_recommended_for: + - Treating this recommendation as an approved mandatory estate standard. + - Selecting test-driver as an implemented JavaScript-capable browser engine. + - Introducing Selenium or Puppeteer merely because their names match a discovery query. + known_limitations: + - This is a dated source inspection; run the target-repo trial before claiming adoption success. + - Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection. + - Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here. + - Local provider availability is verified but ephemeral; managed admission and platform operation remain pending. + - Provider fixture success does not establish consumer target reachability or application acceptance. +promotion_history: + - date: "2026-10-13" + dimension: availability + from: A2 + to: A5 + rationale: >- + Published immutable rapp-playwright 0.1.0 container, versioned client/contract + and independent local release receipts satisfy deployable-container availability. + This is not an A6 managed-platform claim. D3, C2 and R2 remain conservative + assessments pending broader target and operational evidence. + author: codex +--- + +# Headless Browser Automation + +## Recommendation + +Start with **Playwright controlling headless Chromium** for general browser +automation, UI tests, screenshots and JavaScript-rendered page extraction. +This follows implemented usage in four working repos. Playwright is the automation +library; Chromium is the browser engine. Use `@playwright/test` for a JavaScript +test suite, the `playwright` library for standalone JavaScript scripts, or Python +`playwright` when the consumer is Python. + +This is a reuse recommendation reviewed against source on **2026-10-13**, not a +mandatory estate standard or a benchmark verdict against Selenium/Puppeteer. +reuse-surface maintains this discovery record; the example repos maintain their +implementations and the upstream Playwright project maintains the library. + +## Service provider and delivery status + +**rapp-playwright 0.1.0 is published and verified as a local container provider.** +The current vector is **D3 / A5 / C2 / R2**. A5 means a deployable container under +[the maturity standard](../../specs/CapabilityMaturityStandard.md); managed +platform operation is A6 and remains **pending Railiance admission**. Source +examples remain available at A2. No browser is installed on the caller's machine +by discovery or by running the Python client. + +`rapp-playwright` owns the browser service; `railiance-platform` owns managed +lifecycle admission. `reuse-surface` owns this record, discovery, consumption +guidance and evidence assessment. The +[content-explorer intake](../../intakes/REUSE-IN-0001-headless-browser-runnable-answer.md) +concerns registry relevance and availability clarity; CONTENT-WP-0000-T04 +acceptance remains with the consumer. + +### Verified client path + +Only Python 3.10+ is needed by the consumer. Download the single revision-pinned +client into a working directory; a sibling checkout is not required: + +```sh +curl -fL --output rapp_playwright.py https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py +python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight +python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01 +``` + +Use a fresh output directory for each run. Port **18083** was verified on this +workstation on **2026-10-13**; it is an ephemeral local provider, not a permanent +or remotely reachable endpoint. Preflight must report `available: true`, API 1, +service 0.1.0, Playwright **1.64.0**, Chromium **156.0.8078.4**, and the expected +release/location. Connection failure means the provider or tunnel is unavailable, +not that another browser capability is needed. Use the local setup below or the +source-adaptation fallback. Repeat `--url` on later status/download commands. + +The fixture trial checks Tab focus, Enter activation and the counter assertion +across **1280×800** and **390×844** viewports, then downloads screenshots and a +receipt. It does not inspect or accept the consumer's own UI. `run.json` is a +private run handle and must not be published. For `trial`/`run`, exit 0 means +passed, 2 means UI assertion failed, and 3 means infrastructure/setup or another +unsuccessful result; `status` exit 0 only means retrieval succeeded. + +### Reproduce the local provider + +The published release targets **linux/amd64**. With Docker and image pull access, +start the immutable container in one terminal, then point the client at port +**18081** in another: + +```sh +docker run --rm --name rapp-playwright-local --read-only \ + --tmpfs /tmp:rw,size=512m --shm-size=256m --memory=1g --cpus=1 \ + --cap-drop ALL --security-opt no-new-privileges \ + --mount type=volume,src=rapp-playwright-local-data,dst=/data \ + -p 127.0.0.1:18081:8080 -e HOST=0.0.0.0 \ + -e EXECUTION_LOCATION=workstation-container \ + -e RELEASE_ID=sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 \ + forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 +python3 rapp_playwright.py --url http://127.0.0.1:18081 preflight +python3 rapp_playwright.py --url http://127.0.0.1:18081 trial --out trial-local-01 +``` + +This is the provider's documented local setup with the published digest pinned; +it was not redeployed by this registry review. Existing independent final-release +receipts and the fresh discovery trial use the same digest. The default fixture +requires no external target grant. The provider supports trusted/synthetic pages, +not hostile-page or mutually untrusted tenant execution. + +### Conditional managed path + +Only **after platform admission, deployment and caller access are confirmed**: + +```sh +kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1 +# In another terminal, while the tunnel remains running: +python3 rapp_playwright.py preflight +python3 rapp_playwright.py trial --out trial-managed-01 +``` + +No managed deployment or successful managed invocation is claimed here. A remote +browser's localhost belongs to the provider. Consumer applications need a +provider-reachable, explicitly allowed origin; the browser API tunnel does not +forward a workstation app. See the provider contract before running a target +scenario. + +### Pinned delivery evidence + +All provider links below are pinned to published commit +`8831a05aeba5ce588f3b395ade676dde2a151c5d`: + +- [Consumer contract](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md). +- [Release manifest](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json) + and [publication/pull evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md). +- [Independent consumer evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md), + including final-release screenshots, keyboard assertions, wrong-token rejection, + UI failure and unavailable-service results. These are retained provider-side + reports; this review separately verified the fixture path. +- [Fresh registry review and trial](../../docs/evidence/2026-10-13-browser-discovery.md). + +## Existing implementations + +Paths in frontmatter are relative to the reuse-surface repository root. The links +below work with sibling checkouts. The cited files were clean at these revisions. + +| Repo and inspected revision | What is implemented | Reuse starting point | +| --- | --- | --- | +| whynot-design — `a79a4d803e9aed13f66d072bf409b6f86000f01f` | Playwright Test, explicitly headless Chromium, screenshot comparisons | [Configuration](../../../whynot-design/playwright.config.mjs), [visual tests](../../../whynot-design/tests/visual/ui-kit.spec.mjs), [dependency/scripts](../../../whynot-design/package.json) | +| coulomb-social — `5c32757b987ab1610cdb46a808d56c75f569f581` | JavaScript Playwright scripts launching headless Chromium for browser tests and extraction | [Use-case test](../../../coulomb-social/scripts/test-usecase-browser.mjs), [script dependency](../../../coulomb-social/scripts/package.json) | +| core-hub — `a69ad325271485afe284a6db85673dfa30d9d4ad` | Python synchronous Playwright visual checks launching Chromium with the default headless mode | [Visual-check script](../../../core-hub/scripts/check_console_visual.py), [development dependency](../../../core-hub/pyproject.toml) | +| frontend-patterns — `047a6a2d314ff5a9d2a87d5bc987d7d84835f682` | Playwright experiments using Chromium and Firefox, with retained execution receipts | [Runner](../../../frontend-patterns/research/experiments/navigation-history/experiment.mjs), [setup and limitations](../../../frontend-patterns/research/experiments/navigation-history/README.md), [result](../../../frontend-patterns/research/experiments/navigation-history/result.json) | + +These are source/retained-receipt observations, not newly executed test results. +The frontend-patterns example uses an explicit Chromium binary override; do not +copy its workstation paths as a portable browser installation recipe. + +## Alternatives and misleading matches + +- **Selenium:** [testdrive-jsui's optional development dependencies](../../../testdrive-jsui/pyproject.toml) + declare it at `701341d7fa520f860245e28eb16d44b767fd116b`. A declaration alone + does not establish an implemented or passing browser workflow. +- **test-driver:** [SCOPE.md](../../../test-driver/SCOPE.md) at + `c3ad06e598057862cf500cbd46c7c8b6f83885ed` explicitly excludes a browser engine, + JavaScript execution, screenshots and DOM timing. Historical Playwright plans + are not an available implementation. +- **Puppeteer:** no verified implementation was found in this inspection. This + is not a claim that every working repo has been exhaustively searched. +- **Firefox/WebKit:** Playwright supports both upstream. Firefox has retained + experiment evidence here; WebKit has no verified local example in this record. + +## Source-adaptation fallback for the consuming worker + +1. Query this checkout with `python3 -m reuse_surface.cli query --keyword browser` + from the reuse-surface root, then open this entry. If the CLI is installed, + `reuse-surface query --keyword browser` is equivalent. + `plan-check --intent "headless browser" --no-llm` ranks this entry first. + Its reuse verdict describes relevance; provider preflight determines current + runtime availability. Use source adaptation when the provider path is unsuitable. +2. Pick the example matching the target repo's language and task. Inspect its + fixture/server assumptions before adapting the smallest useful test or script. +3. Use the target repo's package manager and lockfile. Select a compatible + Playwright version and install its matching Chromium binary. For an installed + Node dependency, use `npx playwright install chromium`; for an installed Python + dependency, use `python -m playwright install chromium` in its environment. + Follow the upstream [browser/system-dependency instructions](https://playwright.dev/docs/browsers) + if system libraries are missing. No common estate version is established here. +4. Against a local fixture or the target repo's local development server, launch + headless Chromium, load one page, assert one meaningful rendered element or + interaction, save a screenshot if relevant, and close the browser. Exercise + a JavaScript-driven change if JavaScript rendering is the reason for adoption. +5. Report the consumer repo, reference example, package/browser versions, exact + command, assertion outcome, artifact paths and any setup failure. The trial + remains unverified until this evidence exists; installation alone is not success. + +The hosted service reads published repository indexes. A local edit does not +by itself make this entry available at `reuse.coulomb.social`; use the local query +above for an unpublished trial and verify the hosted entry after publication. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.register.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.register.md new file mode 100644 index 00000000..f873c59d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.register.md @@ -0,0 +1,198 @@ +--- +id: capability.registry.register +name: Capability registry and federation +summary: Owner Markdown entries, indexes, federation hub and planning queries. +owner: reuse-surface +status: draft +domain: helix_forge +tags: +- registry +- governance +- meta +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: 'Core use case UC-RS-001 is documented in specs/UseCaseCatalog.md and + the registry model is bounded in INTENT.md, but concrete promotion workflows + are not yet grounded in registry artifacts. + + ' + availability: + current: A3 + target: A5 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Owner Markdown entries, indexes, + federation hub and planning queries. Availability describes the delivery form, + not production acceptance. Discovery is not readiness; empty and stale entries + need evidence-led maintenance.' +external_evidence: + completeness: + level: C2 + name: Partial + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - capability IDs can be assigned in registry entries + - maturity vectors can be recorded at registration time + - CLI validate, query, and export support registry workflows + - promotion history can be recorded in entries + - federation repo registration via hosted hub API and hub CLI + broken_expectations: + - no automated duplicate detection yet + out_of_scope_expectations: + - hosting registered capabilities + - enforcing implementation architecture + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - index drift still possible if authors skip validate + - CLI requires local venv install + - sibling repos cannot register until indexes publish raw URLs + evidence: + satisfied_signals: + - CI validate with fail-on-warnings on every push + - hub register/list/federated smoke on production reuse.coulomb.social + - pytest coverage for hub API and federation compose paths +discovery: + intent: Owner Markdown entries, indexes, federation hub and planning queries + includes: + - Owner Markdown entries, indexes, federation hub and planning queries + excludes: + - Discovery is not readiness; empty and stale entries need evidence-led maintenance + assumptions: + - unregistered capabilities are invisible for registry-driven reuse + - low-maturity entries are acceptable when evidence gaps are explicit + use_cases: + - UC-RS-001 + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: + - specs/UseCaseCatalog.md + - specs/ProductRequirementsDocument.md +availability: + current_level: A3 + target_level: A5 + current_artifacts: + - docs/RegistryFederation.md + - specs/CapabilityMaturityStandard.md + target_artifacts: + - packaged container release with documented SLO + consumption_modes: + - library + - CLI +relations: + depends_on: [] + supports: + - capability.feature-control.evaluate + - capability.identity.vocabulary-canonicalize + related_to: + - capability.registry.validate + - capability.security.iam-tooling-suite +evidence: + documentation: + - docs/RegistryFederation.md + - specs/CapabilityMaturityStandard.md + tests: + - tests/test_hub.py + - tests/test_hub_sync.py + - .forgejo/workflows/ci.yml + consumer_feedback: + - 'reuse-surface dogfood (REUSE-WP-0011): production hub registration and /v1/federated + compose succeeded on Railiance01 without write-path regressions after WP-0011 + deploy. + + ' + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Discovery is not readiness; empty and stale entries need evidence-led maintenance + known_limitations: + - Discovery is not readiness; empty and stale entries need evidence-led maintenance + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-06-14' + dimension: discovery + from: D0 + to: D1 + rationale: Added name, summary, and registry-first intent from INTENT.md. + author: reuse-surface +- date: '2026-06-15' + dimension: discovery + from: D1 + to: D3 + rationale: Bounded scope with UC-RS-001 and MVP registry artifacts in specs/. + author: reuse-surface +- date: '2026-06-15' + dimension: availability + from: A0 + to: A3 + rationale: reuse-surface CLI shipped validate, query, and export commands. + author: reuse-surface +- date: '2026-06-15' + dimension: availability + from: A3 + to: A4 + rationale: 'Hosted federation hub live at reuse.coulomb.social; hub register/update + via HTTP API and reuse-surface hub CLI; production deploy on Railiance01. + + ' + author: reuse-surface +- date: '2026-06-16' + dimension: reliability + from: R2 + to: R3 + rationale: 'CI gates, pytest hub/federation coverage, and production hub smoke support + normal registration workflows with documented limitations. + + ' + author: reuse-surface +- date: '2026-10-14' + dimension: availability + from: A4 + to: A3 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# Capability registry and federation + +Owner Markdown entries, indexes, federation hub and planning queries. + +## Reuse boundary + +Discovery is not readiness; empty and stale entries need evidence-led maintenance. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [docs/RegistryFederation.md](../../docs/RegistryFederation.md) +- [specs/CapabilityMaturityStandard.md](../../specs/CapabilityMaturityStandard.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.validate.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.validate.md new file mode 100644 index 00000000..8231e350 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.validate.md @@ -0,0 +1,134 @@ +--- +id: capability.registry.validate +name: Capability registry validation +summary: Schema, index consistency and relation checks. +owner: reuse-surface +status: draft +domain: helix_forge +tags: +- registry +- validation +- cli +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: UC-RS-023 is implemented via reuse-surface validate with schema and + drift checks. + availability: + current: A3 + target: A3 + confidence: high + rationale: 'Source interface assessed 2026-10-14: Schema, index consistency and + relation checks. Availability describes the delivery form, not production acceptance. + Schema validity alone proves neither capability behavior nor hosted freshness.' +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - schema validation for entry front matter + - index drift detection + - optional relation integrity checks + broken_expectations: [] + out_of_scope_expectations: + - runtime validation of registered capability implementations + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - requires local venv install + - relation warnings require explicit --relations flag + evidence: + satisfied_signals: + - validate --relations --fail-on-warnings in CI + - tests/test_registry.py schema and drift coverage +discovery: + intent: Schema, index consistency and relation checks + includes: + - Schema, index consistency and relation checks + excludes: + - Schema validity alone proves neither capability behavior nor hosted freshness + use_cases: + - UC-RS-023 + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: + - specs/UseCaseCatalog.md +availability: + current_level: A3 + target_level: A3 + current_artifacts: + - docs/RegistryFederation.md + - schemas/capability.schema.yaml + consumption_modes: + - library + - CLI +relations: + depends_on: + - capability.registry.register + supports: [] + related_to: + - capability.registry.register + - capability.security.iam-tooling-suite +evidence: + documentation: + - docs/RegistryFederation.md + - schemas/capability.schema.yaml + tests: + - tests/test_registry.py + consumer_feedback: + - 'reuse-surface CI: registry changes fail when schema validation or relation checks + warn with --fail-on-warnings, giving agents a dependable pre-merge gate. + + ' +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Schema validity alone proves neither capability behavior nor hosted freshness + known_limitations: + - Schema validity alone proves neither capability behavior nor hosted freshness + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-06-16' + dimension: reliability + from: R2 + to: R3 + rationale: CI fail-on-warnings and pytest registry coverage support dependable validation. + author: reuse-surface +--- + +# Capability registry validation + +Schema, index consistency and relation checks. + +## Reuse boundary + +Schema validity alone proves neither capability behavior nor hosted freshness. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [docs/RegistryFederation.md](../../docs/RegistryFederation.md) +- [schemas/capability.schema.yaml](../../schemas/capability.schema.yaml) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..fecdaac8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml @@ -0,0 +1,78 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.infotech.headless-browser + name: Headless Browser Automation + summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright + 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; + managed Railiance admission is pending. Download the Python 3.10+ standalone client + from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then + `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, follow + the local container setup in the capability card or adapt its A2 source examples; + this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.' + vector: D3 / A5 / C2 / R2 + domain: infotech + status: reviewed + owner: reuse-surface + path: registry/capabilities/capability.infotech.headless-browser.md + tags: + - headless + - browser + - automation + - playwright + - chromium + - testing + - screenshots + - extraction + - firefox + - webkit + - selenium + - puppeteer + consumption_modes: + - informational + - source adaptation + - JavaScript library + - Python library + - cli + - service API + - container +- id: capability.registry.register + name: Capability registry and federation + summary: Owner Markdown entries, indexes, federation hub and planning queries. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - governance + - meta + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C2 / R3 + path: registry/capabilities/capability.registry.register.md + consumption_modes: + - library + - CLI +- id: capability.registry.validate + name: Capability registry validation + summary: Schema, index consistency and relation checks. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - validation + - cli + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R3 + path: registry/capabilities/capability.registry.validate.md + consumption_modes: + - library + - CLI diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/capabilities/capability.security.risk-register.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/capabilities/capability.security.risk-register.md new file mode 100644 index 00000000..81cd4222 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/capabilities/capability.security.risk-register.md @@ -0,0 +1,93 @@ +--- +id: capability.security.risk-register +owner: risk-nexus +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Markdown findings and Python + review, verification and due-work reports. Availability describes the delivery + form, not production acceptance. Judgment remains human or agent; no live EUR + risk gate or autonomous response.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security risk and exception review register +summary: Markdown findings and Python review, verification and due-work reports. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Markdown findings and Python review, verification and due-work reports + includes: + - Markdown findings and Python review, verification and due-work reports + excludes: + - Judgment remains human or agent; no live EUR risk gate or autonomous response + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Judgment remains human or agent; no live EUR risk gate or autonomous response + known_limitations: + - Judgment remains human or agent; no live EUR risk gate or autonomous response + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security risk and exception review register + +Markdown findings and Python review, verification and due-work reports. + +## Reuse boundary + +Judgment remains human or agent; no live EUR risk gate or autonomous response. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..685047ea --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.risk-register + name: Security risk and exception review register + summary: Markdown findings and Python review, verification and due-work reports. + domain: infotech + status: draft + owner: risk-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.risk-register.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/capabilities/capability.organization.role-catalog.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/capabilities/capability.organization.role-catalog.md new file mode 100644 index 00000000..0d36f975 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/capabilities/capability.organization.role-catalog.md @@ -0,0 +1,92 @@ +--- +id: capability.organization.role-catalog +owner: role-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Versioned documentation catalog. + Availability describes the delivery form, not production acceptance. Not IAM + roles, assignments or runtime authorization.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Organizational role definitions +summary: Versioned documentation catalog. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Versioned documentation catalog + includes: + - Versioned documentation catalog + excludes: + - Not IAM roles, assignments or runtime authorization + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - README.md + - INTENT.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md + - INTENT.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - Not IAM roles, assignments or runtime authorization + known_limitations: + - Not IAM roles, assignments or runtime authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Organizational role definitions + +Versioned documentation catalog. + +## Reuse boundary + +Not IAM roles, assignments or runtime authorization. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [README.md](../../README.md) +- [INTENT.md](../../INTENT.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..c0136178 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.organization.role-catalog + name: Organizational role definitions + summary: Versioned documentation catalog. + domain: infotech + status: draft + owner: role-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.organization.role-catalog.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md new file mode 100644 index 00000000..2e2be670 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md @@ -0,0 +1,100 @@ +--- +id: capability.infotech.runbook-tutorials +owner: runbook-tutorials +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Pack schema, loader, local UI/CLI, + gates, verification and rollback evidence. Availability describes the delivery + form, not production acceptance. Owner supplies procedures; UI progress is not + runtime approval.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Guided administrative runbooks +summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence + includes: + - Pack schema, loader, local UI/CLI, gates, verification and rollback evidence + excludes: + - Owner supplies procedures; UI progress is not runtime approval + use_cases: + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - docs/pack-spec.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - docs/pack-spec.md +consumer_guidance: + recommended_for: + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator recovers identity, custody or data with independently held recovery material + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Owner supplies procedures; UI progress is not runtime approval + known_limitations: + - Owner supplies procedures; UI progress is not runtime approval + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Guided administrative runbooks + +Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. + +## Reuse boundary + +Owner supplies procedures; UI progress is not runtime approval. + +## Supported use cases + +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U10: Operator recovers identity, custody or data with independently held recovery material +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/pack-spec.md](../../docs/pack-spec.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..432ceaed --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +capabilities: +- id: capability.infotech.runbook-tutorials + name: Guided administrative runbooks + summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. + domain: infotech + status: draft + owner: runbook-tutorials + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.infotech.runbook-tutorials.md + consumption_modes: + - CLI + - source