coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs: publish reviewed NetKingdom evidence batch 1

Browse source
This commit is contained in:
codex 2026-10-14 09:45:31 +02:00
parent e8bd394c8b
commit 2b6901eb9c
40 changed files with 21549 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/assessments/netkingdom-2026-10-14/apply_registry.py Normal file
View file

@ -0,0 +1,20 @@
"""Apply only the hash-pinned, reviewed metadata patch; never stage or commit."""
from pathlib import Path
import hashlib,json
OUT=Path(__file__).resolve().parent;BASE=Path('/home/worsch')
changes=json.loads((OUT/'registry-changes.json').read_text())
# Check the entire patch before the first write. Do not overwrite concurrent edits.
for c in changes:
p=BASE/c['repo']/c['path'];actual=hashlib.sha256(p.read_bytes()).hexdigest() if p.exists() else None
if actual!=c['before_sha256']:raise SystemExit('Concurrent change: '+str(p))
if c['operation']=='write':
stage=OUT/'registry-stage'/c['repo']/c['path']
if hashlib.sha256(stage.read_bytes()).hexdigest()!=c['after_sha256']:raise SystemExit('Staged digest differs: '+str(stage))
for c in changes:
p=BASE/c['repo']/c['path']
if p.exists():
backup=OUT/'registry-before'/c['repo']/c['path'];backup.parent.mkdir(parents=True,exist_ok=True);backup.write_bytes(p.read_bytes())
if c['operation']=='delete':p.unlink()
else:p.parent.mkdir(parents=True,exist_ok=True);p.write_bytes((OUT/'registry-stage'/c['repo']/c['path']).read_bytes())
(OUT/'registry-application.json').write_text(json.dumps({'applied':len(changes),'repositories':len({c['repo'] for c in changes}),'verified_sha256':True,'git_staging_or_commits':False},indent=2)+'\n')
print('Applied',len(changes),'reviewed metadata edits')

98
docs/assessments/netkingdom-2026-10-14/build_inventory.py Normal file
View file

@ -0,0 +1,98 @@
"""Build the review's explicit capability denominator and staged registry patch."""
from pathlib import Path
import hashlib, json, subprocess, yaml
BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent
# repo | id suffix | capability | availability | operational estimate (1..5) | surface | limitation | use cases | artifacts
DATA='''
security-canon|security.practice-canon|Security practice and authority vocabulary|A0|2|Versioned SEC-DSM and Mode of Authority documents|Normative practice; no runtime control or certification|U01 U07 U10 U14|SCOPE.md;infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md
net-kingdom|security.iam-tooling-suite|NetKingdom security architecture and conformance tooling|A2|2|Versioned IAM, layer, tenancy and credential contracts plus validators|Mixed accepted and proposed standards; framework integration remains incomplete|U01 U02 U03 U14|SCOPE.md;SECURITY-COMPANION.md
net-kingdom|security.scenario-compose|Deterministic security scenario composition|A2|2|CLI selects pinned providers and orders trust transitions|Plan only; execution.permitted is always false|U01 U14|tools/security-scenario-composer/README.md;tools/security-scenario-composer/security_scenario_composer.py
net-kingdom|security.posture-feedback|Deterministic posture feedback|A2|2|CLI evaluates evidence age and posture into owner-routed findings|Proposal only; no policy changes or remediation execution|U09 U14|tools/posture-feedback/README.md;tools/posture-feedback/posture_feedback.py
net-kingdom|security.case-contracts|Security case types and instance validation|A2|2|Versioned types, cases and schema validation|Type acknowledgment, case acceptance, structural materialization and native execution are distinct|U01 U05 U06|tools/security-case-types/README.md;canon/standards/security-case-types_v0.1.md
net-kingdom|security.bootstrap-recovery|Guarded bootstrap and recovery preparation|A2|2|Local identity, bootstrap console, encrypted custody handoff and caller tools|Source repairs and disposable native fixtures do not prove estate root isolation or recovery|U10|tools/security-bootstrap-console/README.md;tools/custody-record/README.md
net-kingdom|security.emission-profile|Security emission cadence validation|A2|2|Security profile over generic emission contracts and validator|Profile adoption and source completeness require owner-native evidence|U08 U09|tools/emission-cadence-profile/README.md
key-cape|iam.key-cape|OIDC identity and assurance|A4|3|OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI|Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates|U02 U03 U04 U10|SCOPE.md;README.md
user-engine|identity.user-engine|User lifecycle and account journeys|A4|3|Accounts, identity links, membership, MFA and recovery portal, advisory catalog|Application readback is advisory; applications must enforce their own authorization|U02 U03 U10|SCOPE.md;README.md
tenant-engine|identity.tenant-facts|Tenant lifecycle and guardrail facts|A4|3|Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store|Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate|U03 U04|SCOPE.md;README.md
zone-engine|security.zone-reference|Zone membership reference conformance|A2|2|Offline resolution, exception and lineage checks|No live zone engine, PDP or protected side effects|U01 U03 U14|SCOPE.md;README.md
access-engine|authorization.policy-evaluate|Policy evaluation and decision evidence|A4|3|Check, batch, list-allowed, explain, binding, lifetime and decision records|One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct|U03 U04 U05 U06|SCOPE.md;README.md
approval-engine|security.approval-lifecycle|Bound approval lifecycle|A4|2|Authenticated issue, claim, revoke, supersede and atomic consume API with outbox|Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open|U04 U05 U06|SCOPE.md;approval_engine/api.py;docs/production-dependencies.md
secrets-engine|security.credential-lifecycle|Cataloged credential lifecycle|A2|2|CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke|Production protected execution and independently anchored PDP authentication remain incomplete|U04 U05 U07|SCOPE.md;src/secrets_engine/decision_check.py
ops-warden|security.ssh-certificate-issuance|Decision-bound SSH certificates|A3|3|warden sign with local and OpenBao backends and adm/agt/atm actors|Direct Tooling contact is a declared gap; certificate reachability is not target authorization|U06|SCOPE.md;README.md
ops-warden|security.access-routing|Credential routing and contained access|A3|3|warden route and access catalog; exact lane conduit and secret-exec routing|Routing grants no authority; interim delegates and attended high-risk lanes persist|U04 U05 U06|SCOPE.md;wiki/CredentialRouting.md
ops-warden|security.case-follow-through|Security case operational follow-through|A2|2|KnownSecurityCase route, plan and operational receipts|Execution requires accepted structure and exact owner contracts; case closure is not automatic|U01 U05 U06|workplans/WARDEN-WP-0044-security-case-follow-through.md
ops-mason|security.structure-construction|Reviewed security structure construction|A2|2|Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply|Founder plan gate is an explicit exception; not full PDP conformance|U01 U05 U06|SCOPE.md;docs/construction-plan-format.md
ops-bridge|ops.tunnel-bridge|SSH tunnel lifecycle|A2|3|Named tunnels, reconnect, health and TTL-aware cert_command|Private transport does not authenticate applications or decide access|U06|SCOPE.md
audit-core|audit.event-retain|Independent audit custody|A4|3|Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation|Custody after arrival does not prove source completeness; freshness bounds integrity assertions|U08 U09 U10|SCOPE.md;docs/stream-completeness.md
maturity-engine|security.maturity-claims|Evidence-based maturity claims and gap register|A2|2|SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory|No production deployment claimed; levels supply facts and cannot authorize actions|U09 U14|SCOPE.md;docs/claim-contract.md
kings-guard|security.posture-assessment|Security posture assessment and response proposals|A2|2|Normalized observation evaluator, cadence checks and secret-use snapshot adapter|Bounded reference pilot; containment proposals only; deployed-stream admission remains open|U08 U09|SCOPE.md;docs/SecretUseSnapshotAdmission.md
whitehat-security|security.adversarial-evidence|Authorized adversarial evidence harness|A2|2|Offline ASM and tenancy calibrations and engagement admission|Live probes require a complete engagement; no blanket target authorization|U03 U08 U10 U14|SCOPE.md;README.md
gate-house|security.doctrine-review|Security doctrine and architecture review|A0|3|Layer rules, authority context, ASM criteria and interpretations|Staff judgment; no runtime PDP, credential issuer or automatic enforcement|U01 U09 U14|SCOPE.md;INTENT.md
emergent-security|security.agent-knowledge|Verified security orientation for agents|A2|2|Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports|Current start card withheld for source drift; orientation never grants authority|U01 U11 U14|SCOPE.md;knowledge/cards/start.md
informed-decision|security.human-decision-workspace|Human security decision presentation and disposition|A4|3|Headless lifecycle and browser workspace with exact native approval references|Initial audience is bounded; Approval Engine owns approval state, Access Engine decides|U04 U05 U09|SCOPE.md;README.md
policy-nexus|security.policy-publication|Policy publication with source provenance|A2|3|Generated immutable publication, source currency and stable policy URLs|Publication does not ratify policy or enforce it|U01 U09 U14|README.md;docs/publication-contract.md
risk-nexus|security.risk-register|Security risk and exception review register|A2|2|Markdown findings and Python review, verification and due-work reports|Judgment remains human or agent; no live EUR risk gate or autonomous response|U09 U14|SCOPE.md
role-engine|organization.role-catalog|Organizational role definitions|A0|1|Versioned documentation catalog|Not IAM roles, assignments or runtime authorization|U01 U11|README.md;INTENT.md
glas-harness|execution.profile-harness|Profile-bound agent execution lifecycle|A3|2|Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration|No ready profile asserted by SCOPE; Custodian native isolation remains open|U11|SCOPE.md;README.md
sand-boxer|execution.sandbox-provision|Sandbox establishment and lifecycle|A5|2|Profiles, extensions, provision, checkpoints, TTL teardown and telemetry|Backend-specific guarantees; a created sandbox alone proves no credential isolation|U11 U14|SCOPE.md;README.md
rein-aharness|execution.scheduled-agent-rein|Scheduled agent intake and harness routing|A2|3|Activity Core lease claim/heartbeat and Glas profile execution|Legacy paths are time-gated; task success is not privileged authority|U09 U11|SCOPE.md;README.md
rein-openweights|execution.openweight-rein|Bounded open-weight agent execution|A2|2|Tool loop, path guards, turn/budget limits and verified-commit result|Provider credential acquisition and runtime authority need separate custody controls|U11|SCOPE.md;README.md
agentic-resources|agents.performance-learning|Agent performance learning|A2|2|Capture sessions, curate patterns, distribute lessons and measure outcomes|Workforce assignments and broader authority contracts remain proposed|U09 U11|SCOPE.md
runbook-tutorials|infotech.runbook-tutorials|Guided administrative runbooks|A2|2|Pack schema, loader, local UI/CLI, gates, verification and rollback evidence|Owner supplies procedures; UI progress is not runtime approval|U05 U10 U14|SCOPE.md;docs/pack-spec.md
repo-manager|security.repository-secret-prevention|Repository metadata and staged-secret prevention|A2|3|Repository observation plus pinned staged-blob scanner and hook integration|Local hooks are bypassable; coverage is exact-checkout scoped|U07 U12|SCOPE.md;README.md
sbom-nexus|infotech.sbom-management|Dependency provenance and SBOM evidence|A4|3|Controlled archive ingest, immutable snapshots, freshness and license review|SBOM and license evidence do not prove vulnerability exploitability or artifact trust|U12 U09|README.md
activity-core|activity.event-coordinate|Durable automation and bounded operations|A4|3|Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks|Not a general shell executor; first unassisted security-flow cadence acceptance remains open|U09 U12|SCOPE.md;README.md
issue-core|infotech.issue-tracking|External issue tracker connector|A2|2|CLI and Python adapters for external issue systems|Internal work originates in owner files; external projection is optional|U09|README.md
state-hub|statehub.workstream-coordinate|Cross-repository work tracking|A4|3|File-derived workplans, tasks, dependencies, decisions and coordination views|Read/cache/index of owner work; not runtime approval authority|U09|README.md;SCOPE.md
state-hub|statehub.progress-log|Progress and work evidence indexing|A4|3|REST progress and task evidence references|Not independent security event custody|U08 U09|README.md;SCOPE.md
the-custodian|agents.custodian-runtime-tooling|Generic agent runtime and repository tooling|A2|2|Agent runtime modules and repository classification tooling|Only generic tooling is reusable; confidential canon and session memory are excluded|U09 U11 U14|runtime/README.md
coordination-engine|coordination.cross-owner-work|Cross-owner coordination lifecycle|A2|2|Observation, lease, wake-up, checkpoint and receipt contracts/runtime|Coordinates owners without replacing their execution or security authority|U09|SCOPE.md;spec/cross-owner-wait-mode-v0.1.md
reuse-surface|registry.register|Capability registry and federation|A3|3|Owner Markdown entries, indexes, federation hub and planning queries|Discovery is not readiness; empty and stale entries need evidence-led maintenance|U01 U09 U14|docs/RegistryFederation.md;specs/CapabilityMaturityStandard.md
reuse-surface|registry.validate|Capability registry validation|A3|3|Schema, index consistency and relation checks|Schema validity alone proves neither capability behavior nor hosted freshness|U01 U14|docs/RegistryFederation.md;schemas/capability.schema.yaml
info-tech-canon|infotech.canon-service|Shared semantic contracts and validation|A4|2|Markdown canon with library, CLI and read-only API|Mixed seed/candidate maturity; validation is not owner runtime conformance|U01 U08 U14|SCOPE.md
railiance-master|railiance.security-consumption-contracts|Platform security consumption architecture|A0|2|Rail/rapp/reef boundaries, exposure and security consumption contracts|Architecture declarations do not prove implementation or production admission|U01 U13 U14|SCOPE.md;docs/netkingdom-security-consumption-contract.md
railiance-platform|railiance.platform-services|Secret custody and platform data services|A2|3|OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts|Package ownership is split to rapp repos; caches and object services are demand-led|U04 U05 U07 U10 U13|SCOPE.md;docs/openbao.md
railiance-infra|railiance.infra-provisioning|Host convergence and security baseline|A2|3|Ansible inventory, firewall, SSH bootstrap and baseline verification|Current hosts differ from the retained Hetzner provisioning path|U06 U10 U13|SCOPE.md
railiance-cluster|railiance.cluster-bootstrap|Kubernetes runtime and cluster controls|A2|3|k3s, ingress, CNI, operators and kubeconfig/runtime checks|Single-node runtime and workload recovery are distinct from bootstrap success|U10 U13|SCOPE.md
railiance-enablement|railiance.ci-enablement|Developer delivery and CI templates|A2|2|Reusable CI workflows, build and deployment patterns|Templates do not prove mandatory checks or runner isolation|U12 U14|SCOPE.md
railiance-forge|railiance.forge-infrastructure|Source forge, registries and runner substrate|A2|3|Forgejo operation, package registries and runner lifecycle|Runner workload authority and independent verification coverage remain open|U12|SCOPE.md;workplans/FORGE-WP-0006-independent-secret-detection.md
railiance-forge|security.forge-secret-prevention|Independent introduced-history secret prevention|A2|3|Pinned receive adapter, lifecycle template and fail-closed scan|Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate|U07 U12|workplans/FORGE-WP-0006-independent-secret-detection.md
railiance-apps|railiance.workload-deployment-tooling|Workload release configuration and guards|A2|3|Helm/manifests, exact image pins, application runbooks and rollout/rollback|Release settings depend on underlying platform and workload owners|U12 U13|SCOPE.md
railiance-bootstrap|railiance.bootstrap-sequencing|Bootstrap sequencing contracts|A0|1|Bare-VM to estate sequence and handoff contract|End-to-end unattended rebuild is not established|U10 U14|SCOPE.md
rail-kubernetes|railiance.kubernetes-rail|Generic Kubernetes workload lifecycle|A2|2|Workload declaration, rollout, observe, promote and rollback surfaces|Compatibility extraction remains; not cluster or application-domain ownership|U13 U14|SCOPE.md
reef-railiance|railiance.substrate-bindings|Substrate topology and bindings|A0|2|Grouped home-reef identity, topology and placement declarations|Declarations are not automatic placement or authorization|U13 U14|SCOPE.md
railiance-fabric|railiance.fabric-graph|Infrastructure ownership and dependency graph|A2|2|Schemas, validation, graph queries and State Hub exports|Graph assertions need current owner evidence; not an enforcement registry|U09 U13 U14|SCOPE.md
rapp-openbao|railiance.openbao-package|Managed OpenBao deployment package|A2|3|Helm values, package deploy/status/smoke/rollback and custody boundary|Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit|U04 U10 U13|README.md;docs/retained-s3-handoff.md
rapp-postgres|railiance.postgres-isolation-recovery|Database isolation and recovery package|A2|3|CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures|Host-loss proof and consumer schemas stay with their owners|U03 U10 U13|SCOPE.md
rapp-user-engine|railiance.user-engine-package|User Engine runtime package|A2|3|Pinned deployment, dedicated CNPG, ExternalSecret references and rollback|Domain, identity, PDP and custody authority are separate|U02 U10 U13|SCOPE.md
rapp-tenant-engine|railiance.tenant-engine-package|Tenant Engine runtime package|A2|2|Package declaration, smoke and rollback|No tenant-domain ownership or credential values|U03 U13|SCOPE.md
rapp-policy-nexus|railiance.policy-publication-package|Policy publication runtime package|A2|3|Immutable image, non-root/read-only runtime and approved TLS exposure|No policy authoring or DNS/issuer administration|U01 U13|SCOPE.md
rapp-playwright|railiance.browser-verification|Managed browser verification pilot|A4|2|Bounded jobs, cancellation, artifacts, origin checks and restart receipts|Pilot deployed; human/agent authentication and per-caller self-service connectivity pending|U02 U14|SCOPE.md
railiance-telemetry|observability.security-signals|Security-relevant telemetry contracts and adapters|A2|2|Signal contract, platform adapters, report exporter and absence/alert rules|Reference receiver is not a second production plane; end-to-end delivery acceptance pending|U08 U09|SCOPE.md;README.md
rapp-telemetry|railiance.telemetry-package|Private monitoring package|A2|2|Prometheus, Alertmanager and Grafana package with isolated restore evidence|Private installation only; recurring recovery capture and audited confirmation pending|U08 U09 U10|SCOPE.md
resource-control|resources.security-capacity|Capacity and recovery resource planning|A2|2|Provider-neutral inventory, procurement evidence and optimization reports|No payment authority or irreversible procurement; metrics do not prove usable runtime capacity|U09 U10 U13|SCOPE.md
fin-hub|finance.security-budget-evidence|Budget and cost evidence for security operations|A4|2|Budget, commitment, spend attribution and planning-evidence consumption|No verified concurrent runtime EUR risk/cost enforcement for agents|U09 U11|SCOPE.md
'''
rows=[]
for line in DATA.strip().splitlines():
repo,suffix,name,a,op,surface,limit,ucs,arts=line.split('|')
rows.append(dict(repo=repo,id='capability.'+suffix,name=name,availability=a,operational_estimate=int(op),surface=surface,limitation=limit,use_cases=ucs.split(),artifacts=arts.split(';')))
# Source and current registry evidence, content hashes only (never credentials).
repos={}
for repo in sorted({r['repo'] for r in rows}):
root=BASE/repo
def git(*args):
p=subprocess.run(['git','-C',str(root),*args],capture_output=True,text=True);return p.stdout.strip()
ix=root/'registry/indexes/capabilities.yaml'
index=yaml.safe_load(ix.read_text()) if ix.exists() else {}
sources=sorted(set(['INTENT.md','SCOPE.md','README.md']+[a for r in rows if r['repo']==repo for a in r['artifacts']]))
hashes={p:'sha256:'+hashlib.sha256((root/p).read_bytes()).hexdigest() for p in sources if (root/p).is_file()}
missing=[p for r in rows if r['repo']==repo for p in r['artifacts'] if not (root/p).is_file()]
repos[repo]={'head':git('rev-parse','HEAD'),'branch':git('branch','--show-current'),'dirty_paths':git('status','--short').splitlines(),'source_sha256':hashes,'missing_review_artifacts':missing,'existing_index':index}
for r in [x for x in rows if x['repo']==repo]:
old=next((c for c in (index or {}).get('capabilities',[]) if c.get('id')==r['id']),None)
r['existing_entry_path']=old.get('path') if old else None
r['prior_vector']=old.get('vector') if old else None
r['vector']='D3 / '+r['availability']+' / C1 / R0'
(OUT/'inventory.json').write_text(json.dumps({'as_of':'2026-10-14','capabilities':rows,'repositories':repos},indent=2)+'\n')
print(json.dumps({'repos':len(repos),'capabilities':len(rows),'existing':sum(bool(r['existing_entry_path']) for r in rows),'missing_artifacts':{k:v['missing_review_artifacts'] for k,v in repos.items() if v['missing_review_artifacts']}},indent=2))

504
docs/assessments/netkingdom-2026-10-14/capability-inventory.md Normal file
View file

@ -0,0 +1,504 @@
# NetKingdom repository and capability inventory
Assessed 2026-10-14. See the [architecture review](../../netkingdom-security-architecture-review.md) for use cases U01–U14, evidence rules, operational maturity M1–M5 and D/A/C/R definitions. Existing external evidence levels are owner claims, not newly certified scores.
**60 capability-owning repositories, 70 reviewed capabilities, plus two inspected nonproviders.**
## access-engine
Source revision `16ca97b2776789f730cc7049a2d6533612faaccd`. [Owner scope](../../../../access-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Policy evaluation and decision evidence](../../../../access-engine/SCOPE.md)<br>`capability.authorization.policy-evaluate` | Check, batch, list-allowed, explain, binding, lifetime and decision records.<br>U03, U04, U05, U06 | D4 / A4 / C2 / R1<br>M3 estimate | One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct. |
## activity-core
Source revision `83e6446807c4b36f3aa5023a5c16d4c7df8bd3df`. [Owner scope](../../../../activity-core/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Durable automation and bounded operations](../../../../activity-core/SCOPE.md)<br>`capability.activity.event-coordinate` | Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.<br>U09, U12 | D3 / A4 / C1 / R0<br>M3 estimate | Not a general shell executor; first unassisted security-flow cadence acceptance remains open. |
## agentic-resources
Source revision `65b3a5cb6bf3eb214b492b95a38f2eb729f89709`. [Owner scope](../../../../agentic-resources/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Agent performance learning](../../../../agentic-resources/SCOPE.md)<br>`capability.agents.performance-learning` | Capture sessions, curate patterns, distribute lessons and measure outcomes.<br>U09, U11 | D3 / A2 / C1 / R0<br>M2 estimate | Workforce assignments and broader authority contracts remain proposed. |
## approval-engine
Source revision `e1649617e8ad321f79632d5fd33e973ae5d5ae51`. [Owner scope](../../../../approval-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Bound approval lifecycle](../../../../approval-engine/SCOPE.md)<br>`capability.security.approval-lifecycle` | Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.<br>U04, U05, U06 | D3 / A4 / C1 / R0<br>M2 estimate | Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open. |
## audit-core
Source revision `f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9`. [Owner scope](../../../../audit-core/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Independent audit custody](../../../../audit-core/SCOPE.md)<br>`capability.audit.event-retain` | Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.<br>U08, U09, U10 | D3 / A4 / C3 / R2<br>M3 estimate | Custody after arrival does not prove source completeness; freshness bounds integrity assertions. |
## coordination-engine
Source revision `c401067842072b75717f76480dd6e7db1836059c`. [Owner scope](../../../../coordination-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Cross-owner coordination lifecycle](../../../../coordination-engine/SCOPE.md)<br>`capability.coordination.cross-owner-work` | Observation, lease, wake-up, checkpoint and receipt contracts/runtime.<br>U09 | D3 / A2 / C1 / R0<br>M2 estimate | Coordinates owners without replacing their execution or security authority. |
## emergent-security
Source revision `4c6fda38298fa50665ead41526b893adf069d335`. [Owner scope](../../../../emergent-security/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Verified security orientation for agents](../../../../emergent-security/SCOPE.md)<br>`capability.security.agent-knowledge` | Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports.<br>U01, U11, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Current start card withheld for source drift; orientation never grants authority. |
## fin-hub
Source revision `8f527c6705bbf5d7ffed43559411ca748bec8fe4`. [Owner scope](../../../../fin-hub/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Budget and cost evidence for security operations](../../../../fin-hub/SCOPE.md)<br>`capability.finance.security-budget-evidence` | Budget, commitment, spend attribution and planning-evidence consumption.<br>U09, U11 | D3 / A4 / C1 / R0<br>M2 estimate | No verified concurrent runtime EUR risk/cost enforcement for agents. |
## gate-house
Source revision `bc890c4d050a2e726ce8988a8260ab9caea133e3`. [Owner scope](../../../../gate-house/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security doctrine and architecture review](../../../../gate-house/SCOPE.md)<br>`capability.security.doctrine-review` | Layer rules, authority context, ASM criteria and interpretations.<br>U01, U09, U14 | D3 / A0 / C1 / R0<br>M3 estimate | Staff judgment; no runtime PDP, credential issuer or automatic enforcement. |
## glas-harness
Source revision `7b1557ba14f483569b90ebfdc2d0136fa69602fe`. [Owner scope](../../../../glas-harness/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Profile-bound agent execution lifecycle](../../../../glas-harness/SCOPE.md)<br>`capability.execution.profile-harness` | Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration.<br>U11 | D3 / A3 / C1 / R0<br>M2 estimate | No ready profile asserted by SCOPE; Custodian native isolation remains open. |
## info-tech-canon
Source revision `3d206a56f4ece439f6ee87f9ee4d1800ab82166e`. [Owner scope](../../../../info-tech-canon/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Shared semantic contracts and validation](../../../../info-tech-canon/SCOPE.md)<br>`capability.infotech.canon-service` | Markdown canon with library, CLI and read-only API.<br>U01, U08, U14 | D2 / A4 / C1 / R0<br>M2 estimate | Mixed seed/candidate maturity; validation is not owner runtime conformance. |
## informed-decision
Source revision `ee6a65b80a0fea1a914dfa31434b903669656c09`. [Owner scope](../../../../informed-decision/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Human security decision presentation and disposition](../../../../informed-decision/SCOPE.md)<br>`capability.security.human-decision-workspace` | Headless lifecycle and browser workspace with exact native approval references.<br>U04, U05, U09 | D3 / A4 / C1 / R0<br>M3 estimate | Initial audience is bounded; Approval Engine owns approval state, Access Engine decides. |
## issue-core
Source revision `de368271f6ffc06353ec409998a0d6d0ec0bf25e`. [Owner scope](../../../../issue-core/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [External issue tracker connector](../../../../issue-core/README.md)<br>`capability.infotech.issue-tracking` | CLI and Python adapters for external issue systems.<br>U09 | D4 / A2 / C2 / R1<br>M2 estimate | Internal work originates in owner files; external projection is optional. |
## key-cape
Source revision `1344fc80e56315c5c99f58993f9ee02ce79e8a76`. [Owner scope](../../../../key-cape/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [OIDC identity and assurance](../../../../key-cape/SCOPE.md)<br>`capability.iam.key-cape` | OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.<br>U02, U03, U04, U10 | D4 / A4 / C2 / R1<br>M3 estimate | Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates. |
## kings-guard
Source revision `af02e2547598d6ec0e83f482d9ea3ef943ea67b7`. [Owner scope](../../../../kings-guard/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security posture assessment and response proposals](../../../../kings-guard/SCOPE.md)<br>`capability.security.posture-assessment` | Normalized observation evaluator, cadence checks and secret-use snapshot adapter.<br>U08, U09 | D3 / A2 / C1 / R0<br>M2 estimate | Bounded reference pilot; containment proposals only; deployed-stream admission remains open. |
## maturity-engine
Source revision `2f1de542cc8f24a79452f906d99f95be39d8b6a9`. [Owner scope](../../../../maturity-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Evidence-based maturity claims and gap register](../../../../maturity-engine/SCOPE.md)<br>`capability.security.maturity-claims` | SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory.<br>U09, U14 | D3 / A2 / C1 / R0<br>M2 estimate | No production deployment claimed; levels supply facts and cannot authorize actions. |
## net-kingdom
Source revision `1a36e857cc5aae6fe738f794417126c46dd94627`. [Owner scope](../../../../net-kingdom/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [NetKingdom security architecture and conformance tooling](../../../../net-kingdom/SCOPE.md)<br>`capability.security.iam-tooling-suite` | Versioned IAM, layer, tenancy and credential contracts plus validators.<br>U01, U02, U03, U14 | D3 / A2 / C1 / R1<br>M2 estimate | Mixed accepted and proposed standards; framework integration remains incomplete. |
| [Deterministic security scenario composition](../../../../net-kingdom/tools/security-scenario-composer/README.md)<br>`capability.security.scenario-compose` | CLI selects pinned providers and orders trust transitions.<br>U01, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Plan only; execution.permitted is always false. |
| [Deterministic posture feedback](../../../../net-kingdom/tools/posture-feedback/README.md)<br>`capability.security.posture-feedback` | CLI evaluates evidence age and posture into owner-routed findings.<br>U09, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Proposal only; no policy changes or remediation execution. |
| [Security case types and instance validation](../../../../net-kingdom/tools/security-case-types/README.md)<br>`capability.security.case-contracts` | Versioned types, cases and schema validation.<br>U01, U05, U06 | D3 / A2 / C1 / R0<br>M2 estimate | Type acknowledgment, case acceptance, structural materialization and native execution are distinct. |
| [Guarded bootstrap and recovery preparation](../../../../net-kingdom/tools/security-bootstrap-console/README.md)<br>`capability.security.bootstrap-recovery` | Local identity, bootstrap console, encrypted custody handoff and caller tools.<br>U10 | D3 / A2 / C1 / R0<br>M2 estimate | Source repairs and disposable native fixtures do not prove estate root isolation or recovery. |
| [Security emission cadence validation](../../../../net-kingdom/tools/emission-cadence-profile/README.md)<br>`capability.security.emission-profile` | Security profile over generic emission contracts and validator.<br>U08, U09 | D3 / A2 / C1 / R0<br>M2 estimate | Profile adoption and source completeness require owner-native evidence. |
## ops-bridge
Source revision `190ef1e188e12c606f1359325fd9fdd1dbef29e2`. [Owner scope](../../../../ops-bridge/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [SSH tunnel lifecycle](../../../../ops-bridge/SCOPE.md)<br>`capability.ops.tunnel-bridge` | Named tunnels, reconnect, health and TTL-aware cert_command.<br>U06 | D3 / A2 / C2 / R1<br>M3 estimate | Private transport does not authenticate applications or decide access. |
## ops-mason
Source revision `d86ad141befb6800468f5132d4c7c9ce2f852bb5`. [Owner scope](../../../../ops-mason/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Reviewed security structure construction](../../../../ops-mason/SCOPE.md)<br>`capability.security.structure-construction` | Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.<br>U01, U05, U06 | D3 / A2 / C1 / R0<br>M2 estimate | Founder plan gate is an explicit exception; not full PDP conformance. |
## ops-warden
Source revision `6d2f1be9691b19e826898a2166ae4451e4802ae2`. [Owner scope](../../../../ops-warden/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Decision-bound SSH certificates](../../../../ops-warden/SCOPE.md)<br>`capability.security.ssh-certificate-issuance` | warden sign with local and OpenBao backends and adm/agt/atm actors.<br>U06 | D4 / A3 / C3 / R2<br>M3 estimate | Direct Tooling contact is a declared gap; certificate reachability is not target authorization. |
| [Credential routing and contained access](../../../../ops-warden/SCOPE.md)<br>`capability.security.access-routing` | warden route and access catalog; exact lane conduit and secret-exec routing.<br>U04, U05, U06 | D3 / A3 / C1 / R0<br>M3 estimate | Routing grants no authority; interim delegates and attended high-risk lanes persist. |
| [Security case operational follow-through](../../../../ops-warden/workplans/WARDEN-WP-0044-security-case-follow-through.md)<br>`capability.security.case-follow-through` | KnownSecurityCase route, plan and operational receipts.<br>U01, U05, U06 | D3 / A2 / C1 / R0<br>M2 estimate | Execution requires accepted structure and exact owner contracts; case closure is not automatic. |
## policy-nexus
Source revision `f784f017b0822f34c785f0b34c7c55fcf39c9d99`. [Owner scope](../../../../policy-nexus/README.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Policy publication with source provenance](../../../../policy-nexus/README.md)<br>`capability.security.policy-publication` | Generated immutable publication, source currency and stable policy URLs.<br>U01, U09, U14 | D3 / A2 / C1 / R0<br>M3 estimate | Publication does not ratify policy or enforce it. |
## rail-knative
Source revision `cd38dba3653e7fc85d3b2d3a074811b9a7216f25`. [Owner scope](../../../../rail-knative/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Knative workload lifecycle](../../../../rail-knative/SCOPE.md)<br>`capability.railiance.knative-rail` | Derived rail for activation, revisions, traffic, scaling and rollback.<br>U09, U13, U14 | D3 / A2 / C1 / R0<br>M3 estimate | Inherits Kubernetes common contract; verified readiness is not production approval. |
## rail-kubernetes
Source revision `35159e49c1340b7a0e30c49188975c8839d346f6`. [Owner scope](../../../../rail-kubernetes/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Generic Kubernetes workload lifecycle](../../../../rail-kubernetes/SCOPE.md)<br>`capability.railiance.kubernetes-rail` | Workload declaration, rollout, observe, promote and rollback surfaces.<br>U13, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Compatibility extraction remains; not cluster or application-domain ownership. |
## railiance-apps
Source revision `706461b845086ee2df8ce9acae3dae7feebfffda`. [Owner scope](../../../../railiance-apps/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Workload release configuration and guards](../../../../railiance-apps/SCOPE.md)<br>`capability.railiance.workload-deployment-tooling` | Helm/manifests, exact image pins, application runbooks and rollout/rollback.<br>U12, U13 | D3 / A2 / C1 / R1<br>M3 estimate | Release settings depend on underlying platform and workload owners. |
## railiance-bootstrap
Source revision `ae00b2652737aaf18358431e66f59eeb7c01e16b`. [Owner scope](../../../../railiance-bootstrap/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Bootstrap sequencing contracts](../../../../railiance-bootstrap/SCOPE.md)<br>`capability.railiance.bootstrap-sequencing` | Bare-VM to estate sequence and handoff contract.<br>U10, U14 | D3 / A0 / C1 / R0<br>M1 estimate | End-to-end unattended rebuild is not established. |
## railiance-cluster
Source revision `12d1e881ff2086566712fbc591db293b38ea2bcf`. [Owner scope](../../../../railiance-cluster/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Kubernetes runtime and cluster controls](../../../../railiance-cluster/SCOPE.md)<br>`capability.railiance.cluster-bootstrap` | k3s, ingress, CNI, operators and kubeconfig/runtime checks.<br>U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Single-node runtime and workload recovery are distinct from bootstrap success. |
## railiance-enablement
Source revision `51a7c4cee68b48ed7a236e661b39c1d3cca92063`. [Owner scope](../../../../railiance-enablement/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Developer delivery and CI templates](../../../../railiance-enablement/SCOPE.md)<br>`capability.railiance.ci-enablement` | Reusable CI workflows, build and deployment patterns.<br>U12, U14 | D3 / A2 / C2 / R1<br>M2 estimate | Templates do not prove mandatory checks or runner isolation. |
## railiance-fabric
Source revision `96d19127125e85bdab7ff0ff79fc3ecf7d19045e`. [Owner scope](../../../../railiance-fabric/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Infrastructure ownership and dependency graph](../../../../railiance-fabric/SCOPE.md)<br>`capability.railiance.fabric-graph` | Schemas, validation, graph queries and State Hub exports.<br>U09, U13, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Graph assertions need current owner evidence; not an enforcement registry. |
## railiance-forge
Source revision `a15fac8e938c11b041eb39386f05b63d46ae566a`. [Owner scope](../../../../railiance-forge/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Source forge, registries and runner substrate](../../../../railiance-forge/SCOPE.md)<br>`capability.railiance.forge-infrastructure` | Forgejo operation, package registries and runner lifecycle.<br>U12 | D3 / A2 / C1 / R0<br>M3 estimate | Runner workload authority and independent verification coverage remain open. |
| [Independent introduced-history secret prevention](../../../../railiance-forge/workplans/FORGE-WP-0006-independent-secret-detection.md)<br>`capability.security.forge-secret-prevention` | Pinned receive adapter, lifecycle template and fail-closed scan.<br>U07, U12 | D3 / A2 / C1 / R0<br>M3 estimate | Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate. |
## railiance-infra
Source revision `ef64e324b61e9aa9b9ed03aad7dd2101915057ca`. [Owner scope](../../../../railiance-infra/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Host convergence and security baseline](../../../../railiance-infra/SCOPE.md)<br>`capability.railiance.infra-provisioning` | Ansible inventory, firewall, SSH bootstrap and baseline verification.<br>U06, U10, U13 | D4 / A2 / C2 / R1<br>M3 estimate | Current hosts differ from the retained Hetzner provisioning path. |
## railiance-master
Source revision `865c3bed86b3992244b29d6f1d6b8ebbe8db78c7`. [Owner scope](../../../../railiance-master/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Platform security consumption architecture](../../../../railiance-master/SCOPE.md)<br>`capability.railiance.security-consumption-contracts` | Rail/rapp/reef boundaries, exposure and security consumption contracts.<br>U01, U13, U14 | D3 / A0 / C1 / R0<br>M2 estimate | Architecture declarations do not prove implementation or production admission. |
## railiance-platform
Source revision `d303c99e3be993ffa989bc9ba3d7b471903858ce`. [Owner scope](../../../../railiance-platform/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Secret custody and platform data services](../../../../railiance-platform/SCOPE.md)<br>`capability.railiance.platform-services` | OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.<br>U04, U05, U07, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Package ownership is split to rapp repos; caches and object services are demand-led. |
## railiance-telemetry
Source revision `81d905971c38de9aaf11088ba605e112152d8268`. [Owner scope](../../../../railiance-telemetry/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security-relevant telemetry contracts and adapters](../../../../railiance-telemetry/SCOPE.md)<br>`capability.observability.security-signals` | Signal contract, platform adapters, report exporter and absence/alert rules.<br>U08, U09 | D3 / A2 / C1 / R0<br>M2 estimate | Reference receiver is not a second production plane; end-to-end delivery acceptance pending. |
## rapp-openbao
Source revision `13ab9144bbb1d88fe760362df91a83c8b34e4e66`. [Owner scope](../../../../rapp-openbao/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Managed OpenBao deployment package](../../../../rapp-openbao/README.md)<br>`capability.railiance.openbao-package` | Helm values, package deploy/status/smoke/rollback and custody boundary.<br>U04, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit. |
## rapp-playwright
Source revision `2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. [Owner scope](../../../../rapp-playwright/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Managed browser verification pilot](../../../../rapp-playwright/SCOPE.md)<br>`capability.railiance.browser-verification` | Bounded jobs, cancellation, artifacts, origin checks and restart receipts.<br>U02, U14 | D3 / A4 / C1 / R0<br>M2 estimate | Pilot deployed; human/agent authentication and per-caller self-service connectivity pending. |
## rapp-policy-nexus
Source revision `d3fee97d32ad47e3a7e3201a9c5b7209b4333fda`. [Owner scope](../../../../rapp-policy-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Policy publication runtime package](../../../../rapp-policy-nexus/SCOPE.md)<br>`capability.railiance.policy-publication-package` | Immutable image, non-root/read-only runtime and approved TLS exposure.<br>U01, U13 | D3 / A2 / C1 / R0<br>M3 estimate | No policy authoring or DNS/issuer administration. |
## rapp-postgres
Source revision `03744030c9258e920f6403a9ce184a26d7b75268`. [Owner scope](../../../../rapp-postgres/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Database isolation and recovery package](../../../../rapp-postgres/SCOPE.md)<br>`capability.railiance.postgres-isolation-recovery` | CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures.<br>U03, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Host-loss proof and consumer schemas stay with their owners. |
## rapp-sbom-nexus
Source revision `1566bcf69fc0757db5efc67f78b14af10d944c1b`. [Owner scope](../../../../rapp-sbom-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Private SBOM runtime and dynamic database delivery](../../../../rapp-sbom-nexus/SCOPE.md)<br>`capability.railiance.sbom-runtime-package` | Immutable deployment, private network policy, dynamic database leases and migration/rollback.<br>U07, U12, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Product owns schema and ingestion; database and backup authority remain with platform owners. |
## rapp-telemetry
Source revision `17053dbc47f7c22efd67fd90d06d108d154835fa`. [Owner scope](../../../../rapp-telemetry/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Private monitoring package](../../../../rapp-telemetry/SCOPE.md)<br>`capability.railiance.telemetry-package` | Prometheus, Alertmanager and Grafana package with isolated restore evidence.<br>U08, U09, U10 | D3 / A2 / C1 / R0<br>M2 estimate | Private installation only; recurring recovery capture and audited confirmation pending. |
## rapp-tenant-engine
Source revision `c160be23577ab4d99ee2cd008deb455b07f0597d`. [Owner scope](../../../../rapp-tenant-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Tenant Engine runtime package](../../../../rapp-tenant-engine/SCOPE.md)<br>`capability.railiance.tenant-engine-package` | Package declaration, smoke and rollback.<br>U03, U13 | D3 / A2 / C1 / R0<br>M2 estimate | No tenant-domain ownership or credential values. |
## rapp-user-engine
Source revision `15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c`. [Owner scope](../../../../rapp-user-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [User Engine runtime package](../../../../rapp-user-engine/SCOPE.md)<br>`capability.railiance.user-engine-package` | Pinned deployment, dedicated CNPG, ExternalSecret references and rollback.<br>U02, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Domain, identity, PDP and custody authority are separate. |
## reef-railiance
Source revision `ffb9e272ce1489cc37cc6388873558d8ba56c239`. [Owner scope](../../../../reef-railiance/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Substrate topology and bindings](../../../../reef-railiance/SCOPE.md)<br>`capability.railiance.substrate-bindings` | Grouped home-reef identity, topology and placement declarations.<br>U13, U14 | D3 / A0 / C1 / R0<br>M2 estimate | Declarations are not automatic placement or authorization. |
## rein-aharness
Source revision `398949a3d34b6c9faae0fa1d0ff0aa039565aa42`. [Owner scope](../../../../rein-aharness/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Scheduled agent intake and harness routing](../../../../rein-aharness/SCOPE.md)<br>`capability.execution.scheduled-agent-rein` | Activity Core lease claim/heartbeat and Glas profile execution.<br>U09, U11 | D3 / A2 / C1 / R0<br>M3 estimate | Legacy paths are time-gated; task success is not privileged authority. |
## rein-openweights
Source revision `e1fccb39b738a5381a9de6e1d799f124797798ce`. [Owner scope](../../../../rein-openweights/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Bounded open-weight agent execution](../../../../rein-openweights/SCOPE.md)<br>`capability.execution.openweight-rein` | Tool loop, path guards, turn/budget limits and verified-commit result.<br>U11 | D3 / A2 / C1 / R0<br>M2 estimate | Provider credential acquisition and runtime authority need separate custody controls. |
## repo-manager
Source revision `7677b00f69cd6362ac16a1021dc180ec6df4ebfa`. [Owner scope](../../../../repo-manager/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Repository metadata and staged-secret prevention](../../../../repo-manager/SCOPE.md)<br>`capability.security.repository-secret-prevention` | Repository observation plus pinned staged-blob scanner and hook integration.<br>U07, U12 | D3 / A2 / C1 / R0<br>M3 estimate | Local hooks are bypassable; coverage is exact-checkout scoped. |
## resource-control
Source revision `3604d468f86ede7d320f4d22dd4aea775306b53f`. [Owner scope](../../../../resource-control/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Capacity and recovery resource planning](../../../../resource-control/SCOPE.md)<br>`capability.resources.security-capacity` | Provider-neutral inventory, procurement evidence and optimization reports.<br>U09, U10, U13 | D3 / A2 / C1 / R0<br>M2 estimate | No payment authority or irreversible procurement; metrics do not prove usable runtime capacity. |
## reuse-surface
Source revision `a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1`. [Owner scope](../../../../reuse-surface/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Capability registry and federation](../../../../reuse-surface/docs/RegistryFederation.md)<br>`capability.registry.register` | Owner Markdown entries, indexes, federation hub and planning queries.<br>U01, U09, U14 | D3 / A3 / C2 / R3<br>M3 estimate | Discovery is not readiness; empty and stale entries need evidence-led maintenance. |
| [Capability registry validation](../../../../reuse-surface/docs/RegistryFederation.md)<br>`capability.registry.validate` | Schema, index consistency and relation checks.<br>U01, U14 | D4 / A3 / C3 / R3<br>M3 estimate | Schema validity alone proves neither capability behavior nor hosted freshness. |
## risk-nexus
Source revision `b877231d66e1289dc32fda07ed2c61dcb3e970dc`. [Owner scope](../../../../risk-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security risk and exception review register](../../../../risk-nexus/SCOPE.md)<br>`capability.security.risk-register` | Markdown findings and Python review, verification and due-work reports.<br>U09, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Judgment remains human or agent; no live EUR risk gate or autonomous response. |
## role-engine
Source revision `d231241dbfeeb541b34243f4022883aa6417a1eb`. [Owner scope](../../../../role-engine/README.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Organizational role definitions](../../../../role-engine/README.md)<br>`capability.organization.role-catalog` | Versioned documentation catalog.<br>U01, U11 | D3 / A0 / C1 / R0<br>M1 estimate | Not IAM roles, assignments or runtime authorization. |
## runbook-tutorials
Source revision `df97fadf5decfcdb5c3c6ab90211226335ffdf8e`. [Owner scope](../../../../runbook-tutorials/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Guided administrative runbooks](../../../../runbook-tutorials/SCOPE.md)<br>`capability.infotech.runbook-tutorials` | Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.<br>U05, U10, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Owner supplies procedures; UI progress is not runtime approval. |
## sand-boxer
Source revision `b06d94f02b037764ff41c73c8ab43f4c8f5d309d`. [Owner scope](../../../../sand-boxer/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Sandbox establishment and lifecycle](../../../../sand-boxer/SCOPE.md)<br>`capability.execution.sandbox-provision` | Profiles, extensions, provision, checkpoints, TTL teardown and telemetry.<br>U11, U14 | D5 / A5 / C5 / R0<br>M2 estimate | Backend-specific guarantees; a created sandbox alone proves no credential isolation. |
## sbom-nexus
Source revision `07e998d9abfd4e4fcc74db9e292ed22c6f407522`. [Owner scope](../../../../sbom-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Dependency provenance and SBOM evidence](../../../../sbom-nexus/README.md)<br>`capability.infotech.sbom-management` | Controlled archive ingest, immutable snapshots, freshness and license review.<br>U12, U09 | D3 / A4 / C1 / R0<br>M3 estimate | SBOM and license evidence do not prove vulnerability exploitability or artifact trust. |
## secrets-engine
Source revision `d379a3dfba73c42cd97f4d9cba3a02d705155e4d`. [Owner scope](../../../../secrets-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Cataloged credential lifecycle](../../../../secrets-engine/SCOPE.md)<br>`capability.security.credential-lifecycle` | CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.<br>U04, U05, U07 | D3 / A2 / C1 / R0<br>M2 estimate | Production protected execution and independently anchored PDP authentication remain incomplete. |
## security-canon
Source revision `1664a6def20be2759a1e575024563efd27c9f36f`. [Owner scope](../../../../security-canon/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security practice and authority vocabulary](../../../../security-canon/SCOPE.md)<br>`capability.security.practice-canon` | Versioned SEC-DSM and Mode of Authority documents.<br>U01, U07, U10, U14 | D3 / A0 / C1 / R0<br>M2 estimate | Normative practice; no runtime control or certification. |
## state-hub
Source revision `8ca9201f6a1445c66fe1d1b0ba0c8d044c131647`. [Owner scope](../../../../state-hub/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Cross-repository work tracking](../../../../state-hub/README.md)<br>`capability.statehub.workstream-coordinate` | File-derived workplans, tasks, dependencies, decisions and coordination views.<br>U09 | D4 / A4 / C3 / R2<br>M3 estimate | Read/cache/index of owner work; not runtime approval authority. |
| [Progress and work evidence indexing](../../../../state-hub/README.md)<br>`capability.statehub.progress-log` | REST progress and task evidence references.<br>U08, U09 | D4 / A4 / C3 / R3<br>M3 estimate | Not independent security event custody. |
## tenant-engine
Source revision `1dabbcf47d87d27d118dcf3147d9e3588a807e0c`. [Owner scope](../../../../tenant-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Tenant lifecycle and guardrail facts](../../../../tenant-engine/SCOPE.md)<br>`capability.identity.tenant-facts` | Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.<br>U03, U04 | D3 / A4 / C1 / R0<br>M3 estimate | Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate. |
## the-custodian
Source revision `3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e`. [Owner scope](../../../../the-custodian/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Generic agent runtime and repository tooling](../../../../the-custodian/runtime/README.md)<br>`capability.agents.custodian-runtime-tooling` | Agent runtime modules and repository classification tooling.<br>U09, U11, U14 | D2 / A2 / C1 / R0<br>M2 estimate | Only generic tooling is reusable; confidential canon and session memory are excluded. |
## user-engine
Source revision `85a419d6c5d0b4434d3ca7f33bde3092f5838f79`. [Owner scope](../../../../user-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [User lifecycle and account journeys](../../../../user-engine/SCOPE.md)<br>`capability.identity.user-engine` | Accounts, identity links, membership, MFA and recovery portal, advisory catalog.<br>U02, U03, U10 | D4 / A4 / C2 / R0<br>M3 estimate | Application readback is advisory; applications must enforce their own authorization. |
## whitehat-security
Source revision `5587a8f6ac4b129527db819bc72832051c7fcc3b`. [Owner scope](../../../../whitehat-security/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Authorized adversarial evidence harness](../../../../whitehat-security/SCOPE.md)<br>`capability.security.adversarial-evidence` | Offline ASM and tenancy calibrations and engagement admission.<br>U03, U08, U10, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Live probes require a complete engagement; no blanket target authorization. |
## zone-engine
Source revision `b5a6f88a82b125ebc82c0484bec1ea541e4f95d0`. [Owner scope](../../../../zone-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Zone membership reference conformance](../../../../zone-engine/SCOPE.md)<br>`capability.security.zone-reference` | Offline resolution, exception and lineage checks.<br>U01, U03, U14 | D3 / A2 / C1 / R0<br>M2 estimate | No live zone engine, PDP or protected side effects. |
## Inspected nonproviders
| Repo | Disposition |
| --- | --- |
| [rapp-secrets-engine](../../../../rapp-secrets-engine/README.md) | Retired compatibility stub. Secrets Engine is a CLI/workflow capability; no independent workload is available. No capability was invented to populate this tombstone. |
| [rapp-forgejo](../../../../rapp-forgejo/README.md) | Placeholder with no family declaration. Current Forgejo deployment responsibility remains in the existing Forge/Apps owners. The package family check reports this missing declaration. |
The existing reuse-surface `capability.infotech.headless-browser` remains an additional discovery card for selecting browser tooling. The reviewed `rapp-playwright` capability describes the concrete managed package/provider. This review preserves the discovery card and does not treat the two IDs as two independent browser implementations.

10
docs/assessments/netkingdom-2026-10-14/commit-scan-diagnosis.json Normal file
View file

@ -0,0 +1,10 @@
{
"initial_commit": "blocked by generic-api-key on inventory JSON",
"diagnosis": "All flagged fields were SHA-256 hashes of source files; each value independently recomputed and matched before changing serialization. No credential contents were collected in these fields.",
"remediation": "Qualify source digest strings with sha256: rather than placing bare hex immediately after API/credential-like filename keys. No scanner exception or rule change.",
"affected_artifacts": [
"inventory.json",
"full-inventory.json"
],
"verification": "Normal pre-commit scanner must pass on the revised evidence."
}

42
docs/assessments/netkingdom-2026-10-14/completion-audit.json Normal file
View file

@ -0,0 +1,42 @@
{
"objective_achieved": false,
"requirements": [
{
"requirement": "All relevant repository and capability inventory",
"status": "complete",
"evidence": "full-inventory.json: 60 providers, 70 capabilities; two nonproviders recorded separately"
},
{
"requirement": "Supported use cases",
"status": "complete",
"evidence": "14 use cases in review, owner entries and inventory"
},
{
"requirement": "SWOT",
"status": "complete",
"evidence": "Architecture review SWOT table"
},
{
"requirement": "Maturity estimate",
"status": "complete",
"evidence": "Operational M1\u2013M5 estimates and separate D/A/C/R per capability with limits"
},
{
"requirement": "Ranked improvements for architecture efficiency and framework reuse",
"status": "complete",
"evidence": "12 ranked recommendations with owners, dependencies, effort and acceptance measures"
},
{
"requirement": "Owner capability establishment and local reuse-surface discovery",
"status": "complete",
"evidence": "70/70 local schema, relations, index parity and native federation checks; normal CLI discovery; 60 published source registries"
},
{
"requirement": "Hosted reuse-surface establishment",
"status": "incomplete",
"evidence": "32/70 hosted; 38 registrations pending caller access; seven also require private-source admission"
}
],
"goal_status": "active",
"remaining_action": "Owner-approved hub-write access and private-source read/disclosure admission; apply exact plan and verify all 70 hosted IDs and source parity."
}

1502
docs/assessments/netkingdom-2026-10-14/federated-local.yaml Normal file
View file

File diff suppressed because it is too large Load diff

1461
docs/assessments/netkingdom-2026-10-14/federated-staged.yaml Normal file
View file

File diff suppressed because it is too large Load diff

244
docs/assessments/netkingdom-2026-10-14/federation-local.yaml Normal file
View file

@ -0,0 +1,244 @@
version: 1
domain: infotech
collision_policy: warn
sources:
- repo: access-engine
index: /home/worsch/access-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: activity-core
index: /home/worsch/activity-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: agentic-resources
index: /home/worsch/agentic-resources/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: approval-engine
index: /home/worsch/approval-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: audit-core
index: /home/worsch/audit-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: coordination-engine
index: /home/worsch/coordination-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: emergent-security
index: /home/worsch/emergent-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: fin-hub
index: /home/worsch/fin-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: gate-house
index: /home/worsch/gate-house/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: glas-harness
index: /home/worsch/glas-harness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: info-tech-canon
index: /home/worsch/info-tech-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: informed-decision
index: /home/worsch/informed-decision/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: issue-core
index: /home/worsch/issue-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: key-cape
index: /home/worsch/key-cape/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: kings-guard
index: /home/worsch/kings-guard/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: maturity-engine
index: /home/worsch/maturity-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: net-kingdom
index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-bridge
index: /home/worsch/ops-bridge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-mason
index: /home/worsch/ops-mason/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-warden
index: /home/worsch/ops-warden/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: policy-nexus
index: /home/worsch/policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rail-kubernetes
index: /home/worsch/rail-kubernetes/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-apps
index: /home/worsch/railiance-apps/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-bootstrap
index: /home/worsch/railiance-bootstrap/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-cluster
index: /home/worsch/railiance-cluster/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-enablement
index: /home/worsch/railiance-enablement/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-fabric
index: /home/worsch/railiance-fabric/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-forge
index: /home/worsch/railiance-forge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-infra
index: /home/worsch/railiance-infra/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-master
index: /home/worsch/railiance-master/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-platform
index: /home/worsch/railiance-platform/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-telemetry
index: /home/worsch/railiance-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-openbao
index: /home/worsch/rapp-openbao/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-playwright
index: /home/worsch/rapp-playwright/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-policy-nexus
index: /home/worsch/rapp-policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-postgres
index: /home/worsch/rapp-postgres/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-telemetry
index: /home/worsch/rapp-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-tenant-engine
index: /home/worsch/rapp-tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-user-engine
index: /home/worsch/rapp-user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reef-railiance
index: /home/worsch/reef-railiance/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-aharness
index: /home/worsch/rein-aharness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-openweights
index: /home/worsch/rein-openweights/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: repo-manager
index: /home/worsch/repo-manager/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: resource-control
index: /home/worsch/resource-control/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reuse-surface
index: /home/worsch/reuse-surface/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: risk-nexus
index: /home/worsch/risk-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: role-engine
index: /home/worsch/role-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: runbook-tutorials
index: /home/worsch/runbook-tutorials/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sand-boxer
index: /home/worsch/sand-boxer/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sbom-nexus
index: /home/worsch/sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: secrets-engine
index: /home/worsch/secrets-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: security-canon
index: /home/worsch/security-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: state-hub
index: /home/worsch/state-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: tenant-engine
index: /home/worsch/tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: the-custodian
index: /home/worsch/the-custodian/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: user-engine
index: /home/worsch/user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: whitehat-security
index: /home/worsch/whitehat-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: zone-engine
index: /home/worsch/zone-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rail-knative
index: /home/worsch/rail-knative/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-sbom-nexus
index: /home/worsch/rapp-sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true

236
docs/assessments/netkingdom-2026-10-14/federation-staged.yaml Normal file
View file

@ -0,0 +1,236 @@
version: 1
domain: infotech
collision_policy: warn
sources:
- repo: access-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: activity-core
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: agentic-resources
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: approval-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: audit-core
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: coordination-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: emergent-security
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: fin-hub
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: gate-house
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: glas-harness
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: info-tech-canon
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: informed-decision
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: issue-core
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: key-cape
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: kings-guard
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: maturity-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: net-kingdom
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-bridge
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-mason
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-warden
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: policy-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rail-kubernetes
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-apps
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-bootstrap
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-cluster
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-enablement
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-fabric
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-forge
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-infra
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-master
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-platform
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-telemetry
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-openbao
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-playwright
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-policy-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-postgres
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-telemetry
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-tenant-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-user-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reef-railiance
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-aharness
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-openweights
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: repo-manager
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: resource-control
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reuse-surface
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: risk-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: role-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: runbook-tutorials
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sand-boxer
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sbom-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: secrets-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: security-canon
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: state-hub
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: tenant-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: the-custodian
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: user-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: whitehat-security
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: zone-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml
enabled: true
required: true

2987
docs/assessments/netkingdom-2026-10-14/full-inventory.json Normal file
View file

File diff suppressed because it is too large Load diff

2154
docs/assessments/netkingdom-2026-10-14/hosted-after-publication.json Normal file
View file

File diff suppressed because it is too large Load diff

1872
docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json Normal file
View file

File diff suppressed because it is too large Load diff

714
docs/assessments/netkingdom-2026-10-14/hosted-before-repos.json Normal file
View file

@ -0,0 +1,714 @@
{
"count": 64,
"repos": [
{
"repo": "access-engine",
"url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-09-30T18:31:15+00:00",
"updated_at": "2026-09-30T18:31:15+00:00"
},
{
"repo": "activity-core",
"url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:46:54+00:00",
"updated_at": "2026-08-21T14:26:03+00:00",
"description": ""
},
{
"repo": "agentic-resources",
"url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:10+00:00",
"updated_at": "2026-08-20T21:44:26+00:00"
},
{
"repo": "artifact-store",
"url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:15+00:00",
"updated_at": "2026-08-20T21:44:27+00:00"
},
{
"repo": "audit-core",
"url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:46:57+00:00",
"updated_at": "2026-08-20T21:44:27+00:00"
},
{
"repo": "can-you-assist",
"url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:20+00:00",
"updated_at": "2026-08-20T21:44:27+00:00"
},
{
"repo": "citation-engine",
"url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:25+00:00",
"updated_at": "2026-08-20T21:44:28+00:00"
},
{
"repo": "citation-evidence",
"url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:30+00:00",
"updated_at": "2026-08-20T21:44:28+00:00"
},
{
"repo": "citation-work",
"url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:33+00:00",
"updated_at": "2026-08-20T21:44:29+00:00"
},
{
"repo": "commerce-canon",
"url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"description": "Canonical source after CFED-WP-0001-T03/T09; stable capability.identity identifiers retained.",
"registered_at": "2026-09-05T23:22:01+00:00",
"updated_at": "2026-09-05T23:22:01+00:00"
},
{
"repo": "config-atlas",
"url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "infotech",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-07-06T22:41:01+00:00",
"updated_at": "2026-08-20T21:44:29+00:00"
},
{
"repo": "coordination-engine",
"url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:37+00:00",
"updated_at": "2026-08-20T21:44:30+00:00"
},
{
"repo": "core-hub",
"url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-07-07T10:23:58+00:00",
"updated_at": "2026-07-07T10:23:58+00:00"
},
{
"repo": "domain-tree",
"url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:41+00:00",
"updated_at": "2026-08-20T21:44:30+00:00"
},
{
"repo": "email-connect",
"url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:20+00:00",
"updated_at": "2026-08-20T21:44:30+00:00"
},
{
"repo": "evidence-anchor",
"url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:25+00:00",
"updated_at": "2026-08-20T21:44:31+00:00"
},
{
"repo": "evidence-binder",
"url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:29+00:00",
"updated_at": "2026-08-21T08:31:50+00:00"
},
{
"repo": "evidence-source",
"url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:34+00:00",
"updated_at": "2026-08-20T21:44:32+00:00"
},
{
"repo": "feature-control",
"url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:01+00:00",
"updated_at": "2026-08-20T21:44:32+00:00"
},
{
"repo": "flex-auth",
"url": "https://forgejo.coulomb.social/coulomb/flex-auth/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": false,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:47:00+00:00",
"updated_at": "2026-09-30T18:31:16+00:00",
"description": "Superseded by access-engine (repo rename, FLEX-WP-0020). Kept disabled for audit."
},
{
"repo": "guide-board",
"url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:39+00:00",
"updated_at": "2026-08-20T21:44:33+00:00"
},
{
"repo": "helix-forge",
"url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:43+00:00",
"updated_at": "2026-08-20T21:44:33+00:00"
},
{
"repo": "hub-core",
"url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:04:51+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "human-resources",
"url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:48+00:00",
"updated_at": "2026-08-20T21:44:34+00:00"
},
{
"repo": "identity-canon",
"url": "https://forgejo.coulomb.social/coulomb/identity-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": false,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:02+00:00",
"updated_at": "2026-09-05T23:22:01+00:00",
"description": "Retired source registration after repository rename; replaced by commerce-canon under CFED-WP-0001-T09. Kept for history."
},
{
"repo": "ihp-railiance-probe",
"url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:42+00:00",
"updated_at": "2026-08-20T21:44:34+00:00"
},
{
"repo": "info-tech-canon",
"url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:45+00:00",
"updated_at": "2026-08-20T21:44:35+00:00"
},
{
"repo": "infospace-bench",
"url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:49+00:00",
"updated_at": "2026-08-20T21:44:35+00:00"
},
{
"repo": "inter-hub",
"url": "https://gitea.coulomb.social/coulomb/inter-hub/raw/main/registry/indexes/capabilities.yaml",
"enabled": false,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:18+00:00",
"updated_at": "2026-07-07T10:26:41+00:00"
},
{
"repo": "issue-core",
"url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:54+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "kaizen-agentic",
"url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:57+00:00",
"updated_at": "2026-08-20T21:44:36+00:00"
},
{
"repo": "key-cape",
"url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:00+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "kontextual-engine",
"url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:04+00:00",
"updated_at": "2026-08-20T21:44:36+00:00"
},
{
"repo": "llm-connect",
"url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:07+00:00",
"updated_at": "2026-08-20T21:44:37+00:00"
},
{
"repo": "markitect-filter",
"url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:09+00:00",
"updated_at": "2026-08-20T21:44:37+00:00"
},
{
"repo": "markitect-main",
"url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:13+00:00",
"updated_at": "2026-08-20T21:44:37+00:00"
},
{
"repo": "markitect-quarkdown",
"url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:36+00:00",
"updated_at": "2026-08-20T21:44:38+00:00"
},
{
"repo": "markitect-tool",
"url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:42+00:00",
"updated_at": "2026-08-20T21:44:38+00:00"
},
{
"repo": "net-kingdom",
"url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:46+00:00",
"updated_at": "2026-08-20T21:44:39+00:00"
},
{
"repo": "open-cmis-tck",
"url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:51+00:00",
"updated_at": "2026-08-20T21:44:39+00:00"
},
{
"repo": "open-reuse",
"url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:56+00:00",
"updated_at": "2026-08-20T21:44:39+00:00"
},
{
"repo": "ops-bridge",
"url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:59+00:00",
"updated_at": "2026-08-20T21:44:40+00:00"
},
{
"repo": "ops-hub",
"url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:04+00:00",
"updated_at": "2026-08-20T21:44:40+00:00"
},
{
"repo": "ops-warden",
"url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:09+00:00",
"updated_at": "2026-08-20T21:44:41+00:00"
},
{
"repo": "phase-memory",
"url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:13+00:00",
"updated_at": "2026-08-20T21:44:41+00:00"
},
{
"repo": "railiance-apps",
"url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:16+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-cluster",
"url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:57:59+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-enablement",
"url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:03+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-fabric",
"url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:30+00:00",
"updated_at": "2026-08-20T21:44:42+00:00"
},
{
"repo": "railiance-forge",
"url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:06+00:00",
"updated_at": "2026-08-20T21:44:42+00:00"
},
{
"repo": "railiance-infra",
"url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:09+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-platform",
"url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:46+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "repo-scoping",
"url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:52+00:00",
"updated_at": "2026-08-20T21:44:42+00:00"
},
{
"repo": "repo-seed",
"url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:57+00:00",
"updated_at": "2026-08-20T21:44:43+00:00"
},
{
"repo": "reuse-surface",
"url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"description": "Capability registry for helix_forge",
"registered_at": "2026-06-15T08:24:18+00:00",
"updated_at": "2026-08-20T21:44:43+00:00"
},
{
"repo": "shard-wiki",
"url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:03+00:00",
"updated_at": "2026-08-20T21:44:44+00:00"
},
{
"repo": "state-hub",
"url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:00+00:00",
"updated_at": "2026-07-07T16:09:42+00:00"
},
{
"repo": "tegwick-control",
"url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:00+00:00",
"updated_at": "2026-08-20T21:44:44+00:00"
},
{
"repo": "the-custodian",
"url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:04+00:00",
"updated_at": "2026-08-20T21:44:45+00:00"
},
{
"repo": "user-engine",
"url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:02:46+00:00",
"updated_at": "2026-08-20T21:44:45+00:00"
},
{
"repo": "vantage-point",
"url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:02:51+00:00",
"updated_at": "2026-08-20T21:44:46+00:00"
},
{
"repo": "vergabe-teilnahme",
"url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:02:56+00:00",
"updated_at": "2026-08-20T21:44:46+00:00"
},
{
"repo": "whynot-control",
"url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:03:00+00:00",
"updated_at": "2026-08-20T21:44:46+00:00"
},
{
"repo": "whynot-design",
"url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:03:03+00:00",
"updated_at": "2026-08-20T21:44:47+00:00"
}
]
}

61
docs/assessments/netkingdom-2026-10-14/hosted-verification.json Normal file
View file

@ -0,0 +1,61 @@
{
"matched": 32,
"expected": 70,
"missing": [
"capability.execution.openweight-rein",
"capability.execution.profile-harness",
"capability.execution.sandbox-provision",
"capability.execution.scheduled-agent-rein",
"capability.finance.security-budget-evidence",
"capability.identity.tenant-facts",
"capability.infotech.runbook-tutorials",
"capability.infotech.sbom-management",
"capability.observability.security-signals",
"capability.organization.role-catalog",
"capability.railiance.bootstrap-sequencing",
"capability.railiance.browser-verification",
"capability.railiance.knative-rail",
"capability.railiance.kubernetes-rail",
"capability.railiance.openbao-package",
"capability.railiance.policy-publication-package",
"capability.railiance.postgres-isolation-recovery",
"capability.railiance.sbom-runtime-package",
"capability.railiance.security-consumption-contracts",
"capability.railiance.substrate-bindings",
"capability.railiance.telemetry-package",
"capability.railiance.tenant-engine-package",
"capability.railiance.user-engine-package",
"capability.resources.security-capacity",
"capability.security.adversarial-evidence",
"capability.security.agent-knowledge",
"capability.security.approval-lifecycle",
"capability.security.credential-lifecycle",
"capability.security.doctrine-review",
"capability.security.human-decision-workspace",
"capability.security.maturity-claims",
"capability.security.policy-publication",
"capability.security.posture-assessment",
"capability.security.practice-canon",
"capability.security.repository-secret-prevention",
"capability.security.risk-register",
"capability.security.structure-construction",
"capability.security.zone-reference"
],
"stale": false,
"composed_at": "2026-10-14T04:48:46+00:00",
"warnings": null,
"private_sources": [
"rapp-openbao",
"rapp-policy-nexus",
"rapp-postgres",
"rapp-telemetry",
"rapp-tenant-engine",
"rapp-user-engine",
"rapp-sbom-nexus"
],
"write_attempt": {
"route": "reuse-surface-hub-write-token",
"pdp_decision": "decision:f730e3da14beebdd",
"result": "OpenBao 403 permission denied; helper not executed; no hub writes"
}
}

104
docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json Normal file
View file

@ -0,0 +1,104 @@
{
"reason": "Anonymous source fetch returns 404; hub-side read credential or separately approved metadata publication is needed. Do not change repository visibility.",
"repos": [
"rapp-openbao",
"rapp-policy-nexus",
"rapp-postgres",
"rapp-sbom-nexus",
"rapp-telemetry",
"rapp-tenant-engine",
"rapp-user-engine"
],
"draft_registrations_not_ready": [
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-openbao",
"url": "https://forgejo.coulomb.social/coulomb/rapp-openbao/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-postgres",
"url": "https://forgejo.coulomb.social/coulomb/rapp-postgres/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/rapp-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-user-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-user-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
}
],
"needed_fields": [
"auth_env name for an already admitted hub-side source-read credential",
"proof that the credential is limited to the intended repository read scope",
"successful hub-side index fetch without value disclosure",
"owner consent to metadata appearing in public federation"
]
}

374
docs/assessments/netkingdom-2026-10-14/hub-public-registration-plan.json Normal file
View file

@ -0,0 +1,374 @@
[
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "approval-engine",
"url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "emergent-security",
"url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "fin-hub",
"url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "gate-house",
"url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "glas-harness",
"url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "informed-decision",
"url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "kings-guard",
"url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "maturity-engine",
"url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "ops-mason",
"url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-kubernetes",
"url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-bootstrap",
"url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-master",
"url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-playwright",
"url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "reef-railiance",
"url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-aharness",
"url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-openweights",
"url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "repo-manager",
"url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "resource-control",
"url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "risk-nexus",
"url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "role-engine",
"url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "runbook-tutorials",
"url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sand-boxer",
"url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "secrets-engine",
"url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "security-canon",
"url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "whitehat-security",
"url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "zone-engine",
"url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-knative",
"url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
}
]

458
docs/assessments/netkingdom-2026-10-14/hub-registration-plan.json Normal file
View file

@ -0,0 +1,458 @@
[
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "approval-engine",
"url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "emergent-security",
"url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "fin-hub",
"url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "gate-house",
"url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "glas-harness",
"url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "informed-decision",
"url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "kings-guard",
"url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "maturity-engine",
"url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "ops-mason",
"url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-kubernetes",
"url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-bootstrap",
"url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-master",
"url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-openbao",
"url": "https://forgejo.coulomb.social/coulomb/rapp-openbao/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-playwright",
"url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-postgres",
"url": "https://forgejo.coulomb.social/coulomb/rapp-postgres/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/rapp-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-user-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-user-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "reef-railiance",
"url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-aharness",
"url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-openweights",
"url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "repo-manager",
"url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "resource-control",
"url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "risk-nexus",
"url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "role-engine",
"url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "runbook-tutorials",
"url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sand-boxer",
"url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "secrets-engine",
"url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "security-canon",
"url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "whitehat-security",
"url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "zone-engine",
"url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-knative",
"url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
}
]

14
docs/assessments/netkingdom-2026-10-14/hub-registration-proposal.json Normal file
View file

@ -0,0 +1,14 @@
{
"id": "CUST81-REUSE-REGISTRATION-001",
"authority": "User explicitly requested establishment of reviewed capabilities with reuse-surface. Source publication and cross-repository writes approved through sandbox escalation. No grant beyond registry metadata.",
"target": "https://reuse.coulomb.social/v1/repos",
"helper_sha256": "55465aa4f6a41960055d1b7fcf578c812c917af3110e58676f343472977202fd",
"plan_sha256": "ec0edd0301c43cfb98b5beea7fd454975bca8f6900359df851e70dcc6e6d08df",
"actions": 38,
"credential_lane": "reuse-surface-hub-write-token through warden access --exec; no credential export or persistence",
"expected": "All 60 reviewed owner indexes registered, all 70 reviewed IDs discoverable exactly once with source parity",
"verification": "Public HTTPS raw index and entry hashes, registration readback and fresh hosted federation payload",
"rollback": "Disable only newly created registrations from the exact plan if discovery is incorrect; preserve existing registrations. Source metadata can be reverted by the registry-only commits.",
"cost": "No service deployment or new recurring resource commitment; 38 bounded metadata writes and public readback on existing services.",
"risk": "Incorrect catalog discovery or temporary compose errors; no identity, policy, credential grant, workload or audit authority change. Stop on conflicting registration or transport failure."
}

9
docs/assessments/netkingdom-2026-10-14/hub-registration-receipt.json Normal file
View file

@ -0,0 +1,9 @@
{
"complete": false,
"actions": [],
"helper_executed": false,
"credential_lane_result": "OpenBao HTTP 403",
"pdp_decision": "decision:f730e3da14beebdd",
"public_registrations_ready": 31,
"private_registrations_pending": 7
}

2905
docs/assessments/netkingdom-2026-10-14/inventory.json Normal file
View file

File diff suppressed because it is too large Load diff

2516
docs/assessments/netkingdom-2026-10-14/local-default-federated.yaml Normal file
View file

File diff suppressed because it is too large Load diff

8
docs/assessments/netkingdom-2026-10-14/local-default-federation-receipt.json Normal file
View file

@ -0,0 +1,8 @@
{
"source_count": 99,
"reviewed_count": 70,
"all_exactly_once": true,
"warnings": [],
"previous_sources_sha256": "29a877f165b8d474ceb032f199efa87349a4c4f90c3599fab0cb244110113d10",
"scope": "Workstation local federation. Existing unrelated sources preserved; hosted registration is separate."
}

21
docs/assessments/netkingdom-2026-10-14/local-discovery-receipt.json Normal file
View file

@ -0,0 +1,21 @@
{
"default_federated_index": "/home/worsch/reuse-surface/registry/indexes/federated.yaml",
"total_capabilities_including_unrelated_sources": 114,
"reviewed_exactly_once": 70,
"composition_warnings": [],
"plan_check_trials": [
{
"intent": "bound approval consumption before credential delivery",
"top_id": "capability.security.approval-lifecycle",
"verdict": "extend",
"score": 0.2857
},
{
"intent": "deterministic posture feedback evidence expiry",
"top_id": "capability.security.posture-feedback",
"verdict": "reuse",
"score": 0.6
}
],
"meaning": "Discovery works through the normal CLI. Ranking verdicts are lexical planning recommendations, not permission or runtime readiness."
}

27
docs/assessments/netkingdom-2026-10-14/local-federation-guide.md Normal file
View file

@ -0,0 +1,27 @@
# NetKingdom security capability discovery
The workstation federation includes 70 reviewed security and supporting capabilities from 60 sibling repositories. Two additional inspected repositories are nonproviders: rapp-secrets-engine is retired and rapp-forgejo is a placeholder without a package declaration. The owner capability entries are the reusable source; the architecture assessment is in the-custodian CUST-WP-0081.
## Local discovery
From a reuse-surface checkout beside those repositories:
```sh
reuse-surface federation compose
reuse-surface plan-check --intent "bound approval consumption before credential delivery" --no-llm
reuse-surface plan-check --intent "deterministic posture feedback evidence expiry" --no-llm
```
The source manifest uses relative sibling paths for the reviewed cohort and requires their indexes to exist. Other federation sources are preserved. A missing sibling is a composition error rather than silent loss of a reviewed capability. The composed local index supports planning; it is not a runtime readiness or authorization grant. `reuse-surface query` searches this repository's own index, while `plan-check` uses the composed federation.
## Hosted discovery
```sh
reuse-surface plan-check --hub-url https://reuse.coulomb.social --intent "bound approval consumption" --no-llm
```
As checked on 2026-10-14, all 60 source registry commits are published, while the hosted hub contains 32 of the 70 reviewed capabilities. Thirty-eight new owner registrations remain pending scoped write access: the normal Warden lane was allowed by the PDP but OpenBao refused the current caller with HTTP 403. Seven of those indexes also require admitted private-source read access; anonymous retrieval returns 404. Do not change repository visibility or reuse another workload's credential to make discovery pass.
The seven private sources are rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-telemetry, rapp-tenant-engine, rapp-user-engine and rapp-sbom-nexus. Hosted registration supports an `auth_env` reference to a credential already configured at the hub. Source-owner approval, scoped read provisioning and a successful native fetch must precede their registration. Thirty-one public-source registrations are otherwise ready.
The exact registration plan, source commits, raw retrieval results and local/hosted verification receipts are retained in the-custodian at `docs/assessments/netkingdom-2026-10-14/`. Existing IDs were preserved where valid; the copied Secrets Engine repository-template entry was removed. Registry C/R values retained from older entries remain owner assessments, not renewed evidence.

431
docs/assessments/netkingdom-2026-10-14/local-sources-before.yaml Normal file
View file

@ -0,0 +1,431 @@
version: 1
domain: helix_forge
collision_policy: warn
sources:
- repo: activity-core
url: https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: agentic-resources
url: https://forgejo.coulomb.social/coulomb/agentic-resources/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: artifact-store
url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: audit-core
url: https://forgejo.coulomb.social/coulomb/audit-core/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: can-you-assist
url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-engine
url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-evidence
url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-work
url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: config-atlas
url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: infotech
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: coordination-engine
url: https://forgejo.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: core-hub
url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: domain-tree
url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: email-connect
url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-anchor
url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-binder
url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-source
url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: feature-control
url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: access-engine
url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: guide-board
url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: helix-forge
url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: hub-core
url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: human-resources
url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: commerce-canon
url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ihp-railiance-probe
url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: info-tech-canon
url: https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: infospace-bench
url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: issue-core
url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: kaizen-agentic
url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: key-cape
url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: kontextual-engine
url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: llm-connect
url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-filter
url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-main
url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-quarkdown
url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-tool
url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: net-kingdom
url: https://forgejo.coulomb.social/coulomb/net-kingdom/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: open-cmis-tck
url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: open-reuse
url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-bridge
url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-hub
url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-warden
url: https://forgejo.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: phase-memory
url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-apps
url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-cluster
url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-enablement
url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-fabric
url: https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-forge
url: https://forgejo.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-infra
url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-platform
url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: repo-scoping
url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: repo-seed
url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: reuse-surface
# Include this checkout's entries in local plan-check before publication.
index: registry/indexes/capabilities.yaml
enabled: true
required: true
domain: helix_forge
description: Capability registry for helix_forge
- repo: shard-wiki
url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: state-hub
url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: tegwick-control
url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: the-custodian
url: https://forgejo.coulomb.social/coulomb/the-custodian/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: user-engine
url: https://forgejo.coulomb.social/coulomb/user-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: vantage-point
url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: vergabe-teilnahme
url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whynot-control
url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whynot-design
url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization

577
docs/assessments/netkingdom-2026-10-14/local-sources.yaml Normal file
View file

@ -0,0 +1,577 @@
version: 1
domain: helix_forge
collision_policy: warn
sources:
- repo: access-engine
index: ../access-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: activity-core
index: ../activity-core/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: agentic-resources
index: ../agentic-resources/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: approval-engine
index: ../approval-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: artifact-store
url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: audit-core
index: ../audit-core/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: can-you-assist
url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-engine
url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-evidence
url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-work
url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: commerce-canon
url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: config-atlas
url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: infotech
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: coordination-engine
index: ../coordination-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: core-hub
url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: domain-tree
url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: email-connect
url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: emergent-security
index: ../emergent-security/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: evidence-anchor
url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-binder
url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-source
url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: feature-control
url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: fin-hub
index: ../fin-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: gate-house
index: ../gate-house/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: glas-harness
index: ../glas-harness/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: guide-board
url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: helix-forge
url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: hub-core
url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: human-resources
url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ihp-railiance-probe
url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: info-tech-canon
index: ../info-tech-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: informed-decision
index: ../informed-decision/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: infospace-bench
url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: issue-core
index: ../issue-core/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: kaizen-agentic
url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: key-cape
index: ../key-cape/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: kings-guard
index: ../kings-guard/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: kontextual-engine
url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: llm-connect
url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-filter
url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-main
url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-quarkdown
url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-tool
url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: maturity-engine
index: ../maturity-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: net-kingdom
index: ../net-kingdom/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: open-cmis-tck
url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: open-reuse
url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-bridge
index: ../ops-bridge/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: ops-hub
url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-mason
index: ../ops-mason/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: ops-warden
index: ../ops-warden/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: phase-memory
url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: policy-nexus
index: ../policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rail-knative
index: ../rail-knative/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rail-kubernetes
index: ../rail-kubernetes/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-apps
index: ../railiance-apps/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-bootstrap
index: ../railiance-bootstrap/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-cluster
index: ../railiance-cluster/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-enablement
index: ../railiance-enablement/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-fabric
index: ../railiance-fabric/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-forge
index: ../railiance-forge/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-infra
index: ../railiance-infra/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-master
index: ../railiance-master/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-platform
index: ../railiance-platform/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-telemetry
index: ../railiance-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-openbao
index: ../rapp-openbao/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-playwright
index: ../rapp-playwright/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-policy-nexus
index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-postgres
index: ../rapp-postgres/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-sbom-nexus
index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-telemetry
index: ../rapp-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-tenant-engine
index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-user-engine
index: ../rapp-user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: reef-railiance
index: ../reef-railiance/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rein-aharness
index: ../rein-aharness/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rein-openweights
index: ../rein-openweights/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: repo-manager
index: ../repo-manager/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: repo-scoping
url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: repo-seed
url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: resource-control
index: ../resource-control/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: reuse-surface
index: ../reuse-surface/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: risk-nexus
index: ../risk-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: role-engine
index: ../role-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: runbook-tutorials
index: ../runbook-tutorials/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: sand-boxer
index: ../sand-boxer/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: sbom-nexus
index: ../sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: secrets-engine
index: ../secrets-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: security-canon
index: ../security-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: shard-wiki
url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: state-hub
index: ../state-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: tegwick-control
url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: tenant-engine
index: ../tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: the-custodian
index: ../the-custodian/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: user-engine
index: ../user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: vantage-point
url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: vergabe-teilnahme
url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whitehat-security
index: ../whitehat-security/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: whynot-control
url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whynot-design
url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: zone-engine
index: ../zone-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech

17
docs/assessments/netkingdom-2026-10-14/prepare_local_federation.py Normal file
View file

@ -0,0 +1,17 @@
from pathlib import Path
import hashlib,json,sys,yaml
sys.path.insert(0,'/home/worsch/reuse-surface')
from reuse_surface.federation import compose_federated_index
OUT=Path(__file__).resolve().parent;ROOT=Path('/home/worsch/reuse-surface')
v=json.loads((OUT/'full-inventory.json').read_text());src=ROOT/'registry/federation/sources.yaml';old=yaml.safe_load(src.read_text())
sources={s['repo']:s for s in old['sources']}
for n in v['repositories']:
sources[n]={'repo':n,'index':f'../{n}/registry/indexes/capabilities.yaml','enabled':True,'required':True,'domain':'infotech'}
manifest={**old,'sources':sorted(sources.values(),key=lambda s:s['repo'])}
(OUT/'local-sources-before.yaml').write_bytes(src.read_bytes());(OUT/'local-sources.yaml').write_text(yaml.safe_dump(manifest,sort_keys=False))
federated,warnings=compose_federated_index(manifest,cache_dir=Path('/tmp/netkingdom-reuse-federation-cache'))
counts={r['id']:sum(c['id']==r['id'] for c in federated['capabilities']) for r in v['capabilities']}
receipt={'source_count':len(sources),'reviewed_count':len(counts),'all_exactly_once':all(n==1 for n in counts.values()),'warnings':warnings,'previous_sources_sha256':hashlib.sha256(src.read_bytes()).hexdigest(),'scope':'Workstation local federation. Existing unrelated sources preserved; hosted registration is separate.'}
(OUT/'local-default-federation-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n')
(OUT/'local-default-federated.yaml').write_text(yaml.safe_dump(federated,sort_keys=False))
print(json.dumps(receipt,indent=2));assert receipt['all_exactly_once']

122
docs/assessments/netkingdom-2026-10-14/prepare_registry.py Normal file
View file

@ -0,0 +1,122 @@
"""Prepare exact registry edits for review. Does not mutate owner repositories."""
from pathlib import Path
import json, hashlib, sys, copy
import yaml
sys.path.insert(0,'/home/worsch/reuse-surface')
from reuse_surface.registry import parse_front_matter,entry_vector
from reuse_surface.cli import _run_validate
BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent; STAGE=OUT/'registry-stage'
data=json.loads((OUT/'inventory.json').read_text()); rows=data['capabilities']
CASES={
'U01':'Architect composes a security deployment from explicit owner contracts and case types',
'U02':'Human signs in with MFA and manages account or factor recovery',
'U03':'Application combines identity, tenant and resource facts and enforces a bound decision',
'U04':'Protected operation obtains and consumes exact human approval before its side effect',
'U05':'Operator provisions and delivers a scoped workload credential through the approved owner lane',
'U06':'Operator or automation obtains a bounded SSH certificate and maintains private connectivity',
'U07':'Owner inventories, rotates, revokes and detects exposure of credentials',
'U08':'Consumer emits security events and reconciles independently retained evidence',
'U09':'Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes',
'U10':'Operator recovers identity, custody or data with independently held recovery material',
'U11':'Agent executes an attributable bounded task and supplies supervision evidence',
'U12':'Developer builds and publishes through controlled source, dependency and runner paths',
'U13':'Platform owner deploys and rolls back a workload with explicit substrate and custody bindings',
'U14':'Framework adopter validates and reuses selected contracts, tools and reference compositions',
}
# Adjacencies express interfaces, not a claim that every edge is natively admitted.
NEIGHBORS={
'net-kingdom':['security-canon','gate-house','key-cape','access-engine','reuse-surface'],
'key-cape':['user-engine','tenant-engine','access-engine'],
'user-engine':['key-cape','tenant-engine','access-engine','audit-core'],
'access-engine':['approval-engine','key-cape','tenant-engine','zone-engine','maturity-engine'],
'approval-engine':['access-engine','key-cape','secrets-engine','audit-core'],
'secrets-engine':['approval-engine','access-engine','railiance-platform','ops-warden'],
'ops-warden':['secrets-engine','access-engine','ops-bridge','ops-mason'],
'ops-mason':['secrets-engine','net-kingdom','railiance-platform'],
'audit-core':['approval-engine','tenant-engine','kings-guard','railiance-telemetry'],
'kings-guard':['maturity-engine','audit-core','risk-nexus','net-kingdom'],
'maturity-engine':['gate-house','access-engine','kings-guard'],
'whitehat-security':['gate-house','audit-core','approval-engine'],
'emergent-security':['net-kingdom','gate-house','glas-harness'],
'informed-decision':['approval-engine','access-engine','state-hub'],
'policy-nexus':['net-kingdom','security-canon','risk-nexus'],
'glas-harness':['sand-boxer','rein-aharness','rein-openweights'],
'agentic-resources':['glas-harness','activity-core','fin-hub'],
'repo-manager':['railiance-forge','sbom-nexus','state-hub'],
'railiance-forge':['repo-manager','railiance-enablement','railiance-apps'],
'railiance-platform':['rapp-openbao','rapp-postgres','key-cape','secrets-engine'],
'railiance-telemetry':['rapp-telemetry','audit-core','kings-guard'],
'rapp-telemetry':['railiance-telemetry','rail-kubernetes','reef-railiance'],
'fin-hub':['resource-control','agentic-resources'],
}
primary={}
for r in rows: primary.setdefault(r['repo'],r['id'])
changes=[]; validation=[]
def stage(repo,rel,content):
dst=STAGE/repo/rel;dst.parent.mkdir(parents=True,exist_ok=True); dst.write_text(content)
src=BASE/repo/rel
if src.exists():
baseline=OUT/'registry-before'/repo/rel;baseline.parent.mkdir(parents=True,exist_ok=True);baseline.write_bytes(src.read_bytes())
if not src.exists() or src.read_bytes()!=dst.read_bytes():
changes.append({'repo':repo,'path':rel,'before_sha256':hashlib.sha256(src.read_bytes()).hexdigest() if src.exists() else None,'after_sha256':hashlib.sha256(dst.read_bytes()).hexdigest(),'operation':'write'})
for repo,rv in data['repositories'].items():
root=BASE/repo; rs=[r for r in rows if r['repo']==repo]
ix=copy.deepcopy(rv['existing_index'] or {'version':1,'domain':'infotech','capabilities':[]})
marker=root/'registry/NO_CAPABILITIES.md'
if marker.exists(): changes.append({'repo':repo,'path':'registry/NO_CAPABILITIES.md','before_sha256':hashlib.sha256(marker.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'})
ix['updated']='2026-10-14';ix.setdefault('version',1);ix.setdefault('domain','infotech')
# Include unchanged sibling entries in staged validation without rewriting them.
for p in (root/'registry/capabilities').glob('*.md'):
if repo=='secrets-engine' and parse_front_matter(p).get('id')=='capability.infotech.repo-template':
changes.append({'repo':repo,'path':str(p.relative_to(root)),'before_sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'})
ix['capabilities']=[c for c in ix['capabilities'] if c['id']!='capability.infotech.repo-template'];continue
dst=STAGE/repo/p.relative_to(root);dst.parent.mkdir(parents=True,exist_ok=True);dst.write_bytes(p.read_bytes())
for r in rs:
rel=r['existing_entry_path'] or f"registry/capabilities/{r['id']}.md"
try: old=parse_front_matter(root/rel) if (root/rel).exists() else {}
except (ValueError,yaml.YAMLError):
try: old=yaml.safe_load((root/rel).read_text()[4:])
except yaml.YAMLError: old={}
valid_old='maturity' in old and 'external_evidence' in old
fm=copy.deepcopy(old) if valid_old else {'id':r['id'],'owner':repo,'status':'draft','domain':'infotech','maturity':{'discovery':{'current':'D3','target':'D5','confidence':'medium'},'availability':{'current':r['availability'],'target':r['availability'],'confidence':'medium'}},'external_evidence':{'completeness':{'level':'C1','confidence':'low','basis':'Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review.'},'reliability':{'level':'R0','confidence':'low','basis':'No longitudinal consumer reliability measurement established by this review.'}}}
fm.pop('consumption_modes',None)
fm.update(name=r['name'],summary=r['surface']+'.',owner=repo)
fm['tags']=list(dict.fromkeys(fm.get('tags',[])+['security','netkingdom','framework-reuse']))
if old.get('external_evidence'):
for key in ['completeness','reliability']:
if key in old['external_evidence']: fm['external_evidence'][key]=old['external_evidence'][key]
fm['external_evidence'].setdefault('reliability',{'level':'R0','confidence':'low','basis':'No longitudinal reliability assessment available.'})
previous=entry_vector(fm)
fm['maturity']['availability']['current']=r['availability']
if int(fm['maturity']['availability'].get('target',r['availability'])[1:])<int(r['availability'][1:]):fm['maturity']['availability']['target']=r['availability']
fm['maturity']['availability']['rationale']='Source interface assessed 2026-10-14: '+r['surface']+'. Availability describes the delivery form, not production acceptance. '+r['limitation']+'.'
fm['maturity']['discovery'].setdefault('rationale','Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim.')
vector=entry_vector(fm);r['vector']=vector
if valid_old and previous!=vector:
fm.setdefault('promotion_history',[]).append({'date':'2026-10-14','dimension':'availability','from':previous.split(' / ')[1],'to':r['availability'],'rationale':'Interface-form reassessment from current owner sources; no completeness/reliability promotion.','author':'codex'})
disc=fm.setdefault('discovery',{});disc['intent']=r['surface'];disc['includes']=[r['surface']];disc['excludes']=[r['limitation']]
disc['use_cases']=list(dict.fromkeys(disc.get('use_cases',[])+[u+': '+CASES[u] for u in r['use_cases']]))
av=fm.setdefault('availability',{});av['current_level']=r['availability'];av['target_level']=fm['maturity']['availability']['target'];av['current_artifacts']=r['artifacts']
av['consumption_modes']=['containerized service','CLI'] if r['availability']=='A5' else ['informational'] if r['availability']=='A0' else ['HTTP API','source'] if r['availability']=='A4' else ['library','CLI'] if r['availability']=='A3' else ['CLI','source']
rels=fm.setdefault('relations',{}); neigh=NEIGHBORS.get(repo,['net-kingdom'])
rels['related_to']=list(dict.fromkeys(rels.get('related_to',[])+[primary[n] for n in neigh if primary[n]!=r['id']]))
if repo.startswith('rapp-') and repo[5:] in primary: rels['wraps']=list(dict.fromkeys(rels.get('wraps',[])+[primary[repo[5:]]]))
if repo=='net-kingdom' and r['id']!=primary[repo]:rels['specializes']=[primary[repo]]
ev=fm.setdefault('evidence',{});ev['documentation']=list(dict.fromkeys(r['artifacts']))
guidance=fm.setdefault('consumer_guidance',{});guidance['recommended_for']=[CASES[u] for u in r['use_cases']];guidance['not_recommended_for']=[r['limitation']]
guidance['known_limitations']=[r['limitation'],'2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.']
body='\n# '+r['name']+'\n\n'+r['surface']+'.\n\n## Reuse boundary\n\n'+r['limitation']+'.\n\n## Supported use cases\n\n'+'\n'.join('- '+u+': '+CASES[u] for u in r['use_cases'])+'\n\n## Evidence and integration\n\n'+'\n'.join('- ['+a+'](../../'+a+')' for a in r['artifacts'])+'\n\nAssessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.\n'
stage(repo,rel,'---\n'+yaml.safe_dump(fm,sort_keys=False,allow_unicode=True)+'---\n'+body)
item={k:fm[k] for k in ['id','name','summary','domain','status','owner','tags']};item.update(vector=vector,path=rel,consumption_modes=av['consumption_modes'])
indexpos=next((i for i,c in enumerate(ix['capabilities']) if c.get('id')==r['id']),None)
if indexpos is None:ix['capabilities'].append(item)
else:ix['capabilities'][indexpos]=item
r['entry_path']=rel
stage(repo,'registry/indexes/capabilities.yaml',yaml.safe_dump(ix,sort_keys=False,allow_unicode=True))
errs,warns,paths=_run_validate(STAGE/repo,target=None,relations=False)
validation.append({'repo':repo,'entries':len(paths),'errors':errs,'warnings':warns})
(OUT/'inventory.json').write_text(json.dumps(data,indent=2)+'\n')
(OUT/'use-cases.json').write_text(json.dumps(CASES,indent=2)+'\n')
(OUT/'registry-changes.json').write_text(json.dumps(changes,indent=2)+'\n')
(OUT/'registry-stage-validation.json').write_text(json.dumps(validation,indent=2)+'\n')
print(json.dumps({'changes':len(changes),'repos':len(validation),'errors':[v for v in validation if v['errors'] or v['warnings']]},indent=2))

542
docs/assessments/netkingdom-2026-10-14/publication-preflight.json Normal file
View file

@ -0,0 +1,542 @@
[
{
"repo": "access-engine",
"branch": "main",
"local_head": "16ca97b2776789f730cc7049a2d6533612faaccd",
"remote_head": "16ca97b2776789f730cc7049a2d6533612faaccd",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "activity-core",
"branch": "main",
"local_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
"remote_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "agentic-resources",
"branch": "main",
"local_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709",
"remote_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "approval-engine",
"branch": "main",
"local_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
"remote_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "audit-core",
"branch": "main",
"local_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
"remote_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "coordination-engine",
"branch": "main",
"local_head": "c401067842072b75717f76480dd6e7db1836059c",
"remote_head": "c401067842072b75717f76480dd6e7db1836059c",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "emergent-security",
"branch": "main",
"local_head": "4c6fda38298fa50665ead41526b893adf069d335",
"remote_head": "4c6fda38298fa50665ead41526b893adf069d335",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "fin-hub",
"branch": "main",
"local_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4",
"remote_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "gate-house",
"branch": "main",
"local_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
"remote_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "glas-harness",
"branch": "main",
"local_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe",
"remote_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "info-tech-canon",
"branch": "main",
"local_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e",
"remote_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "informed-decision",
"branch": "main",
"local_head": "ee6a65b80a0fea1a914dfa31434b903669656c09",
"remote_head": "ee6a65b80a0fea1a914dfa31434b903669656c09",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "issue-core",
"branch": "main",
"local_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e",
"remote_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "key-cape",
"branch": "main",
"local_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
"remote_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "kings-guard",
"branch": "main",
"local_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
"remote_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "maturity-engine",
"branch": "main",
"local_head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9",
"remote_head": "2ef97c87a0f818a906aa42942c32d6c69f9ec899",
"same_head": false,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "net-kingdom",
"branch": "main",
"local_head": "1a36e857cc5aae6fe738f794417126c46dd94627",
"remote_head": "1a36e857cc5aae6fe738f794417126c46dd94627",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "ops-bridge",
"branch": "main",
"local_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2",
"remote_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "ops-mason",
"branch": "main",
"local_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
"remote_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "ops-warden",
"branch": "main",
"local_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
"remote_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "policy-nexus",
"branch": "main",
"local_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
"remote_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rail-kubernetes",
"branch": "main",
"local_head": "35159e49c1340b7a0e30c49188975c8839d346f6",
"remote_head": "35159e49c1340b7a0e30c49188975c8839d346f6",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-apps",
"branch": "main",
"local_head": "706461b845086ee2df8ce9acae3dae7feebfffda",
"remote_head": "706461b845086ee2df8ce9acae3dae7feebfffda",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "railiance-bootstrap",
"branch": "main",
"local_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b",
"remote_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-cluster",
"branch": "main",
"local_head": "12d1e881ff2086566712fbc591db293b38ea2bcf",
"remote_head": "12d1e881ff2086566712fbc591db293b38ea2bcf",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-enablement",
"branch": "main",
"local_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063",
"remote_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-fabric",
"branch": "main",
"local_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e",
"remote_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-forge",
"branch": "main",
"local_head": "a15fac8e938c11b041eb39386f05b63d46ae566a",
"remote_head": "a15fac8e938c11b041eb39386f05b63d46ae566a",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "railiance-infra",
"branch": "main",
"local_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
"remote_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-master",
"branch": "main",
"local_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7",
"remote_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-platform",
"branch": "main",
"local_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce",
"remote_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-telemetry",
"branch": "main",
"local_head": "81d905971c38de9aaf11088ba605e112152d8268",
"remote_head": "81d905971c38de9aaf11088ba605e112152d8268",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-openbao",
"branch": "main",
"local_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66",
"remote_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-playwright",
"branch": "main",
"local_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
"remote_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-policy-nexus",
"branch": "main",
"local_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda",
"remote_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-postgres",
"branch": "main",
"local_head": "03744030c9258e920f6403a9ce184a26d7b75268",
"remote_head": "03744030c9258e920f6403a9ce184a26d7b75268",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-telemetry",
"branch": "main",
"local_head": "17053dbc47f7c22efd67fd90d06d108d154835fa",
"remote_head": "17053dbc47f7c22efd67fd90d06d108d154835fa",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-tenant-engine",
"branch": "main",
"local_head": "c160be23577ab4d99ee2cd008deb455b07f0597d",
"remote_head": "c160be23577ab4d99ee2cd008deb455b07f0597d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-user-engine",
"branch": "main",
"local_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c",
"remote_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "reef-railiance",
"branch": "main",
"local_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239",
"remote_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rein-aharness",
"branch": "main",
"local_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42",
"remote_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "rein-openweights",
"branch": "main",
"local_head": "e1fccb39b738a5381a9de6e1d799f124797798ce",
"remote_head": "e1fccb39b738a5381a9de6e1d799f124797798ce",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "repo-manager",
"branch": "main",
"local_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa",
"remote_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "resource-control",
"branch": "main",
"local_head": "3604d468f86ede7d320f4d22dd4aea775306b53f",
"remote_head": "3604d468f86ede7d320f4d22dd4aea775306b53f",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "reuse-surface",
"branch": "main",
"local_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1",
"remote_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "risk-nexus",
"branch": "main",
"local_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc",
"remote_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "role-engine",
"branch": "main",
"local_head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
"remote_head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "runbook-tutorials",
"branch": "main",
"local_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e",
"remote_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "sand-boxer",
"branch": "main",
"local_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d",
"remote_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "sbom-nexus",
"branch": "main",
"local_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522",
"remote_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "secrets-engine",
"branch": "main",
"local_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
"remote_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "security-canon",
"branch": "main",
"local_head": "1664a6def20be2759a1e575024563efd27c9f36f",
"remote_head": "1664a6def20be2759a1e575024563efd27c9f36f",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "state-hub",
"branch": "main",
"local_head": "4ffc7236735afc6223aa613262483ea911307714",
"remote_head": "4ffc7236735afc6223aa613262483ea911307714",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "tenant-engine",
"branch": "main",
"local_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
"remote_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "the-custodian",
"branch": "main",
"local_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e",
"remote_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "user-engine",
"branch": "main",
"local_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
"remote_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "whitehat-security",
"branch": "main",
"local_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b",
"remote_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "zone-engine",
"branch": "main",
"local_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
"remote_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
}
]

18
docs/assessments/netkingdom-2026-10-14/publication_preflight.py Normal file
View file

@ -0,0 +1,18 @@
from pathlib import Path
import concurrent.futures,json,subprocess,urllib.request
OUT=Path(__file__).resolve().parent;v=json.loads((OUT/'inventory.json').read_text())
def inspect(n):
def git(*args):return subprocess.run(['git','-C','/home/worsch/'+n,*args],capture_output=True,text=True,timeout=45)
branch=git('branch','--show-current').stdout.strip(); head=git('rev-parse','HEAD').stdout.strip()
remote=git('ls-remote','origin','refs/heads/'+branch)
sha=remote.stdout.split()[0] if remote.returncode==0 and remote.stdout.strip() else None
return {'repo':n,'branch':branch,'local_head':head,'remote_head':sha,'same_head':head==sha,'remote_read_exit':remote.returncode,'staged_paths':git('diff','--cached','--name-only').stdout.splitlines()}
with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex: result=list(ex.map(inspect,v['repositories']))
(OUT/'publication-preflight.json').write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps({'repos':len(result),'same_heads':sum(r['same_head'] for r in result),'exceptions':[r for r in result if not r['same_head'] or r['staged_paths']]},indent=2))
for endpoint in ['repos','federated']:
try:
with urllib.request.urlopen('https://reuse.coulomb.social/v1/'+endpoint,timeout=40) as r: data=json.load(r)
(OUT/('hosted-before-'+endpoint+'.json')).write_text(json.dumps(data,indent=2)+'\n')
print(endpoint,'read successfully')
except Exception as e:print(endpoint,type(e).__name__)

44
docs/assessments/netkingdom-2026-10-14/publish_registry.py Normal file
View file

@ -0,0 +1,44 @@
"""Publish only the reviewed registry paths; preserve unrelated index/worktree state."""
from pathlib import Path
import hashlib,json,subprocess,tempfile
OUT=Path(__file__).resolve().parent;BASE=Path('/home/worsch')
changes=json.loads((OUT/'registry-changes.json').read_text());pre={r['repo']:r for r in json.loads((OUT/'publication-preflight.json').read_text())}
receipt_path=OUT/'registry-publication.json';receipts=json.loads(receipt_path.read_text()) if receipt_path.exists() else []
completed={r['repo'] for r in receipts if r.get('verified_remote')}
def git(root,*args):
p=subprocess.run(['git','-C',str(root),*args],text=True,capture_output=True,timeout=180)
if p.returncode:raise RuntimeError('git '+args[0]+': '+p.stderr[-1800:]+p.stdout[-1800:])
return p.stdout.strip()
for n in pre:
if n in completed:continue
cs=[c for c in changes if c['repo']==n];root=BASE/n;paths=[c['path'] for c in cs];original=pre[n]
try:
for c in cs:
p=root/c['path'];sha=hashlib.sha256(p.read_bytes()).hexdigest() if p.exists() else None
if sha!=c['after_sha256']:raise RuntimeError('Registry changed since validation: '+c['path'])
if git(root,'rev-parse','HEAD')!=original['local_head']:raise RuntimeError('HEAD moved since preflight')
branch=original['branch'];remote=git(root,'ls-remote','origin','refs/heads/'+branch).split()[0]
if remote!=original['remote_head']:raise RuntimeError('Remote moved since preflight')
isolated=not original['same_head']
if isolated:
# Do not publish existing unrelated local commits. Build the registry commit on the real remote head.
temp=Path(tempfile.mkdtemp(prefix='netkingdom-registry-'+n+'-',dir='/tmp'))
url=git(root,'remote','get-url','origin');git(temp,'clone','--quiet','--single-branch','--branch',branch,url,'.')
for c in cs:
target=temp/c['path']
if c['operation']=='delete':
if target.exists():target.unlink()
else:target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes((OUT/'registry-stage'/n/c['path']).read_bytes())
root=temp
git(root,'diff','--check','--',*paths)
git(root,'add','--',*paths)
git(root,'commit','--only','-m','docs(reuse): establish reviewed NetKingdom security capabilities','--',*paths)
commit=git(root,'rev-parse','HEAD');actual=set(git(root,'diff-tree','--no-commit-id','--name-only','-r',commit).splitlines())
if actual!=set(paths):raise RuntimeError('Commit path mismatch')
git(root,'push','origin','HEAD:refs/heads/'+branch)
observed=git(root,'ls-remote','origin','refs/heads/'+branch).split()[0]
row={'repo':n,'commit':commit,'parent':remote,'paths':paths,'verified_remote':observed==commit,'isolated_publication':isolated}
if isolated:row['local_unrelated_head_preserved']=original['local_head'];row['publication_checkout']=str(root)
receipts.append(row);receipt_path.write_text(json.dumps(receipts,indent=2)+'\n');print(n,commit[:12],'verified',flush=True)
except Exception as e:
receipts.append({'repo':n,'verified_remote':False,'error':str(e)});receipt_path.write_text(json.dumps(receipts,indent=2)+'\n');print(n,'FAILED',str(e),flush=True);raise SystemExit(1)

1194
docs/assessments/netkingdom-2026-10-14/published-source-verification.json Normal file
View file

File diff suppressed because it is too large Load diff

43
docs/assessments/netkingdom-2026-10-14/register_hub.py Normal file
View file

@ -0,0 +1,43 @@
"""Apply the exact non-secret registration plan using the owner-routed env credential.
No redirects/proxies, no credential output, no secret persistence. Safe retry reads first.
"""
import json,os,sys,urllib.request,urllib.error,hashlib
from pathlib import Path
OUT=Path(__file__).resolve().parent;BASE='https://reuse.coulomb.social'
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect())
plan=json.loads((OUT/'hub-registration-plan.json').read_text())
receipt={'plan_sha256':hashlib.sha256((OUT/'hub-registration-plan.json').read_bytes()).hexdigest(),'actions':[]}
def request(method,path,body=None,auth=False):
headers={'Accept':'application/json'}
if auth:
token=os.environ.get('REUSE_SURFACE_TOKEN')
if not token:raise RuntimeError('Required owner-routed credential is unavailable')
headers['Authorization']='Bearer '+token
if body is not None:headers['Content-Type']='application/json'
req=urllib.request.Request(BASE+path,data=json.dumps(body).encode() if body is not None else None,headers=headers,method=method)
with opener.open(req,timeout=55) as response:return response.status,json.load(response)
def save(): (OUT/'hub-registration-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n')
try:
status,listed=request('GET','/v1/repos');existing={r['repo']:r for r in listed['repos']}
# Every reviewed source must already be published; do not register dead indexes.
pub=json.loads((OUT/'registry-publication.json').read_text())+json.loads((OUT/'supplement/registry-publication.json').read_text());verified={r['repo'] for r in pub if r.get('verified_remote')}
expected=set(json.loads((OUT/'full-inventory.json').read_text())['repositories'])
if verified!=expected:raise RuntimeError('Source publication incomplete')
raw=json.loads((OUT/'published-source-verification.json').read_text())
if raw['errors'] or raw['checked_repositories']!=len(expected):raise RuntimeError('Published source verification incomplete')
for a in plan:
repo=a['body'].get('repo') or a['path'].split('/')[-1]
current=existing.get(repo)
if current and all(current.get(k)==v for k,v in a['body'].items() if k not in ['registered_by','description']):
receipt['actions'].append({'repo':repo,'outcome':'already_matches'});save();continue
if current and a['method']=='POST':raise RuntimeError('Concurrent registration differs: '+repo)
status,result=request(a['method'],a['path'],a['body'],auth=True)
receipt['actions'].append({'repo':repo,'http_status':status,'outcome':'applied'});save()
receipt['complete']=True;save()
except Exception as e:
receipt['complete']=False;receipt['failure_type']=type(e).__name__
receipt['failure_status']=e.code if isinstance(e,urllib.error.HTTPError) else None
# Never serialize response bodies/headers or exception strings from authenticated transport.
save();sys.exit(1)

6
docs/assessments/netkingdom-2026-10-14/registry-application.json Normal file
View file

@ -0,0 +1,6 @@
{
"applied": 129,
"repositories": 58,
"verified_sha256": true,
"git_staging_or_commits": false
}

80
docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md Normal file
View file

@ -0,0 +1,80 @@
---
id: capability.authorization.policy-evaluate
name: Authorization Policy Evaluation
summary: Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.
owner: flex-auth
status: draft
domain: helix_forge
tags: [authorization, policy, flex-auth]
maturity:
discovery:
current: D4
target: D6
confidence: medium
rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth path.
availability:
current: A2
target: A5
confidence: low
rationale: Policy registry and evaluation logic exist in repo; service packaging evolving.
external_evidence:
completeness:
level: C2
name: Partial
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- policy-as-code intent documented
broken_expectations:
- not yet indexed from flex-auth native registry
out_of_scope_expectations:
- identity proofing
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- early implementation phase
discovery:
intent: >
Provide inspectable authorization decisions between verified identity and
protected resources using policy-as-code.
includes:
- policy evaluation
- authorization registry
- decision explainability
excludes:
- identity issuance
- authentication protocols
use_cases: []
availability:
current_level: A2
target_level: A5
current_artifacts:
- flex-auth/
consumption_modes:
- source module
relations:
depends_on:
- capability.identity.subject-resolution
related_to:
- capability.feature-control.evaluate
consumer_guidance:
recommended_for:
- planning authorization layer between identity and resources
not_recommended_for:
- feature visibility toggles without policy intent
known_limitations:
- maturity evidence is registry-external today
---
# Authorization Policy Evaluation
Policy evaluation from flex-auth sits between identity resolution and protected
systems.

19
docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,19 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities:
- id: capability.authorization.policy-evaluate
name: Authorization Policy Evaluation
summary: Evaluate access decisions from policy-as-code rules for subjects, resources,
and actions.
vector: D4 / A2 / C2 / R1
domain: helix_forge
status: draft
owner: flex-auth
path: registry/capabilities/capability.authorization.policy-evaluate.md
tags:
- authorization
- policy
- flex-auth
consumption_modes:
- source module

77
docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/capabilities/capability.activity.event-coordinate.md Normal file
View file

@ -0,0 +1,77 @@
---
id: capability.activity.event-coordinate
name: Organizational Event Coordination
summary: Coordinate structured responses to cross-domain events through activity workflows and automation.
owner: activity-core
status: draft
domain: helix_forge
tags: [activity, coordination, automation]
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: activity-core INTENT defines org-wide event response boundary.
availability:
current: A1
target: A4
confidence: low
rationale: Conceptual workflows exist; consumable API surface still emerging.
external_evidence:
completeness:
level: C1
name: Fragmentary
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- problem and boundary documented in INTENT
broken_expectations:
- no registry-native automation artifacts indexed yet
out_of_scope_expectations:
- owning domain-specific business logic
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks: []
discovery:
intent: >
Give the organization a structural home for responding to events across repos
and domains in an auditable, automation-ready way.
includes:
- event-triggered coordination
- cross-domain maintenance workflows
excludes:
- single-repo cron replacements only
use_cases: []
availability:
current_level: A1
target_level: A4
current_artifacts:
- activity-core/INTENT.md
consumption_modes:
- informational
relations:
depends_on: []
related_to:
- capability.statehub.workstream-coordinate
- capability.audit.event-retain
consumer_guidance:
recommended_for:
- planning org-wide event response patterns
not_recommended_for:
- assuming production automation is available
known_limitations:
- early discovery stage
---
# Organizational Event Coordination
activity-core coordinates how the org responds to events—not the domain logic
inside each repo.

19
docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,19 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities:
- id: capability.activity.event-coordinate
name: Organizational Event Coordination
summary: Coordinate structured responses to cross-domain events through activity
workflows and automation.
vector: D3 / A1 / C1 / R0
domain: helix_forge
status: draft
owner: activity-core
path: registry/capabilities/capability.activity.event-coordinate.md
tags:
- activity
- coordination
- automation
consumption_modes:
- informational

15
docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/NO_CAPABILITIES.md Normal file
View file

@ -0,0 +1,15 @@
---
repo: agentic-resources
reason: >
INTENT/SCOPE are aspirational HR-for-agents vision prose; no src/, no package manifest — vision-stage only, nothing implemented to reuse.
reviewed: "2026-07-06"
reviewed_by: claude-code
revisit: >
Revisit once an implementation exists (src/ or package manifest lands).
---
# No reusable capability
This repo was reviewed for the `reuse-surface` capability registry
(REUSE-WP-0017 coverage campaign) and has no capability to register at this
time. See the `reason` field above.

4
docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,4 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities: []