coulomb/the-custodian
5
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

docs: review NetKingdom architecture and establish capability inventory

Browse source
This commit is contained in:
codex 2026-10-14 09:13:18 +02:00
parent e8bd394c8b
commit 44483896fb
252 changed files with 40311 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

20
docs/assessments/netkingdom-2026-10-14/apply_registry.py Normal file
View file

@ -0,0 +1,20 @@
"""Apply only the hash-pinned, reviewed metadata patch; never stage or commit."""
from pathlib import Path
import hashlib,json
OUT=Path(__file__).resolve().parent;BASE=Path('/home/worsch')
changes=json.loads((OUT/'registry-changes.json').read_text())
# Check the entire patch before the first write. Do not overwrite concurrent edits.
for c in changes:
p=BASE/c['repo']/c['path'];actual=hashlib.sha256(p.read_bytes()).hexdigest() if p.exists() else None
if actual!=c['before_sha256']:raise SystemExit('Concurrent change: '+str(p))
if c['operation']=='write':
stage=OUT/'registry-stage'/c['repo']/c['path']
if hashlib.sha256(stage.read_bytes()).hexdigest()!=c['after_sha256']:raise SystemExit('Staged digest differs: '+str(stage))
for c in changes:
p=BASE/c['repo']/c['path']
if p.exists():
backup=OUT/'registry-before'/c['repo']/c['path'];backup.parent.mkdir(parents=True,exist_ok=True);backup.write_bytes(p.read_bytes())
if c['operation']=='delete':p.unlink()
else:p.parent.mkdir(parents=True,exist_ok=True);p.write_bytes((OUT/'registry-stage'/c['repo']/c['path']).read_bytes())
(OUT/'registry-application.json').write_text(json.dumps({'applied':len(changes),'repositories':len({c['repo'] for c in changes}),'verified_sha256':True,'git_staging_or_commits':False},indent=2)+'\n')
print('Applied',len(changes),'reviewed metadata edits')

98
docs/assessments/netkingdom-2026-10-14/build_inventory.py Normal file
View file

@ -0,0 +1,98 @@
"""Build the review's explicit capability denominator and staged registry patch."""
from pathlib import Path
import hashlib, json, subprocess, yaml
BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent
# repo | id suffix | capability | availability | operational estimate (1..5) | surface | limitation | use cases | artifacts
DATA='''
security-canon|security.practice-canon|Security practice and authority vocabulary|A0|2|Versioned SEC-DSM and Mode of Authority documents|Normative practice; no runtime control or certification|U01 U07 U10 U14|SCOPE.md;infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md
net-kingdom|security.iam-tooling-suite|NetKingdom security architecture and conformance tooling|A2|2|Versioned IAM, layer, tenancy and credential contracts plus validators|Mixed accepted and proposed standards; framework integration remains incomplete|U01 U02 U03 U14|SCOPE.md;SECURITY-COMPANION.md
net-kingdom|security.scenario-compose|Deterministic security scenario composition|A2|2|CLI selects pinned providers and orders trust transitions|Plan only; execution.permitted is always false|U01 U14|tools/security-scenario-composer/README.md;tools/security-scenario-composer/security_scenario_composer.py
net-kingdom|security.posture-feedback|Deterministic posture feedback|A2|2|CLI evaluates evidence age and posture into owner-routed findings|Proposal only; no policy changes or remediation execution|U09 U14|tools/posture-feedback/README.md;tools/posture-feedback/posture_feedback.py
net-kingdom|security.case-contracts|Security case types and instance validation|A2|2|Versioned types, cases and schema validation|Type acknowledgment, case acceptance, structural materialization and native execution are distinct|U01 U05 U06|tools/security-case-types/README.md;canon/standards/security-case-types_v0.1.md
net-kingdom|security.bootstrap-recovery|Guarded bootstrap and recovery preparation|A2|2|Local identity, bootstrap console, encrypted custody handoff and caller tools|Source repairs and disposable native fixtures do not prove estate root isolation or recovery|U10|tools/security-bootstrap-console/README.md;tools/custody-record/README.md
net-kingdom|security.emission-profile|Security emission cadence validation|A2|2|Security profile over generic emission contracts and validator|Profile adoption and source completeness require owner-native evidence|U08 U09|tools/emission-cadence-profile/README.md
key-cape|iam.key-cape|OIDC identity and assurance|A4|3|OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI|Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates|U02 U03 U04 U10|SCOPE.md;README.md
user-engine|identity.user-engine|User lifecycle and account journeys|A4|3|Accounts, identity links, membership, MFA and recovery portal, advisory catalog|Application readback is advisory; applications must enforce their own authorization|U02 U03 U10|SCOPE.md;README.md
tenant-engine|identity.tenant-facts|Tenant lifecycle and guardrail facts|A4|3|Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store|Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate|U03 U04|SCOPE.md;README.md
zone-engine|security.zone-reference|Zone membership reference conformance|A2|2|Offline resolution, exception and lineage checks|No live zone engine, PDP or protected side effects|U01 U03 U14|SCOPE.md;README.md
access-engine|authorization.policy-evaluate|Policy evaluation and decision evidence|A4|3|Check, batch, list-allowed, explain, binding, lifetime and decision records|One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct|U03 U04 U05 U06|SCOPE.md;README.md
approval-engine|security.approval-lifecycle|Bound approval lifecycle|A4|2|Authenticated issue, claim, revoke, supersede and atomic consume API with outbox|Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open|U04 U05 U06|SCOPE.md;approval_engine/api.py;docs/production-dependencies.md
secrets-engine|security.credential-lifecycle|Cataloged credential lifecycle|A2|2|CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke|Production protected execution and independently anchored PDP authentication remain incomplete|U04 U05 U07|SCOPE.md;src/secrets_engine/decision_check.py
ops-warden|security.ssh-certificate-issuance|Decision-bound SSH certificates|A3|3|warden sign with local and OpenBao backends and adm/agt/atm actors|Direct Tooling contact is a declared gap; certificate reachability is not target authorization|U06|SCOPE.md;README.md
ops-warden|security.access-routing|Credential routing and contained access|A3|3|warden route and access catalog; exact lane conduit and secret-exec routing|Routing grants no authority; interim delegates and attended high-risk lanes persist|U04 U05 U06|SCOPE.md;wiki/CredentialRouting.md
ops-warden|security.case-follow-through|Security case operational follow-through|A2|2|KnownSecurityCase route, plan and operational receipts|Execution requires accepted structure and exact owner contracts; case closure is not automatic|U01 U05 U06|workplans/WARDEN-WP-0044-security-case-follow-through.md
ops-mason|security.structure-construction|Reviewed security structure construction|A2|2|Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply|Founder plan gate is an explicit exception; not full PDP conformance|U01 U05 U06|SCOPE.md;docs/construction-plan-format.md
ops-bridge|ops.tunnel-bridge|SSH tunnel lifecycle|A2|3|Named tunnels, reconnect, health and TTL-aware cert_command|Private transport does not authenticate applications or decide access|U06|SCOPE.md
audit-core|audit.event-retain|Independent audit custody|A4|3|Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation|Custody after arrival does not prove source completeness; freshness bounds integrity assertions|U08 U09 U10|SCOPE.md;docs/stream-completeness.md
maturity-engine|security.maturity-claims|Evidence-based maturity claims and gap register|A2|2|SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory|No production deployment claimed; levels supply facts and cannot authorize actions|U09 U14|SCOPE.md;docs/claim-contract.md
kings-guard|security.posture-assessment|Security posture assessment and response proposals|A2|2|Normalized observation evaluator, cadence checks and secret-use snapshot adapter|Bounded reference pilot; containment proposals only; deployed-stream admission remains open|U08 U09|SCOPE.md;docs/SecretUseSnapshotAdmission.md
whitehat-security|security.adversarial-evidence|Authorized adversarial evidence harness|A2|2|Offline ASM and tenancy calibrations and engagement admission|Live probes require a complete engagement; no blanket target authorization|U03 U08 U10 U14|SCOPE.md;README.md
gate-house|security.doctrine-review|Security doctrine and architecture review|A0|3|Layer rules, authority context, ASM criteria and interpretations|Staff judgment; no runtime PDP, credential issuer or automatic enforcement|U01 U09 U14|SCOPE.md;INTENT.md
emergent-security|security.agent-knowledge|Verified security orientation for agents|A2|2|Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports|Current start card withheld for source drift; orientation never grants authority|U01 U11 U14|SCOPE.md;knowledge/cards/start.md
informed-decision|security.human-decision-workspace|Human security decision presentation and disposition|A4|3|Headless lifecycle and browser workspace with exact native approval references|Initial audience is bounded; Approval Engine owns approval state, Access Engine decides|U04 U05 U09|SCOPE.md;README.md
policy-nexus|security.policy-publication|Policy publication with source provenance|A2|3|Generated immutable publication, source currency and stable policy URLs|Publication does not ratify policy or enforce it|U01 U09 U14|README.md;docs/publication-contract.md
risk-nexus|security.risk-register|Security risk and exception review register|A2|2|Markdown findings and Python review, verification and due-work reports|Judgment remains human or agent; no live EUR risk gate or autonomous response|U09 U14|SCOPE.md
role-engine|organization.role-catalog|Organizational role definitions|A0|1|Versioned documentation catalog|Not IAM roles, assignments or runtime authorization|U01 U11|README.md;INTENT.md
glas-harness|execution.profile-harness|Profile-bound agent execution lifecycle|A3|2|Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration|No ready profile asserted by SCOPE; Custodian native isolation remains open|U11|SCOPE.md;README.md
sand-boxer|execution.sandbox-provision|Sandbox establishment and lifecycle|A5|2|Profiles, extensions, provision, checkpoints, TTL teardown and telemetry|Backend-specific guarantees; a created sandbox alone proves no credential isolation|U11 U14|SCOPE.md;README.md
rein-aharness|execution.scheduled-agent-rein|Scheduled agent intake and harness routing|A2|3|Activity Core lease claim/heartbeat and Glas profile execution|Legacy paths are time-gated; task success is not privileged authority|U09 U11|SCOPE.md;README.md
rein-openweights|execution.openweight-rein|Bounded open-weight agent execution|A2|2|Tool loop, path guards, turn/budget limits and verified-commit result|Provider credential acquisition and runtime authority need separate custody controls|U11|SCOPE.md;README.md
agentic-resources|agents.performance-learning|Agent performance learning|A2|2|Capture sessions, curate patterns, distribute lessons and measure outcomes|Workforce assignments and broader authority contracts remain proposed|U09 U11|SCOPE.md
runbook-tutorials|infotech.runbook-tutorials|Guided administrative runbooks|A2|2|Pack schema, loader, local UI/CLI, gates, verification and rollback evidence|Owner supplies procedures; UI progress is not runtime approval|U05 U10 U14|SCOPE.md;docs/pack-spec.md
repo-manager|security.repository-secret-prevention|Repository metadata and staged-secret prevention|A2|3|Repository observation plus pinned staged-blob scanner and hook integration|Local hooks are bypassable; coverage is exact-checkout scoped|U07 U12|SCOPE.md;README.md
sbom-nexus|infotech.sbom-management|Dependency provenance and SBOM evidence|A4|3|Controlled archive ingest, immutable snapshots, freshness and license review|SBOM and license evidence do not prove vulnerability exploitability or artifact trust|U12 U09|README.md
activity-core|activity.event-coordinate|Durable automation and bounded operations|A4|3|Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks|Not a general shell executor; first unassisted security-flow cadence acceptance remains open|U09 U12|SCOPE.md;README.md
issue-core|infotech.issue-tracking|External issue tracker connector|A2|2|CLI and Python adapters for external issue systems|Internal work originates in owner files; external projection is optional|U09|README.md
state-hub|statehub.workstream-coordinate|Cross-repository work tracking|A4|3|File-derived workplans, tasks, dependencies, decisions and coordination views|Read/cache/index of owner work; not runtime approval authority|U09|README.md;SCOPE.md
state-hub|statehub.progress-log|Progress and work evidence indexing|A4|3|REST progress and task evidence references|Not independent security event custody|U08 U09|README.md;SCOPE.md
the-custodian|agents.custodian-runtime-tooling|Generic agent runtime and repository tooling|A2|2|Agent runtime modules and repository classification tooling|Only generic tooling is reusable; confidential canon and session memory are excluded|U09 U11 U14|runtime/README.md
coordination-engine|coordination.cross-owner-work|Cross-owner coordination lifecycle|A2|2|Observation, lease, wake-up, checkpoint and receipt contracts/runtime|Coordinates owners without replacing their execution or security authority|U09|SCOPE.md;spec/cross-owner-wait-mode-v0.1.md
reuse-surface|registry.register|Capability registry and federation|A3|3|Owner Markdown entries, indexes, federation hub and planning queries|Discovery is not readiness; empty and stale entries need evidence-led maintenance|U01 U09 U14|docs/RegistryFederation.md;specs/CapabilityMaturityStandard.md
reuse-surface|registry.validate|Capability registry validation|A3|3|Schema, index consistency and relation checks|Schema validity alone proves neither capability behavior nor hosted freshness|U01 U14|docs/RegistryFederation.md;schemas/capability.schema.yaml
info-tech-canon|infotech.canon-service|Shared semantic contracts and validation|A4|2|Markdown canon with library, CLI and read-only API|Mixed seed/candidate maturity; validation is not owner runtime conformance|U01 U08 U14|SCOPE.md
railiance-master|railiance.security-consumption-contracts|Platform security consumption architecture|A0|2|Rail/rapp/reef boundaries, exposure and security consumption contracts|Architecture declarations do not prove implementation or production admission|U01 U13 U14|SCOPE.md;docs/netkingdom-security-consumption-contract.md
railiance-platform|railiance.platform-services|Secret custody and platform data services|A2|3|OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts|Package ownership is split to rapp repos; caches and object services are demand-led|U04 U05 U07 U10 U13|SCOPE.md;docs/openbao.md
railiance-infra|railiance.infra-provisioning|Host convergence and security baseline|A2|3|Ansible inventory, firewall, SSH bootstrap and baseline verification|Current hosts differ from the retained Hetzner provisioning path|U06 U10 U13|SCOPE.md
railiance-cluster|railiance.cluster-bootstrap|Kubernetes runtime and cluster controls|A2|3|k3s, ingress, CNI, operators and kubeconfig/runtime checks|Single-node runtime and workload recovery are distinct from bootstrap success|U10 U13|SCOPE.md
railiance-enablement|railiance.ci-enablement|Developer delivery and CI templates|A2|2|Reusable CI workflows, build and deployment patterns|Templates do not prove mandatory checks or runner isolation|U12 U14|SCOPE.md
railiance-forge|railiance.forge-infrastructure|Source forge, registries and runner substrate|A2|3|Forgejo operation, package registries and runner lifecycle|Runner workload authority and independent verification coverage remain open|U12|SCOPE.md;workplans/FORGE-WP-0006-independent-secret-detection.md
railiance-forge|security.forge-secret-prevention|Independent introduced-history secret prevention|A2|3|Pinned receive adapter, lifecycle template and fail-closed scan|Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate|U07 U12|workplans/FORGE-WP-0006-independent-secret-detection.md
railiance-apps|railiance.workload-deployment-tooling|Workload release configuration and guards|A2|3|Helm/manifests, exact image pins, application runbooks and rollout/rollback|Release settings depend on underlying platform and workload owners|U12 U13|SCOPE.md
railiance-bootstrap|railiance.bootstrap-sequencing|Bootstrap sequencing contracts|A0|1|Bare-VM to estate sequence and handoff contract|End-to-end unattended rebuild is not established|U10 U14|SCOPE.md
rail-kubernetes|railiance.kubernetes-rail|Generic Kubernetes workload lifecycle|A2|2|Workload declaration, rollout, observe, promote and rollback surfaces|Compatibility extraction remains; not cluster or application-domain ownership|U13 U14|SCOPE.md
reef-railiance|railiance.substrate-bindings|Substrate topology and bindings|A0|2|Grouped home-reef identity, topology and placement declarations|Declarations are not automatic placement or authorization|U13 U14|SCOPE.md
railiance-fabric|railiance.fabric-graph|Infrastructure ownership and dependency graph|A2|2|Schemas, validation, graph queries and State Hub exports|Graph assertions need current owner evidence; not an enforcement registry|U09 U13 U14|SCOPE.md
rapp-openbao|railiance.openbao-package|Managed OpenBao deployment package|A2|3|Helm values, package deploy/status/smoke/rollback and custody boundary|Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit|U04 U10 U13|README.md;docs/retained-s3-handoff.md
rapp-postgres|railiance.postgres-isolation-recovery|Database isolation and recovery package|A2|3|CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures|Host-loss proof and consumer schemas stay with their owners|U03 U10 U13|SCOPE.md
rapp-user-engine|railiance.user-engine-package|User Engine runtime package|A2|3|Pinned deployment, dedicated CNPG, ExternalSecret references and rollback|Domain, identity, PDP and custody authority are separate|U02 U10 U13|SCOPE.md
rapp-tenant-engine|railiance.tenant-engine-package|Tenant Engine runtime package|A2|2|Package declaration, smoke and rollback|No tenant-domain ownership or credential values|U03 U13|SCOPE.md
rapp-policy-nexus|railiance.policy-publication-package|Policy publication runtime package|A2|3|Immutable image, non-root/read-only runtime and approved TLS exposure|No policy authoring or DNS/issuer administration|U01 U13|SCOPE.md
rapp-playwright|railiance.browser-verification|Managed browser verification pilot|A4|2|Bounded jobs, cancellation, artifacts, origin checks and restart receipts|Pilot deployed; human/agent authentication and per-caller self-service connectivity pending|U02 U14|SCOPE.md
railiance-telemetry|observability.security-signals|Security-relevant telemetry contracts and adapters|A2|2|Signal contract, platform adapters, report exporter and absence/alert rules|Reference receiver is not a second production plane; end-to-end delivery acceptance pending|U08 U09|SCOPE.md;README.md
rapp-telemetry|railiance.telemetry-package|Private monitoring package|A2|2|Prometheus, Alertmanager and Grafana package with isolated restore evidence|Private installation only; recurring recovery capture and audited confirmation pending|U08 U09 U10|SCOPE.md
resource-control|resources.security-capacity|Capacity and recovery resource planning|A2|2|Provider-neutral inventory, procurement evidence and optimization reports|No payment authority or irreversible procurement; metrics do not prove usable runtime capacity|U09 U10 U13|SCOPE.md
fin-hub|finance.security-budget-evidence|Budget and cost evidence for security operations|A4|2|Budget, commitment, spend attribution and planning-evidence consumption|No verified concurrent runtime EUR risk/cost enforcement for agents|U09 U11|SCOPE.md
'''
rows=[]
for line in DATA.strip().splitlines():
repo,suffix,name,a,op,surface,limit,ucs,arts=line.split('|')
rows.append(dict(repo=repo,id='capability.'+suffix,name=name,availability=a,operational_estimate=int(op),surface=surface,limitation=limit,use_cases=ucs.split(),artifacts=arts.split(';')))
# Source and current registry evidence, content hashes only (never credentials).
repos={}
for repo in sorted({r['repo'] for r in rows}):
root=BASE/repo
def git(*args):
p=subprocess.run(['git','-C',str(root),*args],capture_output=True,text=True);return p.stdout.strip()
ix=root/'registry/indexes/capabilities.yaml'
index=yaml.safe_load(ix.read_text()) if ix.exists() else {}
sources=sorted(set(['INTENT.md','SCOPE.md','README.md']+[a for r in rows if r['repo']==repo for a in r['artifacts']]))
hashes={p:'sha256:'+hashlib.sha256((root/p).read_bytes()).hexdigest() for p in sources if (root/p).is_file()}
missing=[p for r in rows if r['repo']==repo for p in r['artifacts'] if not (root/p).is_file()]
repos[repo]={'head':git('rev-parse','HEAD'),'branch':git('branch','--show-current'),'dirty_paths':git('status','--short').splitlines(),'source_sha256':hashes,'missing_review_artifacts':missing,'existing_index':index}
for r in [x for x in rows if x['repo']==repo]:
old=next((c for c in (index or {}).get('capabilities',[]) if c.get('id')==r['id']),None)
r['existing_entry_path']=old.get('path') if old else None
r['prior_vector']=old.get('vector') if old else None
r['vector']='D3 / '+r['availability']+' / C1 / R0'
(OUT/'inventory.json').write_text(json.dumps({'as_of':'2026-10-14','capabilities':rows,'repositories':repos},indent=2)+'\n')
print(json.dumps({'repos':len(repos),'capabilities':len(rows),'existing':sum(bool(r['existing_entry_path']) for r in rows),'missing_artifacts':{k:v['missing_review_artifacts'] for k,v in repos.items() if v['missing_review_artifacts']}},indent=2))

504
docs/assessments/netkingdom-2026-10-14/capability-inventory.md Normal file
View file

@ -0,0 +1,504 @@
# NetKingdom repository and capability inventory
Assessed 2026-10-14. See the [architecture review](../../netkingdom-security-architecture-review.md) for use cases U01–U14, evidence rules, operational maturity M1–M5 and D/A/C/R definitions. Existing external evidence levels are owner claims, not newly certified scores.
**60 capability-owning repositories, 70 reviewed capabilities, plus two inspected nonproviders.**
## access-engine
Source revision `16ca97b2776789f730cc7049a2d6533612faaccd`. [Owner scope](../../../../access-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Policy evaluation and decision evidence](../../../../access-engine/SCOPE.md)<br>`capability.authorization.policy-evaluate` | Check, batch, list-allowed, explain, binding, lifetime and decision records.<br>U03, U04, U05, U06 | D4 / A4 / C2 / R1<br>M3 estimate | One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct. |
## activity-core
Source revision `83e6446807c4b36f3aa5023a5c16d4c7df8bd3df`. [Owner scope](../../../../activity-core/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Durable automation and bounded operations](../../../../activity-core/SCOPE.md)<br>`capability.activity.event-coordinate` | Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.<br>U09, U12 | D3 / A4 / C1 / R0<br>M3 estimate | Not a general shell executor; first unassisted security-flow cadence acceptance remains open. |
## agentic-resources
Source revision `65b3a5cb6bf3eb214b492b95a38f2eb729f89709`. [Owner scope](../../../../agentic-resources/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Agent performance learning](../../../../agentic-resources/SCOPE.md)<br>`capability.agents.performance-learning` | Capture sessions, curate patterns, distribute lessons and measure outcomes.<br>U09, U11 | D3 / A2 / C1 / R0<br>M2 estimate | Workforce assignments and broader authority contracts remain proposed. |
## approval-engine
Source revision `e1649617e8ad321f79632d5fd33e973ae5d5ae51`. [Owner scope](../../../../approval-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Bound approval lifecycle](../../../../approval-engine/SCOPE.md)<br>`capability.security.approval-lifecycle` | Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.<br>U04, U05, U06 | D3 / A4 / C1 / R0<br>M2 estimate | Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open. |
## audit-core
Source revision `f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9`. [Owner scope](../../../../audit-core/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Independent audit custody](../../../../audit-core/SCOPE.md)<br>`capability.audit.event-retain` | Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.<br>U08, U09, U10 | D3 / A4 / C3 / R2<br>M3 estimate | Custody after arrival does not prove source completeness; freshness bounds integrity assertions. |
## coordination-engine
Source revision `c401067842072b75717f76480dd6e7db1836059c`. [Owner scope](../../../../coordination-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Cross-owner coordination lifecycle](../../../../coordination-engine/SCOPE.md)<br>`capability.coordination.cross-owner-work` | Observation, lease, wake-up, checkpoint and receipt contracts/runtime.<br>U09 | D3 / A2 / C1 / R0<br>M2 estimate | Coordinates owners without replacing their execution or security authority. |
## emergent-security
Source revision `4c6fda38298fa50665ead41526b893adf069d335`. [Owner scope](../../../../emergent-security/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Verified security orientation for agents](../../../../emergent-security/SCOPE.md)<br>`capability.security.agent-knowledge` | Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports.<br>U01, U11, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Current start card withheld for source drift; orientation never grants authority. |
## fin-hub
Source revision `8f527c6705bbf5d7ffed43559411ca748bec8fe4`. [Owner scope](../../../../fin-hub/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Budget and cost evidence for security operations](../../../../fin-hub/SCOPE.md)<br>`capability.finance.security-budget-evidence` | Budget, commitment, spend attribution and planning-evidence consumption.<br>U09, U11 | D3 / A4 / C1 / R0<br>M2 estimate | No verified concurrent runtime EUR risk/cost enforcement for agents. |
## gate-house
Source revision `bc890c4d050a2e726ce8988a8260ab9caea133e3`. [Owner scope](../../../../gate-house/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security doctrine and architecture review](../../../../gate-house/SCOPE.md)<br>`capability.security.doctrine-review` | Layer rules, authority context, ASM criteria and interpretations.<br>U01, U09, U14 | D3 / A0 / C1 / R0<br>M3 estimate | Staff judgment; no runtime PDP, credential issuer or automatic enforcement. |
## glas-harness
Source revision `7b1557ba14f483569b90ebfdc2d0136fa69602fe`. [Owner scope](../../../../glas-harness/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Profile-bound agent execution lifecycle](../../../../glas-harness/SCOPE.md)<br>`capability.execution.profile-harness` | Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration.<br>U11 | D3 / A3 / C1 / R0<br>M2 estimate | No ready profile asserted by SCOPE; Custodian native isolation remains open. |
## info-tech-canon
Source revision `3d206a56f4ece439f6ee87f9ee4d1800ab82166e`. [Owner scope](../../../../info-tech-canon/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Shared semantic contracts and validation](../../../../info-tech-canon/SCOPE.md)<br>`capability.infotech.canon-service` | Markdown canon with library, CLI and read-only API.<br>U01, U08, U14 | D2 / A4 / C1 / R0<br>M2 estimate | Mixed seed/candidate maturity; validation is not owner runtime conformance. |
## informed-decision
Source revision `ee6a65b80a0fea1a914dfa31434b903669656c09`. [Owner scope](../../../../informed-decision/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Human security decision presentation and disposition](../../../../informed-decision/SCOPE.md)<br>`capability.security.human-decision-workspace` | Headless lifecycle and browser workspace with exact native approval references.<br>U04, U05, U09 | D3 / A4 / C1 / R0<br>M3 estimate | Initial audience is bounded; Approval Engine owns approval state, Access Engine decides. |
## issue-core
Source revision `de368271f6ffc06353ec409998a0d6d0ec0bf25e`. [Owner scope](../../../../issue-core/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [External issue tracker connector](../../../../issue-core/README.md)<br>`capability.infotech.issue-tracking` | CLI and Python adapters for external issue systems.<br>U09 | D4 / A2 / C2 / R1<br>M2 estimate | Internal work originates in owner files; external projection is optional. |
## key-cape
Source revision `1344fc80e56315c5c99f58993f9ee02ce79e8a76`. [Owner scope](../../../../key-cape/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [OIDC identity and assurance](../../../../key-cape/SCOPE.md)<br>`capability.iam.key-cape` | OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.<br>U02, U03, U04, U10 | D4 / A4 / C2 / R1<br>M3 estimate | Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates. |
## kings-guard
Source revision `af02e2547598d6ec0e83f482d9ea3ef943ea67b7`. [Owner scope](../../../../kings-guard/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security posture assessment and response proposals](../../../../kings-guard/SCOPE.md)<br>`capability.security.posture-assessment` | Normalized observation evaluator, cadence checks and secret-use snapshot adapter.<br>U08, U09 | D3 / A2 / C1 / R0<br>M2 estimate | Bounded reference pilot; containment proposals only; deployed-stream admission remains open. |
## maturity-engine
Source revision `2f1de542cc8f24a79452f906d99f95be39d8b6a9`. [Owner scope](../../../../maturity-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Evidence-based maturity claims and gap register](../../../../maturity-engine/SCOPE.md)<br>`capability.security.maturity-claims` | SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory.<br>U09, U14 | D3 / A2 / C1 / R0<br>M2 estimate | No production deployment claimed; levels supply facts and cannot authorize actions. |
## net-kingdom
Source revision `1a36e857cc5aae6fe738f794417126c46dd94627`. [Owner scope](../../../../net-kingdom/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [NetKingdom security architecture and conformance tooling](../../../../net-kingdom/SCOPE.md)<br>`capability.security.iam-tooling-suite` | Versioned IAM, layer, tenancy and credential contracts plus validators.<br>U01, U02, U03, U14 | D3 / A2 / C1 / R1<br>M2 estimate | Mixed accepted and proposed standards; framework integration remains incomplete. |
| [Deterministic security scenario composition](../../../../net-kingdom/tools/security-scenario-composer/README.md)<br>`capability.security.scenario-compose` | CLI selects pinned providers and orders trust transitions.<br>U01, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Plan only; execution.permitted is always false. |
| [Deterministic posture feedback](../../../../net-kingdom/tools/posture-feedback/README.md)<br>`capability.security.posture-feedback` | CLI evaluates evidence age and posture into owner-routed findings.<br>U09, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Proposal only; no policy changes or remediation execution. |
| [Security case types and instance validation](../../../../net-kingdom/tools/security-case-types/README.md)<br>`capability.security.case-contracts` | Versioned types, cases and schema validation.<br>U01, U05, U06 | D3 / A2 / C1 / R0<br>M2 estimate | Type acknowledgment, case acceptance, structural materialization and native execution are distinct. |
| [Guarded bootstrap and recovery preparation](../../../../net-kingdom/tools/security-bootstrap-console/README.md)<br>`capability.security.bootstrap-recovery` | Local identity, bootstrap console, encrypted custody handoff and caller tools.<br>U10 | D3 / A2 / C1 / R0<br>M2 estimate | Source repairs and disposable native fixtures do not prove estate root isolation or recovery. |
| [Security emission cadence validation](../../../../net-kingdom/tools/emission-cadence-profile/README.md)<br>`capability.security.emission-profile` | Security profile over generic emission contracts and validator.<br>U08, U09 | D3 / A2 / C1 / R0<br>M2 estimate | Profile adoption and source completeness require owner-native evidence. |
## ops-bridge
Source revision `190ef1e188e12c606f1359325fd9fdd1dbef29e2`. [Owner scope](../../../../ops-bridge/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [SSH tunnel lifecycle](../../../../ops-bridge/SCOPE.md)<br>`capability.ops.tunnel-bridge` | Named tunnels, reconnect, health and TTL-aware cert_command.<br>U06 | D3 / A2 / C2 / R1<br>M3 estimate | Private transport does not authenticate applications or decide access. |
## ops-mason
Source revision `d86ad141befb6800468f5132d4c7c9ce2f852bb5`. [Owner scope](../../../../ops-mason/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Reviewed security structure construction](../../../../ops-mason/SCOPE.md)<br>`capability.security.structure-construction` | Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.<br>U01, U05, U06 | D3 / A2 / C1 / R0<br>M2 estimate | Founder plan gate is an explicit exception; not full PDP conformance. |
## ops-warden
Source revision `6d2f1be9691b19e826898a2166ae4451e4802ae2`. [Owner scope](../../../../ops-warden/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Decision-bound SSH certificates](../../../../ops-warden/SCOPE.md)<br>`capability.security.ssh-certificate-issuance` | warden sign with local and OpenBao backends and adm/agt/atm actors.<br>U06 | D4 / A3 / C3 / R2<br>M3 estimate | Direct Tooling contact is a declared gap; certificate reachability is not target authorization. |
| [Credential routing and contained access](../../../../ops-warden/SCOPE.md)<br>`capability.security.access-routing` | warden route and access catalog; exact lane conduit and secret-exec routing.<br>U04, U05, U06 | D3 / A3 / C1 / R0<br>M3 estimate | Routing grants no authority; interim delegates and attended high-risk lanes persist. |
| [Security case operational follow-through](../../../../ops-warden/workplans/WARDEN-WP-0044-security-case-follow-through.md)<br>`capability.security.case-follow-through` | KnownSecurityCase route, plan and operational receipts.<br>U01, U05, U06 | D3 / A2 / C1 / R0<br>M2 estimate | Execution requires accepted structure and exact owner contracts; case closure is not automatic. |
## policy-nexus
Source revision `f784f017b0822f34c785f0b34c7c55fcf39c9d99`. [Owner scope](../../../../policy-nexus/README.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Policy publication with source provenance](../../../../policy-nexus/README.md)<br>`capability.security.policy-publication` | Generated immutable publication, source currency and stable policy URLs.<br>U01, U09, U14 | D3 / A2 / C1 / R0<br>M3 estimate | Publication does not ratify policy or enforce it. |
## rail-knative
Source revision `cd38dba3653e7fc85d3b2d3a074811b9a7216f25`. [Owner scope](../../../../rail-knative/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Knative workload lifecycle](../../../../rail-knative/SCOPE.md)<br>`capability.railiance.knative-rail` | Derived rail for activation, revisions, traffic, scaling and rollback.<br>U09, U13, U14 | D3 / A2 / C1 / R0<br>M3 estimate | Inherits Kubernetes common contract; verified readiness is not production approval. |
## rail-kubernetes
Source revision `35159e49c1340b7a0e30c49188975c8839d346f6`. [Owner scope](../../../../rail-kubernetes/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Generic Kubernetes workload lifecycle](../../../../rail-kubernetes/SCOPE.md)<br>`capability.railiance.kubernetes-rail` | Workload declaration, rollout, observe, promote and rollback surfaces.<br>U13, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Compatibility extraction remains; not cluster or application-domain ownership. |
## railiance-apps
Source revision `706461b845086ee2df8ce9acae3dae7feebfffda`. [Owner scope](../../../../railiance-apps/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Workload release configuration and guards](../../../../railiance-apps/SCOPE.md)<br>`capability.railiance.workload-deployment-tooling` | Helm/manifests, exact image pins, application runbooks and rollout/rollback.<br>U12, U13 | D3 / A2 / C1 / R1<br>M3 estimate | Release settings depend on underlying platform and workload owners. |
## railiance-bootstrap
Source revision `ae00b2652737aaf18358431e66f59eeb7c01e16b`. [Owner scope](../../../../railiance-bootstrap/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Bootstrap sequencing contracts](../../../../railiance-bootstrap/SCOPE.md)<br>`capability.railiance.bootstrap-sequencing` | Bare-VM to estate sequence and handoff contract.<br>U10, U14 | D3 / A0 / C1 / R0<br>M1 estimate | End-to-end unattended rebuild is not established. |
## railiance-cluster
Source revision `12d1e881ff2086566712fbc591db293b38ea2bcf`. [Owner scope](../../../../railiance-cluster/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Kubernetes runtime and cluster controls](../../../../railiance-cluster/SCOPE.md)<br>`capability.railiance.cluster-bootstrap` | k3s, ingress, CNI, operators and kubeconfig/runtime checks.<br>U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Single-node runtime and workload recovery are distinct from bootstrap success. |
## railiance-enablement
Source revision `51a7c4cee68b48ed7a236e661b39c1d3cca92063`. [Owner scope](../../../../railiance-enablement/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Developer delivery and CI templates](../../../../railiance-enablement/SCOPE.md)<br>`capability.railiance.ci-enablement` | Reusable CI workflows, build and deployment patterns.<br>U12, U14 | D3 / A2 / C2 / R1<br>M2 estimate | Templates do not prove mandatory checks or runner isolation. |
## railiance-fabric
Source revision `96d19127125e85bdab7ff0ff79fc3ecf7d19045e`. [Owner scope](../../../../railiance-fabric/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Infrastructure ownership and dependency graph](../../../../railiance-fabric/SCOPE.md)<br>`capability.railiance.fabric-graph` | Schemas, validation, graph queries and State Hub exports.<br>U09, U13, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Graph assertions need current owner evidence; not an enforcement registry. |
## railiance-forge
Source revision `a15fac8e938c11b041eb39386f05b63d46ae566a`. [Owner scope](../../../../railiance-forge/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Source forge, registries and runner substrate](../../../../railiance-forge/SCOPE.md)<br>`capability.railiance.forge-infrastructure` | Forgejo operation, package registries and runner lifecycle.<br>U12 | D3 / A2 / C1 / R0<br>M3 estimate | Runner workload authority and independent verification coverage remain open. |
| [Independent introduced-history secret prevention](../../../../railiance-forge/workplans/FORGE-WP-0006-independent-secret-detection.md)<br>`capability.security.forge-secret-prevention` | Pinned receive adapter, lifecycle template and fail-closed scan.<br>U07, U12 | D3 / A2 / C1 / R0<br>M3 estimate | Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate. |
## railiance-infra
Source revision `ef64e324b61e9aa9b9ed03aad7dd2101915057ca`. [Owner scope](../../../../railiance-infra/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Host convergence and security baseline](../../../../railiance-infra/SCOPE.md)<br>`capability.railiance.infra-provisioning` | Ansible inventory, firewall, SSH bootstrap and baseline verification.<br>U06, U10, U13 | D4 / A2 / C2 / R1<br>M3 estimate | Current hosts differ from the retained Hetzner provisioning path. |
## railiance-master
Source revision `865c3bed86b3992244b29d6f1d6b8ebbe8db78c7`. [Owner scope](../../../../railiance-master/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Platform security consumption architecture](../../../../railiance-master/SCOPE.md)<br>`capability.railiance.security-consumption-contracts` | Rail/rapp/reef boundaries, exposure and security consumption contracts.<br>U01, U13, U14 | D3 / A0 / C1 / R0<br>M2 estimate | Architecture declarations do not prove implementation or production admission. |
## railiance-platform
Source revision `d303c99e3be993ffa989bc9ba3d7b471903858ce`. [Owner scope](../../../../railiance-platform/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Secret custody and platform data services](../../../../railiance-platform/SCOPE.md)<br>`capability.railiance.platform-services` | OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.<br>U04, U05, U07, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Package ownership is split to rapp repos; caches and object services are demand-led. |
## railiance-telemetry
Source revision `81d905971c38de9aaf11088ba605e112152d8268`. [Owner scope](../../../../railiance-telemetry/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security-relevant telemetry contracts and adapters](../../../../railiance-telemetry/SCOPE.md)<br>`capability.observability.security-signals` | Signal contract, platform adapters, report exporter and absence/alert rules.<br>U08, U09 | D3 / A2 / C1 / R0<br>M2 estimate | Reference receiver is not a second production plane; end-to-end delivery acceptance pending. |
## rapp-openbao
Source revision `13ab9144bbb1d88fe760362df91a83c8b34e4e66`. [Owner scope](../../../../rapp-openbao/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Managed OpenBao deployment package](../../../../rapp-openbao/README.md)<br>`capability.railiance.openbao-package` | Helm values, package deploy/status/smoke/rollback and custody boundary.<br>U04, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit. |
## rapp-playwright
Source revision `2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. [Owner scope](../../../../rapp-playwright/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Managed browser verification pilot](../../../../rapp-playwright/SCOPE.md)<br>`capability.railiance.browser-verification` | Bounded jobs, cancellation, artifacts, origin checks and restart receipts.<br>U02, U14 | D3 / A4 / C1 / R0<br>M2 estimate | Pilot deployed; human/agent authentication and per-caller self-service connectivity pending. |
## rapp-policy-nexus
Source revision `d3fee97d32ad47e3a7e3201a9c5b7209b4333fda`. [Owner scope](../../../../rapp-policy-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Policy publication runtime package](../../../../rapp-policy-nexus/SCOPE.md)<br>`capability.railiance.policy-publication-package` | Immutable image, non-root/read-only runtime and approved TLS exposure.<br>U01, U13 | D3 / A2 / C1 / R0<br>M3 estimate | No policy authoring or DNS/issuer administration. |
## rapp-postgres
Source revision `03744030c9258e920f6403a9ce184a26d7b75268`. [Owner scope](../../../../rapp-postgres/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Database isolation and recovery package](../../../../rapp-postgres/SCOPE.md)<br>`capability.railiance.postgres-isolation-recovery` | CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures.<br>U03, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Host-loss proof and consumer schemas stay with their owners. |
## rapp-sbom-nexus
Source revision `1566bcf69fc0757db5efc67f78b14af10d944c1b`. [Owner scope](../../../../rapp-sbom-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Private SBOM runtime and dynamic database delivery](../../../../rapp-sbom-nexus/SCOPE.md)<br>`capability.railiance.sbom-runtime-package` | Immutable deployment, private network policy, dynamic database leases and migration/rollback.<br>U07, U12, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Product owns schema and ingestion; database and backup authority remain with platform owners. |
## rapp-telemetry
Source revision `17053dbc47f7c22efd67fd90d06d108d154835fa`. [Owner scope](../../../../rapp-telemetry/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Private monitoring package](../../../../rapp-telemetry/SCOPE.md)<br>`capability.railiance.telemetry-package` | Prometheus, Alertmanager and Grafana package with isolated restore evidence.<br>U08, U09, U10 | D3 / A2 / C1 / R0<br>M2 estimate | Private installation only; recurring recovery capture and audited confirmation pending. |
## rapp-tenant-engine
Source revision `c160be23577ab4d99ee2cd008deb455b07f0597d`. [Owner scope](../../../../rapp-tenant-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Tenant Engine runtime package](../../../../rapp-tenant-engine/SCOPE.md)<br>`capability.railiance.tenant-engine-package` | Package declaration, smoke and rollback.<br>U03, U13 | D3 / A2 / C1 / R0<br>M2 estimate | No tenant-domain ownership or credential values. |
## rapp-user-engine
Source revision `15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c`. [Owner scope](../../../../rapp-user-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [User Engine runtime package](../../../../rapp-user-engine/SCOPE.md)<br>`capability.railiance.user-engine-package` | Pinned deployment, dedicated CNPG, ExternalSecret references and rollback.<br>U02, U10, U13 | D3 / A2 / C1 / R0<br>M3 estimate | Domain, identity, PDP and custody authority are separate. |
## reef-railiance
Source revision `ffb9e272ce1489cc37cc6388873558d8ba56c239`. [Owner scope](../../../../reef-railiance/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Substrate topology and bindings](../../../../reef-railiance/SCOPE.md)<br>`capability.railiance.substrate-bindings` | Grouped home-reef identity, topology and placement declarations.<br>U13, U14 | D3 / A0 / C1 / R0<br>M2 estimate | Declarations are not automatic placement or authorization. |
## rein-aharness
Source revision `398949a3d34b6c9faae0fa1d0ff0aa039565aa42`. [Owner scope](../../../../rein-aharness/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Scheduled agent intake and harness routing](../../../../rein-aharness/SCOPE.md)<br>`capability.execution.scheduled-agent-rein` | Activity Core lease claim/heartbeat and Glas profile execution.<br>U09, U11 | D3 / A2 / C1 / R0<br>M3 estimate | Legacy paths are time-gated; task success is not privileged authority. |
## rein-openweights
Source revision `e1fccb39b738a5381a9de6e1d799f124797798ce`. [Owner scope](../../../../rein-openweights/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Bounded open-weight agent execution](../../../../rein-openweights/SCOPE.md)<br>`capability.execution.openweight-rein` | Tool loop, path guards, turn/budget limits and verified-commit result.<br>U11 | D3 / A2 / C1 / R0<br>M2 estimate | Provider credential acquisition and runtime authority need separate custody controls. |
## repo-manager
Source revision `7677b00f69cd6362ac16a1021dc180ec6df4ebfa`. [Owner scope](../../../../repo-manager/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Repository metadata and staged-secret prevention](../../../../repo-manager/SCOPE.md)<br>`capability.security.repository-secret-prevention` | Repository observation plus pinned staged-blob scanner and hook integration.<br>U07, U12 | D3 / A2 / C1 / R0<br>M3 estimate | Local hooks are bypassable; coverage is exact-checkout scoped. |
## resource-control
Source revision `3604d468f86ede7d320f4d22dd4aea775306b53f`. [Owner scope](../../../../resource-control/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Capacity and recovery resource planning](../../../../resource-control/SCOPE.md)<br>`capability.resources.security-capacity` | Provider-neutral inventory, procurement evidence and optimization reports.<br>U09, U10, U13 | D3 / A2 / C1 / R0<br>M2 estimate | No payment authority or irreversible procurement; metrics do not prove usable runtime capacity. |
## reuse-surface
Source revision `a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1`. [Owner scope](../../../../reuse-surface/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Capability registry and federation](../../../../reuse-surface/docs/RegistryFederation.md)<br>`capability.registry.register` | Owner Markdown entries, indexes, federation hub and planning queries.<br>U01, U09, U14 | D3 / A3 / C2 / R3<br>M3 estimate | Discovery is not readiness; empty and stale entries need evidence-led maintenance. |
| [Capability registry validation](../../../../reuse-surface/docs/RegistryFederation.md)<br>`capability.registry.validate` | Schema, index consistency and relation checks.<br>U01, U14 | D4 / A3 / C3 / R3<br>M3 estimate | Schema validity alone proves neither capability behavior nor hosted freshness. |
## risk-nexus
Source revision `b877231d66e1289dc32fda07ed2c61dcb3e970dc`. [Owner scope](../../../../risk-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security risk and exception review register](../../../../risk-nexus/SCOPE.md)<br>`capability.security.risk-register` | Markdown findings and Python review, verification and due-work reports.<br>U09, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Judgment remains human or agent; no live EUR risk gate or autonomous response. |
## role-engine
Source revision `d231241dbfeeb541b34243f4022883aa6417a1eb`. [Owner scope](../../../../role-engine/README.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Organizational role definitions](../../../../role-engine/README.md)<br>`capability.organization.role-catalog` | Versioned documentation catalog.<br>U01, U11 | D3 / A0 / C1 / R0<br>M1 estimate | Not IAM roles, assignments or runtime authorization. |
## runbook-tutorials
Source revision `df97fadf5decfcdb5c3c6ab90211226335ffdf8e`. [Owner scope](../../../../runbook-tutorials/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Guided administrative runbooks](../../../../runbook-tutorials/SCOPE.md)<br>`capability.infotech.runbook-tutorials` | Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.<br>U05, U10, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Owner supplies procedures; UI progress is not runtime approval. |
## sand-boxer
Source revision `b06d94f02b037764ff41c73c8ab43f4c8f5d309d`. [Owner scope](../../../../sand-boxer/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Sandbox establishment and lifecycle](../../../../sand-boxer/SCOPE.md)<br>`capability.execution.sandbox-provision` | Profiles, extensions, provision, checkpoints, TTL teardown and telemetry.<br>U11, U14 | D5 / A5 / C5 / R0<br>M2 estimate | Backend-specific guarantees; a created sandbox alone proves no credential isolation. |
## sbom-nexus
Source revision `07e998d9abfd4e4fcc74db9e292ed22c6f407522`. [Owner scope](../../../../sbom-nexus/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Dependency provenance and SBOM evidence](../../../../sbom-nexus/README.md)<br>`capability.infotech.sbom-management` | Controlled archive ingest, immutable snapshots, freshness and license review.<br>U12, U09 | D3 / A4 / C1 / R0<br>M3 estimate | SBOM and license evidence do not prove vulnerability exploitability or artifact trust. |
## secrets-engine
Source revision `d379a3dfba73c42cd97f4d9cba3a02d705155e4d`. [Owner scope](../../../../secrets-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Cataloged credential lifecycle](../../../../secrets-engine/SCOPE.md)<br>`capability.security.credential-lifecycle` | CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.<br>U04, U05, U07 | D3 / A2 / C1 / R0<br>M2 estimate | Production protected execution and independently anchored PDP authentication remain incomplete. |
## security-canon
Source revision `1664a6def20be2759a1e575024563efd27c9f36f`. [Owner scope](../../../../security-canon/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Security practice and authority vocabulary](../../../../security-canon/SCOPE.md)<br>`capability.security.practice-canon` | Versioned SEC-DSM and Mode of Authority documents.<br>U01, U07, U10, U14 | D3 / A0 / C1 / R0<br>M2 estimate | Normative practice; no runtime control or certification. |
## state-hub
Source revision `8ca9201f6a1445c66fe1d1b0ba0c8d044c131647`. [Owner scope](../../../../state-hub/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Cross-repository work tracking](../../../../state-hub/README.md)<br>`capability.statehub.workstream-coordinate` | File-derived workplans, tasks, dependencies, decisions and coordination views.<br>U09 | D4 / A4 / C3 / R2<br>M3 estimate | Read/cache/index of owner work; not runtime approval authority. |
| [Progress and work evidence indexing](../../../../state-hub/README.md)<br>`capability.statehub.progress-log` | REST progress and task evidence references.<br>U08, U09 | D4 / A4 / C3 / R3<br>M3 estimate | Not independent security event custody. |
## tenant-engine
Source revision `1dabbcf47d87d27d118dcf3147d9e3588a807e0c`. [Owner scope](../../../../tenant-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Tenant lifecycle and guardrail facts](../../../../tenant-engine/SCOPE.md)<br>`capability.identity.tenant-facts` | Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.<br>U03, U04 | D3 / A4 / C1 / R0<br>M3 estimate | Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate. |
## the-custodian
Source revision `3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e`. [Owner scope](../../../../the-custodian/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Generic agent runtime and repository tooling](../../../../the-custodian/runtime/README.md)<br>`capability.agents.custodian-runtime-tooling` | Agent runtime modules and repository classification tooling.<br>U09, U11, U14 | D2 / A2 / C1 / R0<br>M2 estimate | Only generic tooling is reusable; confidential canon and session memory are excluded. |
## user-engine
Source revision `85a419d6c5d0b4434d3ca7f33bde3092f5838f79`. [Owner scope](../../../../user-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [User lifecycle and account journeys](../../../../user-engine/SCOPE.md)<br>`capability.identity.user-engine` | Accounts, identity links, membership, MFA and recovery portal, advisory catalog.<br>U02, U03, U10 | D4 / A4 / C2 / R0<br>M3 estimate | Application readback is advisory; applications must enforce their own authorization. |
## whitehat-security
Source revision `5587a8f6ac4b129527db819bc72832051c7fcc3b`. [Owner scope](../../../../whitehat-security/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Authorized adversarial evidence harness](../../../../whitehat-security/SCOPE.md)<br>`capability.security.adversarial-evidence` | Offline ASM and tenancy calibrations and engagement admission.<br>U03, U08, U10, U14 | D3 / A2 / C1 / R0<br>M2 estimate | Live probes require a complete engagement; no blanket target authorization. |
## zone-engine
Source revision `b5a6f88a82b125ebc82c0484bec1ea541e4f95d0`. [Owner scope](../../../../zone-engine/SCOPE.md).
| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation |
| --- | --- | --- | --- |
| [Zone membership reference conformance](../../../../zone-engine/SCOPE.md)<br>`capability.security.zone-reference` | Offline resolution, exception and lineage checks.<br>U01, U03, U14 | D3 / A2 / C1 / R0<br>M2 estimate | No live zone engine, PDP or protected side effects. |
## Inspected nonproviders
| Repo | Disposition |
| --- | --- |
| [rapp-secrets-engine](../../../../rapp-secrets-engine/README.md) | Retired compatibility stub. Secrets Engine is a CLI/workflow capability; no independent workload is available. No capability was invented to populate this tombstone. |
| [rapp-forgejo](../../../../rapp-forgejo/README.md) | Placeholder with no family declaration. Current Forgejo deployment responsibility remains in the existing Forge/Apps owners. The package family check reports this missing declaration. |
The existing reuse-surface `capability.infotech.headless-browser` remains an additional discovery card for selecting browser tooling. The reviewed `rapp-playwright` capability describes the concrete managed package/provider. This review preserves the discovery card and does not treat the two IDs as two independent browser implementations.

10
docs/assessments/netkingdom-2026-10-14/commit-scan-diagnosis.json Normal file
View file

@ -0,0 +1,10 @@
{
"initial_commit": "blocked by generic-api-key on inventory JSON",
"diagnosis": "All flagged fields were SHA-256 hashes of source files; each value independently recomputed and matched before changing serialization. No credential contents were collected in these fields.",
"remediation": "Qualify source digest strings with sha256: rather than placing bare hex immediately after API/credential-like filename keys. No scanner exception or rule change.",
"affected_artifacts": [
"inventory.json",
"full-inventory.json"
],
"verification": "Normal pre-commit scanner must pass on the revised evidence."
}

42
docs/assessments/netkingdom-2026-10-14/completion-audit.json Normal file
View file

@ -0,0 +1,42 @@
{
"objective_achieved": false,
"requirements": [
{
"requirement": "All relevant repository and capability inventory",
"status": "complete",
"evidence": "full-inventory.json: 60 providers, 70 capabilities; two nonproviders recorded separately"
},
{
"requirement": "Supported use cases",
"status": "complete",
"evidence": "14 use cases in review, owner entries and inventory"
},
{
"requirement": "SWOT",
"status": "complete",
"evidence": "Architecture review SWOT table"
},
{
"requirement": "Maturity estimate",
"status": "complete",
"evidence": "Operational M1\u2013M5 estimates and separate D/A/C/R per capability with limits"
},
{
"requirement": "Ranked improvements for architecture efficiency and framework reuse",
"status": "complete",
"evidence": "12 ranked recommendations with owners, dependencies, effort and acceptance measures"
},
{
"requirement": "Owner capability establishment and local reuse-surface discovery",
"status": "complete",
"evidence": "70/70 local schema, relations, index parity and native federation checks; normal CLI discovery; 60 published source registries"
},
{
"requirement": "Hosted reuse-surface establishment",
"status": "incomplete",
"evidence": "32/70 hosted; 38 registrations pending caller access; seven also require private-source admission"
}
],
"goal_status": "active",
"remaining_action": "Owner-approved hub-write access and private-source read/disclosure admission; apply exact plan and verify all 70 hosted IDs and source parity."
}

1502
docs/assessments/netkingdom-2026-10-14/federated-local.yaml Normal file
View file

File diff suppressed because it is too large Load diff

1461
docs/assessments/netkingdom-2026-10-14/federated-staged.yaml Normal file
View file

File diff suppressed because it is too large Load diff

244
docs/assessments/netkingdom-2026-10-14/federation-local.yaml Normal file
View file

@ -0,0 +1,244 @@
version: 1
domain: infotech
collision_policy: warn
sources:
- repo: access-engine
index: /home/worsch/access-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: activity-core
index: /home/worsch/activity-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: agentic-resources
index: /home/worsch/agentic-resources/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: approval-engine
index: /home/worsch/approval-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: audit-core
index: /home/worsch/audit-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: coordination-engine
index: /home/worsch/coordination-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: emergent-security
index: /home/worsch/emergent-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: fin-hub
index: /home/worsch/fin-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: gate-house
index: /home/worsch/gate-house/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: glas-harness
index: /home/worsch/glas-harness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: info-tech-canon
index: /home/worsch/info-tech-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: informed-decision
index: /home/worsch/informed-decision/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: issue-core
index: /home/worsch/issue-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: key-cape
index: /home/worsch/key-cape/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: kings-guard
index: /home/worsch/kings-guard/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: maturity-engine
index: /home/worsch/maturity-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: net-kingdom
index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-bridge
index: /home/worsch/ops-bridge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-mason
index: /home/worsch/ops-mason/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-warden
index: /home/worsch/ops-warden/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: policy-nexus
index: /home/worsch/policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rail-kubernetes
index: /home/worsch/rail-kubernetes/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-apps
index: /home/worsch/railiance-apps/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-bootstrap
index: /home/worsch/railiance-bootstrap/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-cluster
index: /home/worsch/railiance-cluster/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-enablement
index: /home/worsch/railiance-enablement/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-fabric
index: /home/worsch/railiance-fabric/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-forge
index: /home/worsch/railiance-forge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-infra
index: /home/worsch/railiance-infra/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-master
index: /home/worsch/railiance-master/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-platform
index: /home/worsch/railiance-platform/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-telemetry
index: /home/worsch/railiance-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-openbao
index: /home/worsch/rapp-openbao/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-playwright
index: /home/worsch/rapp-playwright/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-policy-nexus
index: /home/worsch/rapp-policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-postgres
index: /home/worsch/rapp-postgres/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-telemetry
index: /home/worsch/rapp-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-tenant-engine
index: /home/worsch/rapp-tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-user-engine
index: /home/worsch/rapp-user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reef-railiance
index: /home/worsch/reef-railiance/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-aharness
index: /home/worsch/rein-aharness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-openweights
index: /home/worsch/rein-openweights/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: repo-manager
index: /home/worsch/repo-manager/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: resource-control
index: /home/worsch/resource-control/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reuse-surface
index: /home/worsch/reuse-surface/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: risk-nexus
index: /home/worsch/risk-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: role-engine
index: /home/worsch/role-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: runbook-tutorials
index: /home/worsch/runbook-tutorials/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sand-boxer
index: /home/worsch/sand-boxer/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sbom-nexus
index: /home/worsch/sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: secrets-engine
index: /home/worsch/secrets-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: security-canon
index: /home/worsch/security-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: state-hub
index: /home/worsch/state-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: tenant-engine
index: /home/worsch/tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: the-custodian
index: /home/worsch/the-custodian/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: user-engine
index: /home/worsch/user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: whitehat-security
index: /home/worsch/whitehat-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: zone-engine
index: /home/worsch/zone-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rail-knative
index: /home/worsch/rail-knative/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-sbom-nexus
index: /home/worsch/rapp-sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true

236
docs/assessments/netkingdom-2026-10-14/federation-staged.yaml Normal file
View file

@ -0,0 +1,236 @@
version: 1
domain: infotech
collision_policy: warn
sources:
- repo: access-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: activity-core
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: agentic-resources
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: approval-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: audit-core
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: coordination-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: emergent-security
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: fin-hub
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: gate-house
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: glas-harness
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: info-tech-canon
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: informed-decision
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: issue-core
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: key-cape
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: kings-guard
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: maturity-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: net-kingdom
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-bridge
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-mason
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: ops-warden
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: policy-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rail-kubernetes
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-apps
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-bootstrap
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-cluster
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-enablement
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-fabric
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-forge
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-infra
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-master
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-platform
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: railiance-telemetry
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-openbao
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-playwright
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-policy-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-postgres
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-telemetry
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-tenant-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rapp-user-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reef-railiance
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-aharness
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: rein-openweights
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: repo-manager
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: resource-control
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: reuse-surface
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: risk-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: role-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: runbook-tutorials
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sand-boxer
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: sbom-nexus
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: secrets-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: security-canon
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: state-hub
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: tenant-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: the-custodian
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: user-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: whitehat-security
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml
enabled: true
required: true
- repo: zone-engine
index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml
enabled: true
required: true

2987
docs/assessments/netkingdom-2026-10-14/full-inventory.json Normal file
View file

File diff suppressed because it is too large Load diff

2154
docs/assessments/netkingdom-2026-10-14/hosted-after-publication.json Normal file
View file

File diff suppressed because it is too large Load diff

1872
docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json Normal file
View file

File diff suppressed because it is too large Load diff

714
docs/assessments/netkingdom-2026-10-14/hosted-before-repos.json Normal file
View file

@ -0,0 +1,714 @@
{
"count": 64,
"repos": [
{
"repo": "access-engine",
"url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-09-30T18:31:15+00:00",
"updated_at": "2026-09-30T18:31:15+00:00"
},
{
"repo": "activity-core",
"url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:46:54+00:00",
"updated_at": "2026-08-21T14:26:03+00:00",
"description": ""
},
{
"repo": "agentic-resources",
"url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:10+00:00",
"updated_at": "2026-08-20T21:44:26+00:00"
},
{
"repo": "artifact-store",
"url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:15+00:00",
"updated_at": "2026-08-20T21:44:27+00:00"
},
{
"repo": "audit-core",
"url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:46:57+00:00",
"updated_at": "2026-08-20T21:44:27+00:00"
},
{
"repo": "can-you-assist",
"url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:20+00:00",
"updated_at": "2026-08-20T21:44:27+00:00"
},
{
"repo": "citation-engine",
"url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:25+00:00",
"updated_at": "2026-08-20T21:44:28+00:00"
},
{
"repo": "citation-evidence",
"url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:30+00:00",
"updated_at": "2026-08-20T21:44:28+00:00"
},
{
"repo": "citation-work",
"url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:33+00:00",
"updated_at": "2026-08-20T21:44:29+00:00"
},
{
"repo": "commerce-canon",
"url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"description": "Canonical source after CFED-WP-0001-T03/T09; stable capability.identity identifiers retained.",
"registered_at": "2026-09-05T23:22:01+00:00",
"updated_at": "2026-09-05T23:22:01+00:00"
},
{
"repo": "config-atlas",
"url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "infotech",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-07-06T22:41:01+00:00",
"updated_at": "2026-08-20T21:44:29+00:00"
},
{
"repo": "coordination-engine",
"url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:37+00:00",
"updated_at": "2026-08-20T21:44:30+00:00"
},
{
"repo": "core-hub",
"url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-07-07T10:23:58+00:00",
"updated_at": "2026-07-07T10:23:58+00:00"
},
{
"repo": "domain-tree",
"url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:50:41+00:00",
"updated_at": "2026-08-20T21:44:30+00:00"
},
{
"repo": "email-connect",
"url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:20+00:00",
"updated_at": "2026-08-20T21:44:30+00:00"
},
{
"repo": "evidence-anchor",
"url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:25+00:00",
"updated_at": "2026-08-20T21:44:31+00:00"
},
{
"repo": "evidence-binder",
"url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:29+00:00",
"updated_at": "2026-08-21T08:31:50+00:00"
},
{
"repo": "evidence-source",
"url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:34+00:00",
"updated_at": "2026-08-20T21:44:32+00:00"
},
{
"repo": "feature-control",
"url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:01+00:00",
"updated_at": "2026-08-20T21:44:32+00:00"
},
{
"repo": "flex-auth",
"url": "https://forgejo.coulomb.social/coulomb/flex-auth/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": false,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:47:00+00:00",
"updated_at": "2026-09-30T18:31:16+00:00",
"description": "Superseded by access-engine (repo rename, FLEX-WP-0020). Kept disabled for audit."
},
{
"repo": "guide-board",
"url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:39+00:00",
"updated_at": "2026-08-20T21:44:33+00:00"
},
{
"repo": "helix-forge",
"url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:43+00:00",
"updated_at": "2026-08-20T21:44:33+00:00"
},
{
"repo": "hub-core",
"url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:04:51+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "human-resources",
"url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:52:48+00:00",
"updated_at": "2026-08-20T21:44:34+00:00"
},
{
"repo": "identity-canon",
"url": "https://forgejo.coulomb.social/coulomb/identity-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": false,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:02+00:00",
"updated_at": "2026-09-05T23:22:01+00:00",
"description": "Retired source registration after repository rename; replaced by commerce-canon under CFED-WP-0001-T09. Kept for history."
},
{
"repo": "ihp-railiance-probe",
"url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:42+00:00",
"updated_at": "2026-08-20T21:44:34+00:00"
},
{
"repo": "info-tech-canon",
"url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:45+00:00",
"updated_at": "2026-08-20T21:44:35+00:00"
},
{
"repo": "infospace-bench",
"url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:49+00:00",
"updated_at": "2026-08-20T21:44:35+00:00"
},
{
"repo": "inter-hub",
"url": "https://gitea.coulomb.social/coulomb/inter-hub/raw/main/registry/indexes/capabilities.yaml",
"enabled": false,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:18+00:00",
"updated_at": "2026-07-07T10:26:41+00:00"
},
{
"repo": "issue-core",
"url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:54+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "kaizen-agentic",
"url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:53:57+00:00",
"updated_at": "2026-08-20T21:44:36+00:00"
},
{
"repo": "key-cape",
"url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:00+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "kontextual-engine",
"url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:04+00:00",
"updated_at": "2026-08-20T21:44:36+00:00"
},
{
"repo": "llm-connect",
"url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:07+00:00",
"updated_at": "2026-08-20T21:44:37+00:00"
},
{
"repo": "markitect-filter",
"url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:09+00:00",
"updated_at": "2026-08-20T21:44:37+00:00"
},
{
"repo": "markitect-main",
"url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:54:13+00:00",
"updated_at": "2026-08-20T21:44:37+00:00"
},
{
"repo": "markitect-quarkdown",
"url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:36+00:00",
"updated_at": "2026-08-20T21:44:38+00:00"
},
{
"repo": "markitect-tool",
"url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:42+00:00",
"updated_at": "2026-08-20T21:44:38+00:00"
},
{
"repo": "net-kingdom",
"url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:46+00:00",
"updated_at": "2026-08-20T21:44:39+00:00"
},
{
"repo": "open-cmis-tck",
"url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:51+00:00",
"updated_at": "2026-08-20T21:44:39+00:00"
},
{
"repo": "open-reuse",
"url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:56+00:00",
"updated_at": "2026-08-20T21:44:39+00:00"
},
{
"repo": "ops-bridge",
"url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:55:59+00:00",
"updated_at": "2026-08-20T21:44:40+00:00"
},
{
"repo": "ops-hub",
"url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:04+00:00",
"updated_at": "2026-08-20T21:44:40+00:00"
},
{
"repo": "ops-warden",
"url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:09+00:00",
"updated_at": "2026-08-20T21:44:41+00:00"
},
{
"repo": "phase-memory",
"url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:13+00:00",
"updated_at": "2026-08-20T21:44:41+00:00"
},
{
"repo": "railiance-apps",
"url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:56:16+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-cluster",
"url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:57:59+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-enablement",
"url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:03+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-fabric",
"url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:30+00:00",
"updated_at": "2026-08-20T21:44:42+00:00"
},
{
"repo": "railiance-forge",
"url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:06+00:00",
"updated_at": "2026-08-20T21:44:42+00:00"
},
{
"repo": "railiance-infra",
"url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:09+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "railiance-platform",
"url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:46+00:00",
"updated_at": "2026-07-07T12:42:19+00:00"
},
{
"repo": "repo-scoping",
"url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:52+00:00",
"updated_at": "2026-08-20T21:44:42+00:00"
},
{
"repo": "repo-seed",
"url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:58:57+00:00",
"updated_at": "2026-08-20T21:44:43+00:00"
},
{
"repo": "reuse-surface",
"url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"description": "Capability registry for helix_forge",
"registered_at": "2026-06-15T08:24:18+00:00",
"updated_at": "2026-08-20T21:44:43+00:00"
},
{
"repo": "shard-wiki",
"url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:03+00:00",
"updated_at": "2026-08-20T21:44:44+00:00"
},
{
"repo": "state-hub",
"url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:35:00+00:00",
"updated_at": "2026-07-07T16:09:42+00:00"
},
{
"repo": "tegwick-control",
"url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:00+00:00",
"updated_at": "2026-08-20T21:44:44+00:00"
},
{
"repo": "the-custodian",
"url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-15T23:59:04+00:00",
"updated_at": "2026-08-20T21:44:45+00:00"
},
{
"repo": "user-engine",
"url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:02:46+00:00",
"updated_at": "2026-08-20T21:44:45+00:00"
},
{
"repo": "vantage-point",
"url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:02:51+00:00",
"updated_at": "2026-08-20T21:44:46+00:00"
},
{
"repo": "vergabe-teilnahme",
"url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:02:56+00:00",
"updated_at": "2026-08-20T21:44:46+00:00"
},
{
"repo": "whynot-control",
"url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:03:00+00:00",
"updated_at": "2026-08-20T21:44:46+00:00"
},
{
"repo": "whynot-design",
"url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml",
"enabled": true,
"required": false,
"domain": "helix_forge",
"cache_ttl_seconds": 86400,
"auth_header": "Authorization",
"registered_at": "2026-06-16T00:03:03+00:00",
"updated_at": "2026-08-20T21:44:47+00:00"
}
]
}

61
docs/assessments/netkingdom-2026-10-14/hosted-verification.json Normal file
View file

@ -0,0 +1,61 @@
{
"matched": 32,
"expected": 70,
"missing": [
"capability.execution.openweight-rein",
"capability.execution.profile-harness",
"capability.execution.sandbox-provision",
"capability.execution.scheduled-agent-rein",
"capability.finance.security-budget-evidence",
"capability.identity.tenant-facts",
"capability.infotech.runbook-tutorials",
"capability.infotech.sbom-management",
"capability.observability.security-signals",
"capability.organization.role-catalog",
"capability.railiance.bootstrap-sequencing",
"capability.railiance.browser-verification",
"capability.railiance.knative-rail",
"capability.railiance.kubernetes-rail",
"capability.railiance.openbao-package",
"capability.railiance.policy-publication-package",
"capability.railiance.postgres-isolation-recovery",
"capability.railiance.sbom-runtime-package",
"capability.railiance.security-consumption-contracts",
"capability.railiance.substrate-bindings",
"capability.railiance.telemetry-package",
"capability.railiance.tenant-engine-package",
"capability.railiance.user-engine-package",
"capability.resources.security-capacity",
"capability.security.adversarial-evidence",
"capability.security.agent-knowledge",
"capability.security.approval-lifecycle",
"capability.security.credential-lifecycle",
"capability.security.doctrine-review",
"capability.security.human-decision-workspace",
"capability.security.maturity-claims",
"capability.security.policy-publication",
"capability.security.posture-assessment",
"capability.security.practice-canon",
"capability.security.repository-secret-prevention",
"capability.security.risk-register",
"capability.security.structure-construction",
"capability.security.zone-reference"
],
"stale": false,
"composed_at": "2026-10-14T04:48:46+00:00",
"warnings": null,
"private_sources": [
"rapp-openbao",
"rapp-policy-nexus",
"rapp-postgres",
"rapp-telemetry",
"rapp-tenant-engine",
"rapp-user-engine",
"rapp-sbom-nexus"
],
"write_attempt": {
"route": "reuse-surface-hub-write-token",
"pdp_decision": "decision:f730e3da14beebdd",
"result": "OpenBao 403 permission denied; helper not executed; no hub writes"
}
}

104
docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json Normal file
View file

@ -0,0 +1,104 @@
{
"reason": "Anonymous source fetch returns 404; hub-side read credential or separately approved metadata publication is needed. Do not change repository visibility.",
"repos": [
"rapp-openbao",
"rapp-policy-nexus",
"rapp-postgres",
"rapp-sbom-nexus",
"rapp-telemetry",
"rapp-tenant-engine",
"rapp-user-engine"
],
"draft_registrations_not_ready": [
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-openbao",
"url": "https://forgejo.coulomb.social/coulomb/rapp-openbao/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-postgres",
"url": "https://forgejo.coulomb.social/coulomb/rapp-postgres/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/rapp-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-user-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-user-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
}
],
"needed_fields": [
"auth_env name for an already admitted hub-side source-read credential",
"proof that the credential is limited to the intended repository read scope",
"successful hub-side index fetch without value disclosure",
"owner consent to metadata appearing in public federation"
]
}

374
docs/assessments/netkingdom-2026-10-14/hub-public-registration-plan.json Normal file
View file

@ -0,0 +1,374 @@
[
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "approval-engine",
"url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "emergent-security",
"url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "fin-hub",
"url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "gate-house",
"url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "glas-harness",
"url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "informed-decision",
"url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "kings-guard",
"url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "maturity-engine",
"url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "ops-mason",
"url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-kubernetes",
"url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-bootstrap",
"url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-master",
"url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-playwright",
"url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "reef-railiance",
"url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-aharness",
"url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-openweights",
"url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "repo-manager",
"url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "resource-control",
"url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "risk-nexus",
"url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "role-engine",
"url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "runbook-tutorials",
"url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sand-boxer",
"url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "secrets-engine",
"url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "security-canon",
"url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "whitehat-security",
"url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "zone-engine",
"url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-knative",
"url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
}
]

458
docs/assessments/netkingdom-2026-10-14/hub-registration-plan.json Normal file
View file

@ -0,0 +1,458 @@
[
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "approval-engine",
"url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "emergent-security",
"url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "fin-hub",
"url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "gate-house",
"url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "glas-harness",
"url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "informed-decision",
"url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "kings-guard",
"url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "maturity-engine",
"url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "ops-mason",
"url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-kubernetes",
"url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-bootstrap",
"url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-master",
"url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "railiance-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-openbao",
"url": "https://forgejo.coulomb.social/coulomb/rapp-openbao/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-playwright",
"url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-policy-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-postgres",
"url": "https://forgejo.coulomb.social/coulomb/rapp-postgres/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-telemetry",
"url": "https://forgejo.coulomb.social/coulomb/rapp-telemetry/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-user-engine",
"url": "https://forgejo.coulomb.social/coulomb/rapp-user-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "reef-railiance",
"url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-aharness",
"url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rein-openweights",
"url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "repo-manager",
"url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "resource-control",
"url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "risk-nexus",
"url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "role-engine",
"url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "runbook-tutorials",
"url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sand-boxer",
"url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "secrets-engine",
"url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "security-canon",
"url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "tenant-engine",
"url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "whitehat-security",
"url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "zone-engine",
"url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rail-knative",
"url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
},
{
"method": "POST",
"path": "/v1/repos",
"body": {
"repo": "rapp-sbom-nexus",
"url": "https://forgejo.coulomb.social/coulomb/rapp-sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml",
"domain": "infotech",
"enabled": true,
"required": false,
"registered_by": "codex-CUST-WP-0081"
}
}
]

14
docs/assessments/netkingdom-2026-10-14/hub-registration-proposal.json Normal file
View file

@ -0,0 +1,14 @@
{
"id": "CUST81-REUSE-REGISTRATION-001",
"authority": "User explicitly requested establishment of reviewed capabilities with reuse-surface. Source publication and cross-repository writes approved through sandbox escalation. No grant beyond registry metadata.",
"target": "https://reuse.coulomb.social/v1/repos",
"helper_sha256": "55465aa4f6a41960055d1b7fcf578c812c917af3110e58676f343472977202fd",
"plan_sha256": "ec0edd0301c43cfb98b5beea7fd454975bca8f6900359df851e70dcc6e6d08df",
"actions": 38,
"credential_lane": "reuse-surface-hub-write-token through warden access --exec; no credential export or persistence",
"expected": "All 60 reviewed owner indexes registered, all 70 reviewed IDs discoverable exactly once with source parity",
"verification": "Public HTTPS raw index and entry hashes, registration readback and fresh hosted federation payload",
"rollback": "Disable only newly created registrations from the exact plan if discovery is incorrect; preserve existing registrations. Source metadata can be reverted by the registry-only commits.",
"cost": "No service deployment or new recurring resource commitment; 38 bounded metadata writes and public readback on existing services.",
"risk": "Incorrect catalog discovery or temporary compose errors; no identity, policy, credential grant, workload or audit authority change. Stop on conflicting registration or transport failure."
}

9
docs/assessments/netkingdom-2026-10-14/hub-registration-receipt.json Normal file
View file

@ -0,0 +1,9 @@
{
"complete": false,
"actions": [],
"helper_executed": false,
"credential_lane_result": "OpenBao HTTP 403",
"pdp_decision": "decision:f730e3da14beebdd",
"public_registrations_ready": 31,
"private_registrations_pending": 7
}

2905
docs/assessments/netkingdom-2026-10-14/inventory.json Normal file
View file

File diff suppressed because it is too large Load diff

2516
docs/assessments/netkingdom-2026-10-14/local-default-federated.yaml Normal file
View file

File diff suppressed because it is too large Load diff

8
docs/assessments/netkingdom-2026-10-14/local-default-federation-receipt.json Normal file
View file

@ -0,0 +1,8 @@
{
"source_count": 99,
"reviewed_count": 70,
"all_exactly_once": true,
"warnings": [],
"previous_sources_sha256": "29a877f165b8d474ceb032f199efa87349a4c4f90c3599fab0cb244110113d10",
"scope": "Workstation local federation. Existing unrelated sources preserved; hosted registration is separate."
}

21
docs/assessments/netkingdom-2026-10-14/local-discovery-receipt.json Normal file
View file

@ -0,0 +1,21 @@
{
"default_federated_index": "/home/worsch/reuse-surface/registry/indexes/federated.yaml",
"total_capabilities_including_unrelated_sources": 114,
"reviewed_exactly_once": 70,
"composition_warnings": [],
"plan_check_trials": [
{
"intent": "bound approval consumption before credential delivery",
"top_id": "capability.security.approval-lifecycle",
"verdict": "extend",
"score": 0.2857
},
{
"intent": "deterministic posture feedback evidence expiry",
"top_id": "capability.security.posture-feedback",
"verdict": "reuse",
"score": 0.6
}
],
"meaning": "Discovery works through the normal CLI. Ranking verdicts are lexical planning recommendations, not permission or runtime readiness."
}

27
docs/assessments/netkingdom-2026-10-14/local-federation-guide.md Normal file
View file

@ -0,0 +1,27 @@
# NetKingdom security capability discovery
The workstation federation includes 70 reviewed security and supporting capabilities from 60 sibling repositories. Two additional inspected repositories are nonproviders: rapp-secrets-engine is retired and rapp-forgejo is a placeholder without a package declaration. The owner capability entries are the reusable source; the architecture assessment is in the-custodian CUST-WP-0081.
## Local discovery
From a reuse-surface checkout beside those repositories:
```sh
reuse-surface federation compose
reuse-surface plan-check --intent "bound approval consumption before credential delivery" --no-llm
reuse-surface plan-check --intent "deterministic posture feedback evidence expiry" --no-llm
```
The source manifest uses relative sibling paths for the reviewed cohort and requires their indexes to exist. Other federation sources are preserved. A missing sibling is a composition error rather than silent loss of a reviewed capability. The composed local index supports planning; it is not a runtime readiness or authorization grant. `reuse-surface query` searches this repository's own index, while `plan-check` uses the composed federation.
## Hosted discovery
```sh
reuse-surface plan-check --hub-url https://reuse.coulomb.social --intent "bound approval consumption" --no-llm
```
As checked on 2026-10-14, all 60 source registry commits are published, while the hosted hub contains 32 of the 70 reviewed capabilities. Thirty-eight new owner registrations remain pending scoped write access: the normal Warden lane was allowed by the PDP but OpenBao refused the current caller with HTTP 403. Seven of those indexes also require admitted private-source read access; anonymous retrieval returns 404. Do not change repository visibility or reuse another workload's credential to make discovery pass.
The seven private sources are rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-telemetry, rapp-tenant-engine, rapp-user-engine and rapp-sbom-nexus. Hosted registration supports an `auth_env` reference to a credential already configured at the hub. Source-owner approval, scoped read provisioning and a successful native fetch must precede their registration. Thirty-one public-source registrations are otherwise ready.
The exact registration plan, source commits, raw retrieval results and local/hosted verification receipts are retained in the-custodian at `docs/assessments/netkingdom-2026-10-14/`. Existing IDs were preserved where valid; the copied Secrets Engine repository-template entry was removed. Registry C/R values retained from older entries remain owner assessments, not renewed evidence.

431
docs/assessments/netkingdom-2026-10-14/local-sources-before.yaml Normal file
View file

@ -0,0 +1,431 @@
version: 1
domain: helix_forge
collision_policy: warn
sources:
- repo: activity-core
url: https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: agentic-resources
url: https://forgejo.coulomb.social/coulomb/agentic-resources/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: artifact-store
url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: audit-core
url: https://forgejo.coulomb.social/coulomb/audit-core/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: can-you-assist
url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-engine
url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-evidence
url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-work
url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: config-atlas
url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: infotech
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: coordination-engine
url: https://forgejo.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: core-hub
url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: domain-tree
url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: email-connect
url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-anchor
url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-binder
url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-source
url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: feature-control
url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: access-engine
url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: guide-board
url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: helix-forge
url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: hub-core
url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: human-resources
url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: commerce-canon
url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ihp-railiance-probe
url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: info-tech-canon
url: https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: infospace-bench
url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: issue-core
url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: kaizen-agentic
url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: key-cape
url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: kontextual-engine
url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: llm-connect
url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-filter
url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-main
url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-quarkdown
url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-tool
url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: net-kingdom
url: https://forgejo.coulomb.social/coulomb/net-kingdom/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: open-cmis-tck
url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: open-reuse
url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-bridge
url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-hub
url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-warden
url: https://forgejo.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: phase-memory
url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-apps
url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-cluster
url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-enablement
url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-fabric
url: https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-forge
url: https://forgejo.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-infra
url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: railiance-platform
url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: repo-scoping
url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: repo-seed
url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: reuse-surface
# Include this checkout's entries in local plan-check before publication.
index: registry/indexes/capabilities.yaml
enabled: true
required: true
domain: helix_forge
description: Capability registry for helix_forge
- repo: shard-wiki
url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: state-hub
url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: tegwick-control
url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: the-custodian
url: https://forgejo.coulomb.social/coulomb/the-custodian/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: user-engine
url: https://forgejo.coulomb.social/coulomb/user-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: vantage-point
url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: vergabe-teilnahme
url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whynot-control
url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whynot-design
url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization

577
docs/assessments/netkingdom-2026-10-14/local-sources.yaml Normal file
View file

@ -0,0 +1,577 @@
version: 1
domain: helix_forge
collision_policy: warn
sources:
- repo: access-engine
index: ../access-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: activity-core
index: ../activity-core/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: agentic-resources
index: ../agentic-resources/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: approval-engine
index: ../approval-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: artifact-store
url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: audit-core
index: ../audit-core/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: can-you-assist
url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-engine
url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-evidence
url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: citation-work
url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: commerce-canon
url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: config-atlas
url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: infotech
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: coordination-engine
index: ../coordination-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: core-hub
url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: domain-tree
url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: email-connect
url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: emergent-security
index: ../emergent-security/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: evidence-anchor
url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-binder
url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: evidence-source
url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: feature-control
url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: fin-hub
index: ../fin-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: gate-house
index: ../gate-house/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: glas-harness
index: ../glas-harness/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: guide-board
url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: helix-forge
url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: hub-core
url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: human-resources
url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ihp-railiance-probe
url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: info-tech-canon
index: ../info-tech-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: informed-decision
index: ../informed-decision/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: infospace-bench
url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: issue-core
index: ../issue-core/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: kaizen-agentic
url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: key-cape
index: ../key-cape/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: kings-guard
index: ../kings-guard/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: kontextual-engine
url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: llm-connect
url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-filter
url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-main
url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-quarkdown
url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: markitect-tool
url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: maturity-engine
index: ../maturity-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: net-kingdom
index: ../net-kingdom/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: open-cmis-tck
url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: open-reuse
url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-bridge
index: ../ops-bridge/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: ops-hub
url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: ops-mason
index: ../ops-mason/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: ops-warden
index: ../ops-warden/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: phase-memory
url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: policy-nexus
index: ../policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rail-knative
index: ../rail-knative/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rail-kubernetes
index: ../rail-kubernetes/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-apps
index: ../railiance-apps/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-bootstrap
index: ../railiance-bootstrap/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-cluster
index: ../railiance-cluster/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-enablement
index: ../railiance-enablement/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-fabric
index: ../railiance-fabric/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-forge
index: ../railiance-forge/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-infra
index: ../railiance-infra/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-master
index: ../railiance-master/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-platform
index: ../railiance-platform/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: railiance-telemetry
index: ../railiance-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-openbao
index: ../rapp-openbao/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-playwright
index: ../rapp-playwright/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-policy-nexus
index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-postgres
index: ../rapp-postgres/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-sbom-nexus
index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-telemetry
index: ../rapp-telemetry/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-tenant-engine
index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rapp-user-engine
index: ../rapp-user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: reef-railiance
index: ../reef-railiance/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rein-aharness
index: ../rein-aharness/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: rein-openweights
index: ../rein-openweights/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: repo-manager
index: ../repo-manager/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: repo-scoping
url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: repo-seed
url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: resource-control
index: ../resource-control/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: reuse-surface
index: ../reuse-surface/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: risk-nexus
index: ../risk-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: role-engine
index: ../role-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: runbook-tutorials
index: ../runbook-tutorials/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: sand-boxer
index: ../sand-boxer/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: sbom-nexus
index: ../sbom-nexus/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: secrets-engine
index: ../secrets-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: security-canon
index: ../security-canon/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: shard-wiki
url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: state-hub
index: ../state-hub/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: tegwick-control
url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: tenant-engine
index: ../tenant-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: the-custodian
index: ../the-custodian/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: user-engine
index: ../user-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: vantage-point
url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: vergabe-teilnahme
url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whitehat-security
index: ../whitehat-security/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech
- repo: whynot-control
url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: whynot-design
url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml
enabled: true
required: false
domain: helix_forge
cache_ttl_seconds: 86400
auth_header: Authorization
- repo: zone-engine
index: ../zone-engine/registry/indexes/capabilities.yaml
enabled: true
required: true
domain: infotech

17
docs/assessments/netkingdom-2026-10-14/prepare_local_federation.py Normal file
View file

@ -0,0 +1,17 @@
from pathlib import Path
import hashlib,json,sys,yaml
sys.path.insert(0,'/home/worsch/reuse-surface')
from reuse_surface.federation import compose_federated_index
OUT=Path(__file__).resolve().parent;ROOT=Path('/home/worsch/reuse-surface')
v=json.loads((OUT/'full-inventory.json').read_text());src=ROOT/'registry/federation/sources.yaml';old=yaml.safe_load(src.read_text())
sources={s['repo']:s for s in old['sources']}
for n in v['repositories']:
sources[n]={'repo':n,'index':f'../{n}/registry/indexes/capabilities.yaml','enabled':True,'required':True,'domain':'infotech'}
manifest={**old,'sources':sorted(sources.values(),key=lambda s:s['repo'])}
(OUT/'local-sources-before.yaml').write_bytes(src.read_bytes());(OUT/'local-sources.yaml').write_text(yaml.safe_dump(manifest,sort_keys=False))
federated,warnings=compose_federated_index(manifest,cache_dir=Path('/tmp/netkingdom-reuse-federation-cache'))
counts={r['id']:sum(c['id']==r['id'] for c in federated['capabilities']) for r in v['capabilities']}
receipt={'source_count':len(sources),'reviewed_count':len(counts),'all_exactly_once':all(n==1 for n in counts.values()),'warnings':warnings,'previous_sources_sha256':hashlib.sha256(src.read_bytes()).hexdigest(),'scope':'Workstation local federation. Existing unrelated sources preserved; hosted registration is separate.'}
(OUT/'local-default-federation-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n')
(OUT/'local-default-federated.yaml').write_text(yaml.safe_dump(federated,sort_keys=False))
print(json.dumps(receipt,indent=2));assert receipt['all_exactly_once']

122
docs/assessments/netkingdom-2026-10-14/prepare_registry.py Normal file
View file

@ -0,0 +1,122 @@
"""Prepare exact registry edits for review. Does not mutate owner repositories."""
from pathlib import Path
import json, hashlib, sys, copy
import yaml
sys.path.insert(0,'/home/worsch/reuse-surface')
from reuse_surface.registry import parse_front_matter,entry_vector
from reuse_surface.cli import _run_validate
BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent; STAGE=OUT/'registry-stage'
data=json.loads((OUT/'inventory.json').read_text()); rows=data['capabilities']
CASES={
'U01':'Architect composes a security deployment from explicit owner contracts and case types',
'U02':'Human signs in with MFA and manages account or factor recovery',
'U03':'Application combines identity, tenant and resource facts and enforces a bound decision',
'U04':'Protected operation obtains and consumes exact human approval before its side effect',
'U05':'Operator provisions and delivers a scoped workload credential through the approved owner lane',
'U06':'Operator or automation obtains a bounded SSH certificate and maintains private connectivity',
'U07':'Owner inventories, rotates, revokes and detects exposure of credentials',
'U08':'Consumer emits security events and reconciles independently retained evidence',
'U09':'Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes',
'U10':'Operator recovers identity, custody or data with independently held recovery material',
'U11':'Agent executes an attributable bounded task and supplies supervision evidence',
'U12':'Developer builds and publishes through controlled source, dependency and runner paths',
'U13':'Platform owner deploys and rolls back a workload with explicit substrate and custody bindings',
'U14':'Framework adopter validates and reuses selected contracts, tools and reference compositions',
}
# Adjacencies express interfaces, not a claim that every edge is natively admitted.
NEIGHBORS={
'net-kingdom':['security-canon','gate-house','key-cape','access-engine','reuse-surface'],
'key-cape':['user-engine','tenant-engine','access-engine'],
'user-engine':['key-cape','tenant-engine','access-engine','audit-core'],
'access-engine':['approval-engine','key-cape','tenant-engine','zone-engine','maturity-engine'],
'approval-engine':['access-engine','key-cape','secrets-engine','audit-core'],
'secrets-engine':['approval-engine','access-engine','railiance-platform','ops-warden'],
'ops-warden':['secrets-engine','access-engine','ops-bridge','ops-mason'],
'ops-mason':['secrets-engine','net-kingdom','railiance-platform'],
'audit-core':['approval-engine','tenant-engine','kings-guard','railiance-telemetry'],
'kings-guard':['maturity-engine','audit-core','risk-nexus','net-kingdom'],
'maturity-engine':['gate-house','access-engine','kings-guard'],
'whitehat-security':['gate-house','audit-core','approval-engine'],
'emergent-security':['net-kingdom','gate-house','glas-harness'],
'informed-decision':['approval-engine','access-engine','state-hub'],
'policy-nexus':['net-kingdom','security-canon','risk-nexus'],
'glas-harness':['sand-boxer','rein-aharness','rein-openweights'],
'agentic-resources':['glas-harness','activity-core','fin-hub'],
'repo-manager':['railiance-forge','sbom-nexus','state-hub'],
'railiance-forge':['repo-manager','railiance-enablement','railiance-apps'],
'railiance-platform':['rapp-openbao','rapp-postgres','key-cape','secrets-engine'],
'railiance-telemetry':['rapp-telemetry','audit-core','kings-guard'],
'rapp-telemetry':['railiance-telemetry','rail-kubernetes','reef-railiance'],
'fin-hub':['resource-control','agentic-resources'],
}
primary={}
for r in rows: primary.setdefault(r['repo'],r['id'])
changes=[]; validation=[]
def stage(repo,rel,content):
dst=STAGE/repo/rel;dst.parent.mkdir(parents=True,exist_ok=True); dst.write_text(content)
src=BASE/repo/rel
if src.exists():
baseline=OUT/'registry-before'/repo/rel;baseline.parent.mkdir(parents=True,exist_ok=True);baseline.write_bytes(src.read_bytes())
if not src.exists() or src.read_bytes()!=dst.read_bytes():
changes.append({'repo':repo,'path':rel,'before_sha256':hashlib.sha256(src.read_bytes()).hexdigest() if src.exists() else None,'after_sha256':hashlib.sha256(dst.read_bytes()).hexdigest(),'operation':'write'})
for repo,rv in data['repositories'].items():
root=BASE/repo; rs=[r for r in rows if r['repo']==repo]
ix=copy.deepcopy(rv['existing_index'] or {'version':1,'domain':'infotech','capabilities':[]})
marker=root/'registry/NO_CAPABILITIES.md'
if marker.exists(): changes.append({'repo':repo,'path':'registry/NO_CAPABILITIES.md','before_sha256':hashlib.sha256(marker.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'})
ix['updated']='2026-10-14';ix.setdefault('version',1);ix.setdefault('domain','infotech')
# Include unchanged sibling entries in staged validation without rewriting them.
for p in (root/'registry/capabilities').glob('*.md'):
if repo=='secrets-engine' and parse_front_matter(p).get('id')=='capability.infotech.repo-template':
changes.append({'repo':repo,'path':str(p.relative_to(root)),'before_sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'})
ix['capabilities']=[c for c in ix['capabilities'] if c['id']!='capability.infotech.repo-template'];continue
dst=STAGE/repo/p.relative_to(root);dst.parent.mkdir(parents=True,exist_ok=True);dst.write_bytes(p.read_bytes())
for r in rs:
rel=r['existing_entry_path'] or f"registry/capabilities/{r['id']}.md"
try: old=parse_front_matter(root/rel) if (root/rel).exists() else {}
except (ValueError,yaml.YAMLError):
try: old=yaml.safe_load((root/rel).read_text()[4:])
except yaml.YAMLError: old={}
valid_old='maturity' in old and 'external_evidence' in old
fm=copy.deepcopy(old) if valid_old else {'id':r['id'],'owner':repo,'status':'draft','domain':'infotech','maturity':{'discovery':{'current':'D3','target':'D5','confidence':'medium'},'availability':{'current':r['availability'],'target':r['availability'],'confidence':'medium'}},'external_evidence':{'completeness':{'level':'C1','confidence':'low','basis':'Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review.'},'reliability':{'level':'R0','confidence':'low','basis':'No longitudinal consumer reliability measurement established by this review.'}}}
fm.pop('consumption_modes',None)
fm.update(name=r['name'],summary=r['surface']+'.',owner=repo)
fm['tags']=list(dict.fromkeys(fm.get('tags',[])+['security','netkingdom','framework-reuse']))
if old.get('external_evidence'):
for key in ['completeness','reliability']:
if key in old['external_evidence']: fm['external_evidence'][key]=old['external_evidence'][key]
fm['external_evidence'].setdefault('reliability',{'level':'R0','confidence':'low','basis':'No longitudinal reliability assessment available.'})
previous=entry_vector(fm)
fm['maturity']['availability']['current']=r['availability']
if int(fm['maturity']['availability'].get('target',r['availability'])[1:])<int(r['availability'][1:]):fm['maturity']['availability']['target']=r['availability']
fm['maturity']['availability']['rationale']='Source interface assessed 2026-10-14: '+r['surface']+'. Availability describes the delivery form, not production acceptance. '+r['limitation']+'.'
fm['maturity']['discovery'].setdefault('rationale','Owner scope, neighboring responsibilities, concrete use cases and limitations are documented; no exhaustive or generalized maturity claim.')
vector=entry_vector(fm);r['vector']=vector
if valid_old and previous!=vector:
fm.setdefault('promotion_history',[]).append({'date':'2026-10-14','dimension':'availability','from':previous.split(' / ')[1],'to':r['availability'],'rationale':'Interface-form reassessment from current owner sources; no completeness/reliability promotion.','author':'codex'})
disc=fm.setdefault('discovery',{});disc['intent']=r['surface'];disc['includes']=[r['surface']];disc['excludes']=[r['limitation']]
disc['use_cases']=list(dict.fromkeys(disc.get('use_cases',[])+[u+': '+CASES[u] for u in r['use_cases']]))
av=fm.setdefault('availability',{});av['current_level']=r['availability'];av['target_level']=fm['maturity']['availability']['target'];av['current_artifacts']=r['artifacts']
av['consumption_modes']=['containerized service','CLI'] if r['availability']=='A5' else ['informational'] if r['availability']=='A0' else ['HTTP API','source'] if r['availability']=='A4' else ['library','CLI'] if r['availability']=='A3' else ['CLI','source']
rels=fm.setdefault('relations',{}); neigh=NEIGHBORS.get(repo,['net-kingdom'])
rels['related_to']=list(dict.fromkeys(rels.get('related_to',[])+[primary[n] for n in neigh if primary[n]!=r['id']]))
if repo.startswith('rapp-') and repo[5:] in primary: rels['wraps']=list(dict.fromkeys(rels.get('wraps',[])+[primary[repo[5:]]]))
if repo=='net-kingdom' and r['id']!=primary[repo]:rels['specializes']=[primary[repo]]
ev=fm.setdefault('evidence',{});ev['documentation']=list(dict.fromkeys(r['artifacts']))
guidance=fm.setdefault('consumer_guidance',{});guidance['recommended_for']=[CASES[u] for u in r['use_cases']];guidance['not_recommended_for']=[r['limitation']]
guidance['known_limitations']=[r['limitation'],'2026-10-14 architecture review estimates operational maturity separately; a registry entry does not authorize execution or establish deployment.']
body='\n# '+r['name']+'\n\n'+r['surface']+'.\n\n## Reuse boundary\n\n'+r['limitation']+'.\n\n## Supported use cases\n\n'+'\n'.join('- '+u+': '+CASES[u] for u in r['use_cases'])+'\n\n## Evidence and integration\n\n'+'\n'.join('- ['+a+'](../../'+a+')' for a in r['artifacts'])+'\n\nAssessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.\n'
stage(repo,rel,'---\n'+yaml.safe_dump(fm,sort_keys=False,allow_unicode=True)+'---\n'+body)
item={k:fm[k] for k in ['id','name','summary','domain','status','owner','tags']};item.update(vector=vector,path=rel,consumption_modes=av['consumption_modes'])
indexpos=next((i for i,c in enumerate(ix['capabilities']) if c.get('id')==r['id']),None)
if indexpos is None:ix['capabilities'].append(item)
else:ix['capabilities'][indexpos]=item
r['entry_path']=rel
stage(repo,'registry/indexes/capabilities.yaml',yaml.safe_dump(ix,sort_keys=False,allow_unicode=True))
errs,warns,paths=_run_validate(STAGE/repo,target=None,relations=False)
validation.append({'repo':repo,'entries':len(paths),'errors':errs,'warnings':warns})
(OUT/'inventory.json').write_text(json.dumps(data,indent=2)+'\n')
(OUT/'use-cases.json').write_text(json.dumps(CASES,indent=2)+'\n')
(OUT/'registry-changes.json').write_text(json.dumps(changes,indent=2)+'\n')
(OUT/'registry-stage-validation.json').write_text(json.dumps(validation,indent=2)+'\n')
print(json.dumps({'changes':len(changes),'repos':len(validation),'errors':[v for v in validation if v['errors'] or v['warnings']]},indent=2))

542
docs/assessments/netkingdom-2026-10-14/publication-preflight.json Normal file
View file

@ -0,0 +1,542 @@
[
{
"repo": "access-engine",
"branch": "main",
"local_head": "16ca97b2776789f730cc7049a2d6533612faaccd",
"remote_head": "16ca97b2776789f730cc7049a2d6533612faaccd",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "activity-core",
"branch": "main",
"local_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
"remote_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "agentic-resources",
"branch": "main",
"local_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709",
"remote_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "approval-engine",
"branch": "main",
"local_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
"remote_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "audit-core",
"branch": "main",
"local_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
"remote_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "coordination-engine",
"branch": "main",
"local_head": "c401067842072b75717f76480dd6e7db1836059c",
"remote_head": "c401067842072b75717f76480dd6e7db1836059c",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "emergent-security",
"branch": "main",
"local_head": "4c6fda38298fa50665ead41526b893adf069d335",
"remote_head": "4c6fda38298fa50665ead41526b893adf069d335",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "fin-hub",
"branch": "main",
"local_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4",
"remote_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "gate-house",
"branch": "main",
"local_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
"remote_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "glas-harness",
"branch": "main",
"local_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe",
"remote_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "info-tech-canon",
"branch": "main",
"local_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e",
"remote_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "informed-decision",
"branch": "main",
"local_head": "ee6a65b80a0fea1a914dfa31434b903669656c09",
"remote_head": "ee6a65b80a0fea1a914dfa31434b903669656c09",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "issue-core",
"branch": "main",
"local_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e",
"remote_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "key-cape",
"branch": "main",
"local_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
"remote_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "kings-guard",
"branch": "main",
"local_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
"remote_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "maturity-engine",
"branch": "main",
"local_head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9",
"remote_head": "2ef97c87a0f818a906aa42942c32d6c69f9ec899",
"same_head": false,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "net-kingdom",
"branch": "main",
"local_head": "1a36e857cc5aae6fe738f794417126c46dd94627",
"remote_head": "1a36e857cc5aae6fe738f794417126c46dd94627",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "ops-bridge",
"branch": "main",
"local_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2",
"remote_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "ops-mason",
"branch": "main",
"local_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
"remote_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "ops-warden",
"branch": "main",
"local_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
"remote_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "policy-nexus",
"branch": "main",
"local_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
"remote_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rail-kubernetes",
"branch": "main",
"local_head": "35159e49c1340b7a0e30c49188975c8839d346f6",
"remote_head": "35159e49c1340b7a0e30c49188975c8839d346f6",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-apps",
"branch": "main",
"local_head": "706461b845086ee2df8ce9acae3dae7feebfffda",
"remote_head": "706461b845086ee2df8ce9acae3dae7feebfffda",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "railiance-bootstrap",
"branch": "main",
"local_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b",
"remote_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-cluster",
"branch": "main",
"local_head": "12d1e881ff2086566712fbc591db293b38ea2bcf",
"remote_head": "12d1e881ff2086566712fbc591db293b38ea2bcf",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-enablement",
"branch": "main",
"local_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063",
"remote_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-fabric",
"branch": "main",
"local_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e",
"remote_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-forge",
"branch": "main",
"local_head": "a15fac8e938c11b041eb39386f05b63d46ae566a",
"remote_head": "a15fac8e938c11b041eb39386f05b63d46ae566a",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "railiance-infra",
"branch": "main",
"local_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
"remote_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-master",
"branch": "main",
"local_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7",
"remote_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-platform",
"branch": "main",
"local_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce",
"remote_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "railiance-telemetry",
"branch": "main",
"local_head": "81d905971c38de9aaf11088ba605e112152d8268",
"remote_head": "81d905971c38de9aaf11088ba605e112152d8268",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-openbao",
"branch": "main",
"local_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66",
"remote_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-playwright",
"branch": "main",
"local_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
"remote_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-policy-nexus",
"branch": "main",
"local_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda",
"remote_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-postgres",
"branch": "main",
"local_head": "03744030c9258e920f6403a9ce184a26d7b75268",
"remote_head": "03744030c9258e920f6403a9ce184a26d7b75268",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-telemetry",
"branch": "main",
"local_head": "17053dbc47f7c22efd67fd90d06d108d154835fa",
"remote_head": "17053dbc47f7c22efd67fd90d06d108d154835fa",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-tenant-engine",
"branch": "main",
"local_head": "c160be23577ab4d99ee2cd008deb455b07f0597d",
"remote_head": "c160be23577ab4d99ee2cd008deb455b07f0597d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rapp-user-engine",
"branch": "main",
"local_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c",
"remote_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "reef-railiance",
"branch": "main",
"local_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239",
"remote_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "rein-aharness",
"branch": "main",
"local_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42",
"remote_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "rein-openweights",
"branch": "main",
"local_head": "e1fccb39b738a5381a9de6e1d799f124797798ce",
"remote_head": "e1fccb39b738a5381a9de6e1d799f124797798ce",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "repo-manager",
"branch": "main",
"local_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa",
"remote_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "resource-control",
"branch": "main",
"local_head": "3604d468f86ede7d320f4d22dd4aea775306b53f",
"remote_head": "3604d468f86ede7d320f4d22dd4aea775306b53f",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "reuse-surface",
"branch": "main",
"local_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1",
"remote_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "risk-nexus",
"branch": "main",
"local_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc",
"remote_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "role-engine",
"branch": "main",
"local_head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
"remote_head": "d231241dbfeeb541b34243f4022883aa6417a1eb",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "runbook-tutorials",
"branch": "main",
"local_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e",
"remote_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "sand-boxer",
"branch": "main",
"local_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d",
"remote_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "sbom-nexus",
"branch": "main",
"local_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522",
"remote_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "secrets-engine",
"branch": "main",
"local_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
"remote_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "security-canon",
"branch": "main",
"local_head": "1664a6def20be2759a1e575024563efd27c9f36f",
"remote_head": "1664a6def20be2759a1e575024563efd27c9f36f",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "state-hub",
"branch": "main",
"local_head": "4ffc7236735afc6223aa613262483ea911307714",
"remote_head": "4ffc7236735afc6223aa613262483ea911307714",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": [
".custodian-brief.md"
]
},
{
"repo": "tenant-engine",
"branch": "main",
"local_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
"remote_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "the-custodian",
"branch": "main",
"local_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e",
"remote_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "user-engine",
"branch": "main",
"local_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
"remote_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "whitehat-security",
"branch": "main",
"local_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b",
"remote_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
},
{
"repo": "zone-engine",
"branch": "main",
"local_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
"remote_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
"same_head": true,
"remote_read_exit": 0,
"staged_paths": []
}
]

18
docs/assessments/netkingdom-2026-10-14/publication_preflight.py Normal file
View file

@ -0,0 +1,18 @@
from pathlib import Path
import concurrent.futures,json,subprocess,urllib.request
OUT=Path(__file__).resolve().parent;v=json.loads((OUT/'inventory.json').read_text())
def inspect(n):
def git(*args):return subprocess.run(['git','-C','/home/worsch/'+n,*args],capture_output=True,text=True,timeout=45)
branch=git('branch','--show-current').stdout.strip(); head=git('rev-parse','HEAD').stdout.strip()
remote=git('ls-remote','origin','refs/heads/'+branch)
sha=remote.stdout.split()[0] if remote.returncode==0 and remote.stdout.strip() else None
return {'repo':n,'branch':branch,'local_head':head,'remote_head':sha,'same_head':head==sha,'remote_read_exit':remote.returncode,'staged_paths':git('diff','--cached','--name-only').stdout.splitlines()}
with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex: result=list(ex.map(inspect,v['repositories']))
(OUT/'publication-preflight.json').write_text(json.dumps(result,indent=2)+'\n')
print(json.dumps({'repos':len(result),'same_heads':sum(r['same_head'] for r in result),'exceptions':[r for r in result if not r['same_head'] or r['staged_paths']]},indent=2))
for endpoint in ['repos','federated']:
try:
with urllib.request.urlopen('https://reuse.coulomb.social/v1/'+endpoint,timeout=40) as r: data=json.load(r)
(OUT/('hosted-before-'+endpoint+'.json')).write_text(json.dumps(data,indent=2)+'\n')
print(endpoint,'read successfully')
except Exception as e:print(endpoint,type(e).__name__)

44
docs/assessments/netkingdom-2026-10-14/publish_registry.py Normal file
View file

@ -0,0 +1,44 @@
"""Publish only the reviewed registry paths; preserve unrelated index/worktree state."""
from pathlib import Path
import hashlib,json,subprocess,tempfile
OUT=Path(__file__).resolve().parent;BASE=Path('/home/worsch')
changes=json.loads((OUT/'registry-changes.json').read_text());pre={r['repo']:r for r in json.loads((OUT/'publication-preflight.json').read_text())}
receipt_path=OUT/'registry-publication.json';receipts=json.loads(receipt_path.read_text()) if receipt_path.exists() else []
completed={r['repo'] for r in receipts if r.get('verified_remote')}
def git(root,*args):
p=subprocess.run(['git','-C',str(root),*args],text=True,capture_output=True,timeout=180)
if p.returncode:raise RuntimeError('git '+args[0]+': '+p.stderr[-1800:]+p.stdout[-1800:])
return p.stdout.strip()
for n in pre:
if n in completed:continue
cs=[c for c in changes if c['repo']==n];root=BASE/n;paths=[c['path'] for c in cs];original=pre[n]
try:
for c in cs:
p=root/c['path'];sha=hashlib.sha256(p.read_bytes()).hexdigest() if p.exists() else None
if sha!=c['after_sha256']:raise RuntimeError('Registry changed since validation: '+c['path'])
if git(root,'rev-parse','HEAD')!=original['local_head']:raise RuntimeError('HEAD moved since preflight')
branch=original['branch'];remote=git(root,'ls-remote','origin','refs/heads/'+branch).split()[0]
if remote!=original['remote_head']:raise RuntimeError('Remote moved since preflight')
isolated=not original['same_head']
if isolated:
# Do not publish existing unrelated local commits. Build the registry commit on the real remote head.
temp=Path(tempfile.mkdtemp(prefix='netkingdom-registry-'+n+'-',dir='/tmp'))
url=git(root,'remote','get-url','origin');git(temp,'clone','--quiet','--single-branch','--branch',branch,url,'.')
for c in cs:
target=temp/c['path']
if c['operation']=='delete':
if target.exists():target.unlink()
else:target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes((OUT/'registry-stage'/n/c['path']).read_bytes())
root=temp
git(root,'diff','--check','--',*paths)
git(root,'add','--',*paths)
git(root,'commit','--only','-m','docs(reuse): establish reviewed NetKingdom security capabilities','--',*paths)
commit=git(root,'rev-parse','HEAD');actual=set(git(root,'diff-tree','--no-commit-id','--name-only','-r',commit).splitlines())
if actual!=set(paths):raise RuntimeError('Commit path mismatch')
git(root,'push','origin','HEAD:refs/heads/'+branch)
observed=git(root,'ls-remote','origin','refs/heads/'+branch).split()[0]
row={'repo':n,'commit':commit,'parent':remote,'paths':paths,'verified_remote':observed==commit,'isolated_publication':isolated}
if isolated:row['local_unrelated_head_preserved']=original['local_head'];row['publication_checkout']=str(root)
receipts.append(row);receipt_path.write_text(json.dumps(receipts,indent=2)+'\n');print(n,commit[:12],'verified',flush=True)
except Exception as e:
receipts.append({'repo':n,'verified_remote':False,'error':str(e)});receipt_path.write_text(json.dumps(receipts,indent=2)+'\n');print(n,'FAILED',str(e),flush=True);raise SystemExit(1)

1194
docs/assessments/netkingdom-2026-10-14/published-source-verification.json Normal file
View file

File diff suppressed because it is too large Load diff

43
docs/assessments/netkingdom-2026-10-14/register_hub.py Normal file
View file

@ -0,0 +1,43 @@
"""Apply the exact non-secret registration plan using the owner-routed env credential.
No redirects/proxies, no credential output, no secret persistence. Safe retry reads first.
"""
import json,os,sys,urllib.request,urllib.error,hashlib
from pathlib import Path
OUT=Path(__file__).resolve().parent;BASE='https://reuse.coulomb.social'
class NoRedirect(urllib.request.HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
opener=urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect())
plan=json.loads((OUT/'hub-registration-plan.json').read_text())
receipt={'plan_sha256':hashlib.sha256((OUT/'hub-registration-plan.json').read_bytes()).hexdigest(),'actions':[]}
def request(method,path,body=None,auth=False):
headers={'Accept':'application/json'}
if auth:
token=os.environ.get('REUSE_SURFACE_TOKEN')
if not token:raise RuntimeError('Required owner-routed credential is unavailable')
headers['Authorization']='Bearer '+token
if body is not None:headers['Content-Type']='application/json'
req=urllib.request.Request(BASE+path,data=json.dumps(body).encode() if body is not None else None,headers=headers,method=method)
with opener.open(req,timeout=55) as response:return response.status,json.load(response)
def save(): (OUT/'hub-registration-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n')
try:
status,listed=request('GET','/v1/repos');existing={r['repo']:r for r in listed['repos']}
# Every reviewed source must already be published; do not register dead indexes.
pub=json.loads((OUT/'registry-publication.json').read_text())+json.loads((OUT/'supplement/registry-publication.json').read_text());verified={r['repo'] for r in pub if r.get('verified_remote')}
expected=set(json.loads((OUT/'full-inventory.json').read_text())['repositories'])
if verified!=expected:raise RuntimeError('Source publication incomplete')
raw=json.loads((OUT/'published-source-verification.json').read_text())
if raw['errors'] or raw['checked_repositories']!=len(expected):raise RuntimeError('Published source verification incomplete')
for a in plan:
repo=a['body'].get('repo') or a['path'].split('/')[-1]
current=existing.get(repo)
if current and all(current.get(k)==v for k,v in a['body'].items() if k not in ['registered_by','description']):
receipt['actions'].append({'repo':repo,'outcome':'already_matches'});save();continue
if current and a['method']=='POST':raise RuntimeError('Concurrent registration differs: '+repo)
status,result=request(a['method'],a['path'],a['body'],auth=True)
receipt['actions'].append({'repo':repo,'http_status':status,'outcome':'applied'});save()
receipt['complete']=True;save()
except Exception as e:
receipt['complete']=False;receipt['failure_type']=type(e).__name__
receipt['failure_status']=e.code if isinstance(e,urllib.error.HTTPError) else None
# Never serialize response bodies/headers or exception strings from authenticated transport.
save();sys.exit(1)

6
docs/assessments/netkingdom-2026-10-14/registry-application.json Normal file
View file

@ -0,0 +1,6 @@
{
"applied": 129,
"repositories": 58,
"verified_sha256": true,
"git_staging_or_commits": false
}

80
docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md Normal file
View file

@ -0,0 +1,80 @@
---
id: capability.authorization.policy-evaluate
name: Authorization Policy Evaluation
summary: Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.
owner: flex-auth
status: draft
domain: helix_forge
tags: [authorization, policy, flex-auth]
maturity:
discovery:
current: D4
target: D6
confidence: medium
rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth path.
availability:
current: A2
target: A5
confidence: low
rationale: Policy registry and evaluation logic exist in repo; service packaging evolving.
external_evidence:
completeness:
level: C2
name: Partial
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- policy-as-code intent documented
broken_expectations:
- not yet indexed from flex-auth native registry
out_of_scope_expectations:
- identity proofing
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- early implementation phase
discovery:
intent: >
Provide inspectable authorization decisions between verified identity and
protected resources using policy-as-code.
includes:
- policy evaluation
- authorization registry
- decision explainability
excludes:
- identity issuance
- authentication protocols
use_cases: []
availability:
current_level: A2
target_level: A5
current_artifacts:
- flex-auth/
consumption_modes:
- source module
relations:
depends_on:
- capability.identity.subject-resolution
related_to:
- capability.feature-control.evaluate
consumer_guidance:
recommended_for:
- planning authorization layer between identity and resources
not_recommended_for:
- feature visibility toggles without policy intent
known_limitations:
- maturity evidence is registry-external today
---
# Authorization Policy Evaluation
Policy evaluation from flex-auth sits between identity resolution and protected
systems.

19
docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,19 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities:
- id: capability.authorization.policy-evaluate
name: Authorization Policy Evaluation
summary: Evaluate access decisions from policy-as-code rules for subjects, resources,
and actions.
vector: D4 / A2 / C2 / R1
domain: helix_forge
status: draft
owner: flex-auth
path: registry/capabilities/capability.authorization.policy-evaluate.md
tags:
- authorization
- policy
- flex-auth
consumption_modes:
- source module

77
docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/capabilities/capability.activity.event-coordinate.md Normal file
View file

@ -0,0 +1,77 @@
---
id: capability.activity.event-coordinate
name: Organizational Event Coordination
summary: Coordinate structured responses to cross-domain events through activity workflows and automation.
owner: activity-core
status: draft
domain: helix_forge
tags: [activity, coordination, automation]
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: activity-core INTENT defines org-wide event response boundary.
availability:
current: A1
target: A4
confidence: low
rationale: Conceptual workflows exist; consumable API surface still emerging.
external_evidence:
completeness:
level: C1
name: Fragmentary
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- problem and boundary documented in INTENT
broken_expectations:
- no registry-native automation artifacts indexed yet
out_of_scope_expectations:
- owning domain-specific business logic
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks: []
discovery:
intent: >
Give the organization a structural home for responding to events across repos
and domains in an auditable, automation-ready way.
includes:
- event-triggered coordination
- cross-domain maintenance workflows
excludes:
- single-repo cron replacements only
use_cases: []
availability:
current_level: A1
target_level: A4
current_artifacts:
- activity-core/INTENT.md
consumption_modes:
- informational
relations:
depends_on: []
related_to:
- capability.statehub.workstream-coordinate
- capability.audit.event-retain
consumer_guidance:
recommended_for:
- planning org-wide event response patterns
not_recommended_for:
- assuming production automation is available
known_limitations:
- early discovery stage
---
# Organizational Event Coordination
activity-core coordinates how the org responds to events—not the domain logic
inside each repo.

19
docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,19 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities:
- id: capability.activity.event-coordinate
name: Organizational Event Coordination
summary: Coordinate structured responses to cross-domain events through activity
workflows and automation.
vector: D3 / A1 / C1 / R0
domain: helix_forge
status: draft
owner: activity-core
path: registry/capabilities/capability.activity.event-coordinate.md
tags:
- activity
- coordination
- automation
consumption_modes:
- informational

15
docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/NO_CAPABILITIES.md Normal file
View file

@ -0,0 +1,15 @@
---
repo: agentic-resources
reason: >
INTENT/SCOPE are aspirational HR-for-agents vision prose; no src/, no package manifest — vision-stage only, nothing implemented to reuse.
reviewed: "2026-07-06"
reviewed_by: claude-code
revisit: >
Revisit once an implementation exists (src/ or package manifest lands).
---
# No reusable capability
This repo was reviewed for the `reuse-surface` capability registry
(REUSE-WP-0017 coverage campaign) and has no capability to register at this
time. See the `reason` field above.

4
docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,4 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities: []

88
docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/capabilities/capability.audit.event-retain.md Normal file
View file

@ -0,0 +1,88 @@
---
id: capability.audit.event-retain
name: Audit Event Retention
summary: Collect, normalize, retain, and search audit events with integrity evidence across tenants.
owner: audit-core
status: production
domain: infotech
tags: [audit, retention, compliance]
joins:
itc_cap: operations.audit
provision: data/capability/audit-core-operational.json
provision_maturity: D4
external_evidence:
completeness:
level: C3
name: Substantial
confidence: medium
basis: live_receiver_and_restore_walk
satisfied_expectations:
- HTTP ingest through the backend contract
- append-only Postgres custody on platform-pg
- recovery cited to the live platform data.backup provision
broken_expectations:
- data.archive sink not provided
out_of_scope_expectations:
- application business audit semantics ownership
- booked-cost origination
reliability:
level: R2
confidence: medium
basis: failure_matrix_and_restore_walk
known_reliability_risks:
- single replica
discovery:
intent: >
Provide independent audit fabric for collecting, retaining, searching, and
proving integrity of audit events.
includes:
- audit ingestion
- retention policy
- search and export
- tamper evidence
excludes:
- generating domain business events
- procuring or operating platform backup
- booked financial facts
use_cases: []
availability:
current_level: A4
target_level: A5
current_artifacts:
- audit-core/deploy/audit-core.yaml
- audit-core/audit_core/postgres_backend.py
- rapp-postgres/consumers/audit-core.yaml
consumption_modes:
- http ingest
- source module
relations:
depends_on: []
related_to:
- capability.activity.event-coordinate
- capability.statehub.progress-log
uses_provisions:
- data.transactional (rapp-postgres/platform-pg)
- data.backup (resource:platform:audit-storage, cited)
- security.secrets (OpenBao / ESO)
consumer_guidance:
recommended_for:
- platform and application audit event delivery over POST /v1/events
not_recommended_for:
- treating this store as WORM archive
- replacing application-level logging only
known_limitations:
- recoverable history is the 30-day platform backup window
- no hash-chain or export API yet
---
# Audit Event Retention
Audit Core provides the operational custody layer for audit events.
ITC-CAP join: `operations.audit` at provision maturity D4
(`data/capability/audit-core-operational.json`). Maturity is not a
property of this abstract capability.

22
docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,22 @@
version: 1
updated: '2026-08-16'
domain: infotech
capabilities:
- id: capability.audit.event-retain
name: Audit Event Retention
summary: Collect, normalize, retain, and search audit events with integrity evidence
across tenants.
joins: operations.audit
provision: data/capability/audit-core-operational.json
vector: D4 provision / A4 / C3 / R2
domain: infotech
status: production
owner: audit-core
path: registry/capabilities/capability.audit.event-retain.md
tags:
- audit
- retention
- compliance
consumption_modes:
- http ingest
- source module

15
docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/NO_CAPABILITIES.md Normal file
View file

@ -0,0 +1,15 @@
---
repo: coordination-engine
reason: >
Ambitious coordination-framework prose in INTENT, but only history/spec/registry dirs exist — no runtime code yet.
reviewed: "2026-07-06"
reviewed_by: claude-code
revisit: >
Revisit once runtime code for the coordination framework lands.
---
# No reusable capability
This repo was reviewed for the `reuse-surface` capability registry
(REUSE-WP-0017 coverage campaign) and has no capability to register at this
time. See the `reason` field above.

4
docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,4 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities: []

4
docs/assessments/netkingdom-2026-10-14/registry-before/glas-harness/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,4 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities: []

120
docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md Normal file
View file

@ -0,0 +1,120 @@
---
id: capability.infotech.canon-service
name: InfoTechCanon Service Surface
summary: Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon
information-processing infospace, backed by infospace-bench.
owner: info-tech-canon
status: draft
domain: infotech
tags:
- canon
- infospace
- service
maturity:
discovery:
current: D2
target: D4
confidence: medium
rationale: README documents a working CLI surface (inspect, artifacts, models, standards, review-kit,
alignment-template, validate, graph) over one concrete infospace under infospace/.
availability:
current: A2
target: A3
confidence: medium
rationale: Runnable today via `PYTHONPATH=src python3 -m info_tech_canon ...`; includes a read-only
local HTTP API in addition to the CLI.
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- CLI commands for inspect/artifacts/models/standards/review-kit/alignment-template/validate/graph
- read-only local HTTP API
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- depends on infospace-bench for artifact loading/checks/graph summaries; only one concrete infospace
implemented so far
discovery:
intent: Provide a small, concrete service surface over one InfoTechCanon infospace so the canon corpus
is usable via CLI, importable functions, or a read-only API, not just documentation.
includes:
- JSON-first CLI over the infospace
- importable Python service functions
- read-only local HTTP API
excludes:
- the underlying infospace-bench workspace/evaluation tooling itself (separate capability)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- Python package (`info_tech_canon`)
target_artifacts: []
consumption_modes:
- cli
- library import
- http api (read-only, local)
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.md
tests:
- tests/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- consumers wanting programmatic or CLI access to the InfoTechCanon infospace
not_recommended_for:
- needs requiring a writable or hosted API
known_limitations:
- only one concrete infospace implemented under infospace/ so far
promotion_history: []
---
# InfoTechCanon Service Surface
## Overview
`info-tech-canon` implements a concrete service surface over one InfoTechCanon infospace: a JSON-first CLI, importable Python functions, and a read-only local HTTP API, backed by artifact loading and graph summaries from `infospace-bench`.
## Assessment notes
### Discovery
README documents a working CLI surface (inspect, artifacts, models, standards, review-kit, alignment-template, validate, graph) over one concrete infospace under infospace/.
### Availability
Runnable today via `PYTHONPATH=src python3 -m info_tech_canon ...`; includes a read-only local HTTP API in addition to the CLI.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

21
docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,21 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.infotech.canon-service
name: InfoTechCanon Service Surface
summary: Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon
information-processing infospace, backed by infospace-bench.
vector: D2 / A2 / C1 / R0
domain: infotech
status: draft
owner: info-tech-canon
path: registry/capabilities/capability.infotech.canon-service.md
tags:
- canon
- infospace
- service
consumption_modes:
- cli
- library import
- http api (read-only, local)

85
docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/capabilities/capability.infotech.issue-tracking.md Normal file
View file

@ -0,0 +1,85 @@
---
id: capability.infotech.issue-tracking
name: External Issue Tracker Connector
summary: Backend-agnostic CLI/Python connector to Forgejo (and SQLite cache)
with work-record UUID ↔ external issue mapping. Not the fleet work origin.
owner: issue-core
status: draft
domain: infotech
tags:
- issue-tracking
- connector
- work-record
maturity:
discovery:
current: D4
target: D5
confidence: high
rationale: INTENT.md, SCOPE.md, CAPABILITY-issue-tracking.yaml, mapping design,
boundary-sync policy, AGENT_INTEGRATION.md.
availability:
current: A2
target: A3
confidence: high
rationale: Python package + CLI (list/create/project/map) installable via pip;
mapping store shipped; MCP not yet available.
external_evidence:
completeness:
level: C2
confidence: medium
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- Forgejo + local SQLite backends
- CLI with JSON output; project/map commands
- work_record_uuid optional on TaskSpec
- credential handling via env vars (FORGEJO_TOKEN preferred; GITEA_API_TOKEN deprecated alias; ISSUE_CORE_API_KEY)
broken_expectations: []
out_of_scope_expectations:
- Fleet task origin / intake promotion (work-record canon)
- Default IssueSink for internal findings (activity-core)
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- manual backend configuration (auto-detect planned)
- no built-in issue locking beyond assignee+state
- inward boundary sync not shipped
discovery:
intent: Project and operate on external issue trackers with a stable link to
work-record UUIDs; never replace file-first work records as coordination substrate.
includes:
- unified Python API and CLI over Forgejo/SQLite issue operations
- work_record_issue_map store + project/map/push-status
- local offline cache and backend sync
- credential handling via environment variables
excludes:
- originating workplans/tasks/intake
- MCP server (planned)
- multi-agent fleet board semantics on Forgejo
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- Python package (`issue_core`)
- '`issue` CLI (including project/map)'
target_artifacts: []
consumption_modes:
- cli
- library import
- rest (optional `[api]` extra)
relations:
depends_on: []
supports: []
related_to:
- capability.activity.event-coordinate
evidence:
documentation:
- INTENT.md
- SCOPE.md
- CAPABILITY-issue-tracking.yaml
- docs/uuid-external-id-mapping.md
- docs/boundary-sync-and-status-mapping.md

20
docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,20 @@
version: 1
updated: '2026-07-07'
domain: helix_forge
capabilities:
- id: capability.infotech.issue-tracking
name: Universal Issue Tracking Coordination
summary: Unified Python/CLI interface for issue tracking across Forgejo, GitHub, and GitLab, preventing
direct platform API usage and credential sprawl for coordinating agents.
vector: D4 / A2 / C2 / R1
domain: infotech
status: draft
owner: issue-core
path: registry/capabilities/capability.infotech.issue-tracking.md
tags:
- issue-tracking
- coordination
- multi-platform
consumption_modes:
- cli
- library import

125
docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/capabilities/capability.iam.key-cape.md Normal file
View file

@ -0,0 +1,125 @@
---
id: capability.iam.key-cape
name: KeyCape Lightweight IAM (NetKingdom Profile)
summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract),
orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against
implementation internals.
owner: key-cape
status: draft
domain: infotech
tags:
- iam
- oidc
- netkingdom
- security
maturity:
discovery:
current: D4
target: D5
confidence: high
rationale: README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md),
explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status
(all 23 workplan tasks, 21 green test packages).
availability:
current: A2
target: A3
confidence: high
rationale: README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/`
CI already in place — ahead of most siblings on the Forgejo transition.
external_evidence:
completeness:
level: C2
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- full v0.1 implementation per its own workplan (23/23 tasks)
- 21 test packages, all green
- documented lightweight-to-expanded (Keycloak) migration path
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- maturity claims rely on the repo's own workplan completion record, not independently re-verified
in this sweep
discovery:
intent: Let applications integrate against a versioned IAM profile contract rather than against Keycape
internals, so migrating from lightweight (Authelia/LLDAP/privacyIDEA) to expanded (Keycloak) mode
is a tested operation, not a rewrite.
includes:
- NetKingdom IAM Profile v0.2 lightweight-mode orchestration (Authelia, LLDAP, privacyIDEA)
- profile-contract conformance
excludes:
- expanded-mode (Keycloak) implementation itself (separate deployment target for the same profile)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- deployable lightweight-mode IAM stack
target_artifacts: []
consumption_modes:
- service (self-hosted deployment)
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.md
- workplans/KEY-WP-0001-keycape-implementation.md
tests:
- .gitea/workflows/
- .forgejo/workflows/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- NetKingdom deployments wanting a lightweight, self-hosted IAM profile implementation with a tested
migration path to Keycloak
not_recommended_for:
- deployments already committed to expanded/Keycloak mode
known_limitations:
- v0.1 completion claim not independently re-verified during this coverage sweep
promotion_history: []
---
# KeyCape Lightweight IAM (NetKingdom Profile)
## Overview
KeyCape is the lightweight IAM component of NetKingdom, implementing the versioned NetKingdom IAM Profile (OIDC/PKCE) by orchestrating Authelia, LLDAP, and privacyIDEA — the same profile Keycloak implements in expanded-mode deployments, so migration is a tested operation rather than a rewrite.
## Assessment notes
### Discovery
README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status (all 23 workplan tasks, 21 green test packages).
### Availability
README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/` CI already in place — ahead of most siblings on the Forgejo transition.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

21
docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,21 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.iam.key-cape
name: KeyCape Lightweight IAM (NetKingdom Profile)
summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract),
orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not
against implementation internals.
vector: D4 / A2 / C2 / R1
domain: infotech
status: draft
owner: key-cape
path: registry/capabilities/capability.iam.key-cape.md
tags:
- iam
- oidc
- netkingdom
- security
consumption_modes:
- service (self-hosted deployment)

148
docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md Normal file
View file

@ -0,0 +1,148 @@
---
id: capability.security.iam-tooling-suite
name: NetKingdom Security/IAM Tooling Suite
summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation,
deterministic plan-only security scenario composition, and proposal-only posture feedback.
owner: net-kingdom
status: draft
domain: infotech
tags:
- security
- iam
- kubernetes
- conformance
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit
integration boundary with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon,
and State Hub; canon/standards/ holds versioned IAM v0.3, playbook capability, scenario composition,
tenancy, zone, and boundary standards that provider repos implement against.
availability:
current: A2
target: A3
confidence: medium
rationale: 'No top-level package manifest, but tools/ holds independently documented and runnable
conformance, posture, posture-feedback, scenario-composition, and guarded bootstrap tools; local-identity is separately
packaged and tested.'
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- versioned canon standards already implemented by a sibling repo (key-cape)
- documented, runnable conformance, posture, composition, and bootstrap tools under tools/
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- no top-level packaging; each tool under tools/ has its own runtime dependencies, no unified install
path yet
discovery:
intent: Own canonical NetKingdom security semantics and provide executable reference and conformance tooling
so provider implementations can integrate without inferred authority or hidden deployment coupling.
includes:
- canon/standards/ versioned IAM, tenancy, zone, credential, boundary, and composition standards
- IAM profile conformance checker
- playbook capability contract validator
- deterministic plan-only security scenario composer
- tenancy posture schema and validator
- deterministic proposal-only posture feedback evaluator
- security bootstrap console (local, non-secret-collecting)
- packaged local bootstrap identity CLI
excludes:
- concrete IAM implementations themselves (see key-cape for lightweight mode)
- live secret value handling (bootstrap console explicitly refuses live OpenBao initialization)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- tools/iam-profile-conformance
- tools/playbook-capability-contract
- tools/security-scenario-composer
- tools/tenancy-posture
- tools/posture-feedback
- tools/security-bootstrap-console
- local-identity
target_artifacts: []
consumption_modes:
- cli
- local web ui
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.md
- docs/secrets-engine-security-infrastructure-boundary.md
- tools/*/README.md
tests:
- tools/iam-profile-conformance (pytest fixtures)
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- implementers needing to verify IAM/security conformance against Coulomb's canonical standards
not_recommended_for:
- needs for a packaged, single-install security suite (currently three separate tools)
known_limitations:
- no unified top-level packaging across the three tools
promotion_history: []
---
# NetKingdom Security/IAM Tooling Suite
## Overview
`net-kingdom` provides canonical IAM and security architecture, executable
conformance and posture checks, deterministic plan-only scenario composition,
proposal-only posture feedback, a local bootstrap identity package, and a non-secret-collecting security
bootstrap console. Provider implementations remain in sibling repositories such
as `key-cape`; the self-optimizing platform remains an intent rather than a
current delivery claim.
## Assessment notes
### Discovery
SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an
explicit integration boundary with OpenBao, flex-auth, user-engine, ops-warden,
ops-bridge, info-tech-canon, and State Hub. `canon/standards/` holds the current
IAM v0.3 and related boundary, posture, zone, credential, playbook, and scenario
composition standards.
### Availability
No top-level package manifest exists. The independently runnable surfaces are
documented under `tools/`, and `local-identity` has its own package manifest and
test environment.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

21
docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,21 @@
version: 1
updated: '2026-08-23'
domain: helix_forge
capabilities:
- id: capability.security.iam-tooling-suite
name: NetKingdom Security/IAM Tooling Suite
summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture
validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.
vector: D3 / A2 / C1 / R1
domain: infotech
status: draft
owner: net-kingdom
path: registry/capabilities/capability.security.iam-tooling-suite.md
tags:
- security
- iam
- kubernetes
- conformance
consumption_modes:
- cli
- local web ui

122
docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md Normal file
View file

@ -0,0 +1,122 @@
---
id: capability.ops.tunnel-bridge
name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge)
summary: CLI that manages named SSH reverse tunnels keeping remote execution environments connected to
the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.
owner: ops-bridge
status: draft
domain: infotech
tags:
- ssh
- tunnel
- ops
- connectivity
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: README.txt documents named tunnels, auto-reconnect with exponential backoff, HTTP health
checks, and structured JSON audit events per tunnel; this is also the tool underlying reuse-surface's
own `/bridge` skill.
availability:
current: A2
target: A3
confidence: medium
rationale: Ships a `bridge` CLI, installable via pyproject; already actively used to keep remote Claude
Code sessions (COULOMBCORE, Railiance nodes) connected to the State Hub MCP.
external_evidence:
completeness:
level: C2
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- auto-reconnecting named SSH reverse tunnels
- HTTP health checks confirming forwarded service reachability, not just SSH liveness
- structured audit event log per tunnel
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- operational tool with real production usage but no independent load/failure testing recorded in
this sweep
discovery:
intent: Keep remote execution environments' MCP connectivity to the local State Hub alive and observable
via managed, auto-reconnecting SSH reverse tunnels.
includes:
- named SSH reverse tunnel lifecycle management
- auto-reconnect with exponential backoff
- HTTP health checks
- structured audit event logging
excludes:
- the State Hub or MCP servers themselves (bridge only manages connectivity)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- '`bridge` CLI'
target_artifacts: []
consumption_modes:
- cli
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.txt
tests:
- tests/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- any workstation/remote-machine pair needing durable SSH-tunneled MCP or service connectivity
not_recommended_for:
- needs for tunnel types other than SSH reverse port-forwards
known_limitations:
- no independent load/failure testing recorded beyond production usage observations
promotion_history: []
---
# SSH Reverse Tunnel Lifecycle Manager (ops-bridge)
## Overview
`ops-bridge` is an SSH reverse tunnel lifecycle manager: a `bridge` CLI that keeps remote execution environments (COULOMBCORE, Railiance nodes) connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit logging per tunnel.
## Assessment notes
### Discovery
README.txt documents named tunnels, auto-reconnect with exponential backoff, HTTP health checks, and structured JSON audit events per tunnel; this is also the tool underlying reuse-surface's own `/bridge` skill.
### Availability
Ships a `bridge` CLI, installable via pyproject; already actively used to keep remote Claude Code sessions (COULOMBCORE, Railiance nodes) connected to the State Hub MCP.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

20
docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,20 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.ops.tunnel-bridge
name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge)
summary: CLI that manages named SSH reverse tunnels keeping remote execution environments connected
to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.
vector: D3 / A2 / C2 / R1
domain: infotech
status: draft
owner: ops-bridge
path: registry/capabilities/capability.ops.tunnel-bridge.md
tags:
- ssh
- tunnel
- ops
- connectivity
consumption_modes:
- cli

137
docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md Normal file
View file

@ -0,0 +1,137 @@
---
id: capability.security.ssh-certificate-issuance
name: SSH Certificate Issuance
summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward operational access routing across NetKingdom security lanes.
owner: ops-warden
status: draft
domain: helix_forge
tags:
- ssh
- certificate
- ca
- ops-warden
- openbao
- security
maturity:
discovery:
current: D4
target: D5
confidence: medium
rationale: >
SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command
contract are documented; production OpenBao integration is documented but
engine deployment lives in railiance-platform. A machine-readable routing
catalog (registry/routing/catalog.yaml) and wiki/AccessRouting.md make the
"issue SSH, route the rest" boundary discoverable.
availability:
current: A3
target: A5
confidence: medium
rationale: >
Installable `warden` CLI and `ops-ssh-wrapper` entry points; ops-bridge and
other callers integrate via cert_command without backend-specific branching.
A `warden route` lookup over the pointer catalog (WARDEN-WP-0011) will move
routing discovery from wiki prose to a structured surface for agents (A3 -> A4).
external_evidence:
completeness:
level: C3
name: Functional Core
confidence: medium
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- local and OpenBao/Vault-compatible signing backends
- TTL policy enforcement per actor type
- principals inventory and cert-side scorecard
- signatures audit log and stale-cert cleanup
- cert_command stdout contract for ops-bridge
broken_expectations:
- host-side principal deployment not owned here
- OpenBao SSH engine mount not deployed from this repo
out_of_scope_expectations:
- long-lived API key custody
- tunnel lifecycle management
- Vault/OpenBao cluster operations
reliability:
level: R2
name: Tolerable
confidence: medium
basis: consumer_quality_signals
known_reliability_risks:
- production signing depends on OpenBao availability and token policy
- local backend requires protected CA key handling by operators
discovery:
intent: >
Give the ops fleet short-lived SSH credentials for humans, agents, and
automations without static keys, through a single cert_command surface that
callers can rely on regardless of CA backend; route non-SSH credential needs
to the correct NetKingdom subsystems (OpenBao, flex-auth, key-cape).
includes:
- certificate signing for adm, agt, and atm actors
- actor principals inventory and TTL policy
- cert_command interface (`warden sign`)
- cert-side compliance scorecard and signatures log
- ops-ssh-wrapper for automatic cert acquisition
- NetKingdom credential routing and alignment documentation
- machine-readable routing pointer catalog (registry/routing/catalog.yaml)
excludes:
- tunnel lifecycle
- host /etc/ssh/auth_principals deployment
- OpenBao or Vault cluster setup
- long-lived secret storage
assumptions:
- callers supply actor public keys; humans self-issue admin keys
- production platform uses OpenBao with Vault-compatible SSH engine API
use_cases:
- ops-bridge tunnel cert_command
- Inter-Hub bootstrap short-lived agent access
research_memos:
- ops-warden/SCOPE.md
- ops-warden/wiki/CertCommandInterface.md
- ops-warden/wiki/OpsWardenConfig.md
- ops-warden/wiki/AccessRouting.md
availability:
current_level: A3
target_level: A5
current_artifacts:
- ops-warden/src/warden/
- ops-warden/wiki/CertCommandInterface.md
- ops-warden/wiki/OpsWardenConfig.md
target_artifacts:
- packaged ops-warden release with documented OpenBao role bootstrap
- "`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)"
consumption_modes:
- CLI
- cert_command subprocess
relations:
depends_on: []
supports: []
related_to: []
consumer_guidance:
recommended_for:
- issuing short-lived SSH certs for ops-bridge tunnels
- agent or automation access with TTL-bound principals
- checking cert-side compliance before rotation windows
- orienting dev workers on which NetKingdom subsystem owns each credential type
not_recommended_for:
- storing OpenRouter or Inter-Hub API keys
- replacing OpenBao deployment or host SSH hardening playbooks
- static-key-only legacy access (use ops-bridge static key mode instead)
known_limitations:
- "VaultCA backend config key remains backend: vault for API compatibility"
- host-side scorecard checks live in railiance-infra
---
# SSH Certificate Issuance
ops-warden is the custodian-domain SSH CA tool. It signs short-lived certificates,
maintains the actor inventory, and exposes `warden sign` as the cert_command
contract for ops-bridge and other callers.
Production environments point the vault-compatible backend at OpenBao; labs use
the local ssh-keygen CA backend without platform dependencies.

23
docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,23 @@
version: 1
updated: '2026-06-17'
domain: helix_forge
capabilities:
- id: capability.security.ssh-certificate-issuance
name: SSH Certificate Issuance
summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors
through a stable cert_command CLI interface; steward NetKingdom operational access routing.
vector: D4 / A3 / C3 / R2
domain: helix_forge
status: draft
owner: ops-warden
path: registry/capabilities/capability.security.ssh-certificate-issuance.md
tags:
- ssh
- certificate
- ca
- ops-warden
- openbao
- security
consumption_modes:
- CLI
- cert_command subprocess

127
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md Normal file
View file

@ -0,0 +1,127 @@
---
id: capability.railiance.workload-deployment-tooling
name: Railiance Application Workload Deployment Tooling
summary: S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack — application Helm releases,
Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.
owner: railiance-apps
status: draft
domain: financials
tags:
- railiance
- kubernetes
- helm
- deployment
maturity:
discovery:
current: D3
target: D4
confidence: medium
rationale: SCOPE.md places this repo precisely in the Railiance OAS Stack layering (S5), scoped to
application Helm releases, workload manifests, and operator runbooks for user-facing services such
as vergabe-teilnahme.
availability:
current: A2
target: A3
confidence: medium
rationale: No top-level package manifest, but ships real, runnable tooling under tools/ (build-database-url-secret.sh,
check-oci-image.sh, check-sops.sh, forgejo-smoke.sh, inter-hub-smoke.sh, k8s-server-dry-run.sh,
smoke-service.sh) plus charts/ and manifests/; has both .gitea and .forgejo CI already.
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- Helm charts and Kubernetes manifests for application workloads
- smoke-test and dry-run check scripts, including a forgejo-smoke.sh already ahead of the platform-wide
Forgejo transition
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- no top-level packaging; tooling is a collection of shell scripts under tools/
discovery:
intent: 'Own the S5 layer of the Railiance OAS Stack: deploying and verifying user-facing application
workloads via Helm/Kubernetes with guardrails and operator runbooks.'
includes:
- application Helm releases and Kubernetes workload manifests
- deployment guardrails
- smoke-test and dry-run tooling (including forgejo-smoke.sh)
excludes:
- cluster/platform substrate (see railiance-cluster, railiance-platform)
- CI/CD enablement templates (see railiance-enablement)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- Helm charts
- Kubernetes manifests
- tools/*.sh smoke and check scripts
target_artifacts: []
consumption_modes:
- cli (shell scripts)
- helm/kubernetes deployment
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- SCOPE.md
tests:
- tools/forgejo-smoke.sh
- tools/inter-hub-smoke.sh
- tools/k8s-server-dry-run.sh
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- operators deploying or verifying Railiance user-facing application workloads
not_recommended_for:
- needs at the cluster/platform substrate layer (see railiance-cluster, railiance-platform)
known_limitations:
- no unified packaging; tooling is a set of independent shell scripts
promotion_history: []
---
# Railiance Application Workload Deployment Tooling
## Overview
`railiance-apps` is the S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack: Helm releases, Kubernetes workload manifests, deployment guardrails, and operator runbooks for user-facing services such as `vergabe-teilnahme`, including a `forgejo-smoke.sh` check already ahead of the platform-wide Gitea-to-Forgejo transition.
## Assessment notes
### Discovery
SCOPE.md places this repo precisely in the Railiance OAS Stack layering (S5), scoped to application Helm releases, workload manifests, and operator runbooks for user-facing services such as vergabe-teilnahme.
### Availability
No top-level package manifest, but ships real, runnable tooling under tools/ (build-database-url-secret.sh, check-oci-image.sh, check-sops.sh, forgejo-smoke.sh, inter-hub-smoke.sh, k8s-server-dry-run.sh, smoke-service.sh) plus charts/ and manifests/; has both .gitea and .forgejo CI already.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

22
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,22 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.railiance.workload-deployment-tooling
name: Railiance Application Workload Deployment Tooling
summary: S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack — application Helm releases,
Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing
services.
vector: D3 / A2 / C1 / R1
domain: financials
status: draft
owner: railiance-apps
path: registry/capabilities/capability.railiance.workload-deployment-tooling.md
tags:
- railiance
- kubernetes
- helm
- deployment
consumption_modes:
- cli (shell scripts)
- helm/kubernetes deployment

4
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-bootstrap/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,4 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities: []

122
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md Normal file
View file

@ -0,0 +1,122 @@
---
id: capability.railiance.cluster-bootstrap
name: Railiance Cluster Runtime Bootstrap
summary: 'Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare
Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.'
owner: railiance-cluster
status: draft
domain: financials
tags:
- railiance
- kubernetes
- iac
- bootstrap
maturity:
discovery:
current: D3
target: D4
confidence: medium
rationale: README documents the 'Rails for Ops' convention-over-configuration philosophy and a concrete
quick-start (clone, from two bare servers rebuild a full k8s environment); has .forgejo CI already
in place.
availability:
current: A2
target: A3
confidence: medium
rationale: Real Python package (pyproject, requires-python >=3.11) plus bin/railiance CLI and ansible
playbooks (bootstrap/harden), with a documented quick-start path.
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- documented quick-start from two bare servers to a running Kubernetes environment
- bootstrap/harden ansible playbooks
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- reproducibility claims not independently re-verified (no live bootstrap run during this sweep)
discovery:
intent: 'Provide the cluster runtime entry point for Railiance: reproducible, self-reliant Kubernetes
environment bootstrap from bare servers via convention-over-configuration IaC.'
includes:
- cluster bootstrap CLI and ansible playbooks (bootstrap/harden)
- Kubernetes-based environment rebuild path
excludes:
- application workload deployment (see railiance-apps)
- platform services like Postgres/Valkey (see railiance-platform)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- '`railiance` CLI (bin/railiance)'
- ansible playbooks
target_artifacts: []
consumption_modes:
- cli
- ansible playbook
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.md
tests:
- tests/
- .forgejo/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- operators bootstrapping a new Railiance Kubernetes cluster from bare servers
not_recommended_for:
- application-level or platform-service deployment (see railiance-apps, railiance-platform)
known_limitations:
- reproducibility not independently re-verified via a live bootstrap run in this sweep
promotion_history: []
---
# Railiance Cluster Runtime Bootstrap
## Overview
`railiance-cluster` is the cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, it rebuilds a fully automated Kubernetes-based environment via convention-over-configuration IaC (Terraform/cloud-init/Ansible-adjacent tooling, `railiance` CLI).
## Assessment notes
### Discovery
README documents the 'Rails for Ops' convention-over-configuration philosophy and a concrete quick-start (clone, from two bare servers rebuild a full k8s environment); has .forgejo CI already in place.
### Availability
Real Python package (pyproject, requires-python >=3.11) plus bin/railiance CLI and ansible playbooks (bootstrap/harden), with a documented quick-start path.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

21
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,21 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.railiance.cluster-bootstrap
name: Railiance Cluster Runtime Bootstrap
summary: 'Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare
Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.'
vector: D3 / A2 / C1 / R0
domain: financials
status: draft
owner: railiance-cluster
path: registry/capabilities/capability.railiance.cluster-bootstrap.md
tags:
- railiance
- kubernetes
- iac
- bootstrap
consumption_modes:
- cli
- ansible playbook

125
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md Normal file
View file

@ -0,0 +1,125 @@
---
id: capability.railiance.ci-enablement
name: Railiance Developer Enablement And CI/CD Templates
summary: S4 Developer Enablement layer of the Railiance OAS Stack — reusable CI/CD workflow templates,
developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning
forge runtime.
owner: railiance-enablement
status: draft
domain: financials
tags:
- railiance
- ci-cd
- developer-enablement
- forgejo
maturity:
discovery:
current: D3
target: D4
confidence: medium
rationale: SCOPE.md places this repo precisely at S4 in the Railiance OAS Stack, explicitly scoped
to reusable CI/CD templates and enablement tooling while using (not owning) forge capabilities.
availability:
current: A2
target: A3
confidence: high
rationale: Ships real, reusable Forgejo Actions workflow templates (container-build-push.yaml, container-build-push-multirepo.yaml,
ci-smoke.yaml) plus `tools/promote-repo-to-forgejo.sh` — directly relevant tooling for the ecosystem-wide
Gitea-to-Forgejo transition (REUSE-WP-0019).
external_evidence:
completeness:
level: C2
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- reusable Forgejo Actions CI/CD workflow templates already in production shape
- a repo-promotion-to-forgejo script directly usable for the platform-wide forge transition
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- templates are workflow YAML, not a packaged/versioned artifact; consumption is copy/reference rather
than dependency-managed
discovery:
intent: Give Railiance repos reusable CI/CD templates and developer-enablement tooling (including forge-promotion
tooling) without each repo owning the forge runtime or runner substrate itself.
includes:
- reusable Forgejo Actions CI/CD workflow templates
- repo-to-forgejo promotion tooling
- developer portal/platform template scope (per SCOPE.md)
excludes:
- forge runtime and runner substrate ownership (see railiance-forge)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- workflows/container-build-push.yaml
- workflows/ci-smoke.yaml
- tools/promote-repo-to-forgejo.sh
target_artifacts: []
consumption_modes:
- ci workflow template (copy/reference)
- cli (promote-repo-to-forgejo.sh)
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- SCOPE.md
tests:
- workflows/ci-smoke.yaml
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- Railiance repos needing reusable Forgejo Actions CI/CD templates, or any repo executing a Gitea-to-Forgejo
promotion
not_recommended_for:
- needs for owning forge runtime/runner infrastructure itself (see railiance-forge)
known_limitations:
- templates are consumed by copy/reference, not as a versioned dependency
promotion_history: []
---
# Railiance Developer Enablement And CI/CD Templates
## Overview
`railiance-enablement` is the S4 Developer Enablement layer of the Railiance OAS Stack: reusable CI/CD workflow templates and developer-enablement tooling, including a `promote-repo-to-forgejo.sh` script directly relevant to the ecosystem-wide Gitea-to-Forgejo transition tracked in REUSE-WP-0019.
## Assessment notes
### Discovery
SCOPE.md places this repo precisely at S4 in the Railiance OAS Stack, explicitly scoped to reusable CI/CD templates and enablement tooling while using (not owning) forge capabilities.
### Availability
Ships real, reusable Forgejo Actions workflow templates (container-build-push.yaml, container-build-push-multirepo.yaml, ci-smoke.yaml) plus `tools/promote-repo-to-forgejo.sh` — directly relevant tooling for the ecosystem-wide Gitea-to-Forgejo transition (REUSE-WP-0019).
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

22
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,22 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.railiance.ci-enablement
name: Railiance Developer Enablement And CI/CD Templates
summary: S4 Developer Enablement layer of the Railiance OAS Stack — reusable CI/CD workflow templates,
developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without
owning forge runtime.
vector: D3 / A2 / C2 / R1
domain: financials
status: draft
owner: railiance-enablement
path: registry/capabilities/capability.railiance.ci-enablement.md
tags:
- railiance
- ci-cd
- developer-enablement
- forgejo
consumption_modes:
- ci workflow template (copy/reference)
- cli (promote-repo-to-forgejo.sh)

122
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md Normal file
View file

@ -0,0 +1,122 @@
---
id: capability.railiance.fabric-graph
name: Railiance Fabric Ecosystem Graph
summary: 'Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas,
discovery tools, registry services, graph queries, and State Hub export contracts for services, machines,
repos, deployables, endpoints, ownership, dependencies, and bindings.'
owner: railiance-fabric
status: draft
domain: financials
tags:
- railiance
- graph
- ownership
- discovery
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: README and SCOPE.md document the ecosystem graph model bounded by financial/operational
accountability (who pays, who is accountable), with king/lord/tenant ownership concepts referenced
in docs/FabricDiscoveryAndUpdate.md.
availability:
current: A1
target: A3
confidence: medium
rationale: Python package (`railiance-fabric`) providing a declaration loader and validator; consumed
as a library, no hosted service documented yet.
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- ecosystem graph declaration loader and validator
- schemas for services/machines/repos/deployables/endpoints/ownership/dependencies/bindings
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- discovery/rebuild/update-loop architecture documented as still evolving per docs/FabricDiscoveryAndUpdate.md
discovery:
intent: Let repos declare services, capabilities, interfaces, dependencies, and bindings in source-controlled
files, and model the resulting durable infrastructure-responsibility graph across the Railiance ecosystem.
includes:
- ecosystem graph schema and declaration loader/validator
- State Hub export contracts for the graph
excludes:
- actual infrastructure provisioning (see railiance-infra, railiance-cluster)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A1
target_level: A3
current_artifacts:
- Python package (`railiance-fabric`)
target_artifacts: []
consumption_modes:
- library import
- cli (validation)
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.md
- SCOPE.md
- docs/FabricDiscoveryAndUpdate.md
tests:
- tests/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- Railiance repos wanting to declare their place in the ecosystem ownership/dependency graph
not_recommended_for:
- needs for actual infrastructure provisioning (see railiance-infra/-cluster)
known_limitations:
- discovery/rebuild/update-loop architecture still evolving
promotion_history: []
---
# Railiance Fabric Ecosystem Graph
## Overview
`railiance-fabric` models the durable infrastructure-responsibility graph of the Railiance netkingdom — who pays for infrastructure, who is accountable for it, and which durable interfaces create value across boundaries — via schemas, a declaration loader/validator, and State Hub export contracts.
## Assessment notes
### Discovery
README and SCOPE.md document the ecosystem graph model bounded by financial/operational accountability (who pays, who is accountable), with king/lord/tenant ownership concepts referenced in docs/FabricDiscoveryAndUpdate.md.
### Availability
Python package (`railiance-fabric`) providing a declaration loader and validator; consumed as a library, no hosted service documented yet.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

22
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,22 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.railiance.fabric-graph
name: Railiance Fabric Ecosystem Graph
summary: 'Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas,
discovery tools, registry services, graph queries, and State Hub export contracts for services, machines,
repos, deployables, endpoints, ownership, dependencies, and bindings.'
vector: D3 / A1 / C1 / R0
domain: financials
status: draft
owner: railiance-fabric
path: registry/capabilities/capability.railiance.fabric-graph.md
tags:
- railiance
- graph
- ownership
- discovery
consumption_modes:
- library import
- cli (validation)

129
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md Normal file
View file

@ -0,0 +1,129 @@
---
id: capability.railiance.forge-infrastructure
name: Railiance Forge And Artifact Infrastructure
summary: Source forge, registry, and automation-runner infrastructure for Railiance, separated out from
railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package
registries, and Actions runner substrate.
owner: railiance-forge
status: draft
domain: financials
tags:
- railiance
- forgejo
- forge
- ci-runner
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: README and SCOPE.md explicitly name 'current Gitea operation, future Forgejo migration,
container and package registries, Actions runner substrate, artifact lifecycle' as the scope; status
noted as 'active forge extraction' with canonical registry operation docs already landed.
availability:
current: A1
target: A3
confidence: medium
rationale: README explicitly states 'no live Helm deploy or Kubernetes apply was run as part of the
move' — documentation and operator targets exist, but this repo is mid-extraction; has .gitea CI
(not yet migrated to .forgejo itself, notably, despite owning the migration).
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- scope separation from railiance-apps/railiance-enablement documented
- canonical registry operation docs and runner ownership contracts
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- repo is actively being founded/extracted; no live deploy yet by its own account
- directly relevant to REUSE-WP-0019 but hasn't migrated its own CI to .forgejo/ yet
discovery:
intent: Own source forge, artifact registry, and CI runner substrate responsibilities for Railiance,
separated from application (railiance-apps) and enablement (railiance-enablement) concerns, across
the Gitea-to-Forgejo transition.
includes:
- forge operation (current Gitea, migrating to Forgejo)
- container/package registries
- Actions runner substrate
- artifact lifecycle
excludes:
- application workload deployment (railiance-apps)
- CI/CD templates for consuming repos (railiance-enablement)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A1
target_level: A3
current_artifacts:
- operator docs and tools/ (extraction in progress)
target_artifacts: []
consumption_modes:
- cli (operator tooling)
- documentation/runbooks
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.md
- SCOPE.md
tests: []
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- Railiance operators managing forge/registry/runner infrastructure, especially during the Gitea-to-Forgejo
transition
not_recommended_for:
- treating this as production-stable — the repo's own README states the extraction is active and no
live deploy has run yet
known_limitations:
- actively being founded; no live Helm/k8s deploy has run as part of the extraction yet; own CI still
under .gitea/ pending its own Forgejo migration
promotion_history: []
---
# Railiance Forge And Artifact Infrastructure
## Overview
`railiance-forge` is being founded to separate source forge, artifact registry, and CI/Actions runner responsibilities from `railiance-apps` and `railiance-enablement`. It directly owns the current Gitea operation and the future Forgejo migration — of particular relevance to REUSE-WP-0019 — though by its own account no live deploy has run yet.
## Assessment notes
### Discovery
README and SCOPE.md explicitly name 'current Gitea operation, future Forgejo migration, container and package registries, Actions runner substrate, artifact lifecycle' as the scope; status noted as 'active forge extraction' with canonical registry operation docs already landed.
### Availability
README explicitly states 'no live Helm deploy or Kubernetes apply was run as part of the move' — documentation and operator targets exist, but this repo is mid-extraction; has .gitea CI (not yet migrated to .forgejo itself, notably, despite owning the migration).
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

22
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,22 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.railiance.forge-infrastructure
name: Railiance Forge And Artifact Infrastructure
summary: Source forge, registry, and automation-runner infrastructure for Railiance, separated out from
railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package
registries, and Actions runner substrate.
vector: D3 / A1 / C1 / R0
domain: financials
status: draft
owner: railiance-forge
path: registry/capabilities/capability.railiance.forge-infrastructure.md
tags:
- railiance
- forgejo
- forge
- ci-runner
consumption_modes:
- cli (operator tooling)
- documentation/runbooks

131
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md Normal file
View file

@ -0,0 +1,131 @@
---
id: capability.railiance.infra-provisioning
name: RailianceHosts Infrastructure Provisioning
summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
of truth.
owner: railiance-infra
status: draft
domain: financials
tags:
- railiance
- terraform
- ansible
- infrastructure
maturity:
discovery:
current: D4
target: D5
confidence: high
rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets
setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`)
as source of truth — an unusually complete operational README among the swept repos.
availability:
current: A2
target: A3
confidence: high
rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI
already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
external_evidence:
completeness:
level: C2
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- documented end-to-end quickstart from bare cloud account to converged servers
- SOPS+age encrypted secrets with a documented key-custody model
- inventory/servers.yaml as explicit source of truth
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- reproducibility not independently re-verified via a live provisioning run in this sweep
discovery:
intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle,
cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance
OAS Stack.
includes:
- Terraform server lifecycle management
- cloud-init first-boot configuration
- Ansible convergence playbooks
- SOPS+age encrypted secrets in-repo
excludes:
- Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster)
- platform services (see railiance-platform)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- Terraform configs
- Ansible playbooks
- scripts/
- tools/
target_artifacts: []
consumption_modes:
- cli (terraform/ansible)
- gitops
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- README.md
- SCOPE.md
tests:
- sbom-tools.yaml
- .forgejo/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody
not_recommended_for:
- needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform
for shared services)
known_limitations:
- reproducibility not independently re-verified via a live provisioning run in this sweep
promotion_history: []
---
# RailianceHosts Infrastructure Provisioning
## Overview
`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
## Assessment notes
### Discovery
README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos.
### Availability
Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

22
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,22 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.railiance.infra-provisioning
name: RailianceHosts Infrastructure Provisioning
summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform,
cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source
of truth.
vector: D4 / A2 / C2 / R1
domain: financials
status: draft
owner: railiance-infra
path: registry/capabilities/capability.railiance.infra-provisioning.md
tags:
- railiance
- terraform
- ansible
- infrastructure
consumption_modes:
- cli (terraform/ansible)
- gitops

122
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/capabilities/capability.railiance.platform-services.md Normal file
View file

@ -0,0 +1,122 @@
---
id: capability.railiance.platform-services
name: Railiance Platform Services
summary: 'S3 Platform Services layer of the Railiance OAS Stack — shared cluster services: PostgreSQL
HA, Valkey cache, secret management, identity integration, and object storage.'
owner: railiance-platform
status: draft
domain: financials
tags:
- railiance
- platform
- secrets
- postgres
maturity:
discovery:
current: D3
target: D4
confidence: medium
rationale: SCOPE.md places this repo precisely at S3 in the Railiance OAS Stack, scoped to shared
cluster services (PostgreSQL HA, Valkey, secrets, identity integration, object storage).
availability:
current: A2
target: A3
confidence: medium
rationale: No top-level package manifest, but ships real scripts/ (OpenBao/Vault apply/verify, credential-change
Python tooling) and tools/; has `.forgejo/` CI already in place.
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- OpenBao/Vault secret-management apply/verify scripting
- credential-change tooling
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- no top-level packaging; scripts/tools have no unified install path
discovery:
intent: Own the shared platform services layer (Postgres HA, Valkey, secrets, identity integration,
object storage) that application and enablement layers depend on, without owning the underlying host/cluster
substrate.
includes:
- PostgreSQL HA and Valkey cache service management
- secret management (OpenBao/Vault) apply/verify tooling
- identity integration and object storage
excludes:
- host/cluster substrate provisioning (see railiance-infra, railiance-cluster)
- application workload deployment (see railiance-apps)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- scripts/ (OpenBao/Vault, credential-change tooling)
- tools/
target_artifacts: []
consumption_modes:
- cli (shell/python scripts)
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- SCOPE.md
tests:
- tests/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- Railiance operators managing shared platform services (Postgres, Valkey, secrets, identity, storage)
not_recommended_for:
- needs at the host/cluster substrate layer (see railiance-infra/-cluster) or application layer (see
railiance-apps)
known_limitations:
- no unified top-level packaging across scripts/tools
promotion_history: []
---
# Railiance Platform Services
## Overview
`railiance-platform` is the S3 Platform Services layer of the Railiance OAS Stack: shared cluster services including PostgreSQL HA, Valkey cache, OpenBao/Vault secret management, identity integration, and object storage, consumed by application and enablement layers above it.
## Assessment notes
### Discovery
SCOPE.md places this repo precisely at S3 in the Railiance OAS Stack, scoped to shared cluster services (PostgreSQL HA, Valkey, secrets, identity integration, object storage).
### Availability
No top-level package manifest, but ships real scripts/ (OpenBao/Vault apply/verify, credential-change Python tooling) and tools/; has `.forgejo/` CI already in place.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

20
docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,20 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.railiance.platform-services
name: Railiance Platform Services
summary: 'S3 Platform Services layer of the Railiance OAS Stack — shared cluster services: PostgreSQL
HA, Valkey cache, secret management, identity integration, and object storage.'
vector: D3 / A2 / C1 / R0
domain: financials
status: draft
owner: railiance-platform
path: registry/capabilities/capability.railiance.platform-services.md
tags:
- railiance
- platform
- secrets
- postgres
consumption_modes:
- cli (shell/python scripts)

199
docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.register.md Normal file
View file

@ -0,0 +1,199 @@
---
id: capability.registry.register
name: Capability Registration
summary: Register a new capability so it becomes visible for planning and implementation reuse.
owner: reuse-surface
status: draft
domain: helix_forge
tags:
- registry
- governance
- meta
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: >
Core use case UC-RS-001 is documented in specs/UseCaseCatalog.md and the
registry model is bounded in INTENT.md, but concrete promotion workflows
are not yet grounded in registry artifacts.
availability:
current: A4
target: A5
confidence: medium
rationale: >
Local registry workflows use the reuse-surface CLI (A3). Federation repo
registration is also available through the hosted hub HTTP API at
reuse.coulomb.social (POST/PATCH /v1/repos), deployed and dogfood-tested
on Railiance01 (REUSE-WP-0011).
external_evidence:
completeness:
level: C2
name: Partial
confidence: medium
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- capability IDs can be assigned in registry entries
- maturity vectors can be recorded at registration time
- CLI validate, query, and export support registry workflows
- promotion history can be recorded in entries
- federation repo registration via hosted hub API and hub CLI
broken_expectations:
- no automated duplicate detection yet
out_of_scope_expectations:
- hosting registered capabilities
- enforcing implementation architecture
reliability:
level: R3
name: Usable
confidence: medium
basis: consumer_quality_signals
known_reliability_risks:
- index drift still possible if authors skip validate
- CLI requires local venv install
- sibling repos cannot register until indexes publish raw URLs
evidence:
satisfied_signals:
- CI validate with fail-on-warnings on every push
- hub register/list/federated smoke on production reuse.coulomb.social
- pytest coverage for hub API and federation compose paths
discovery:
intent: >
Make a capability candidate visible in the registry so humans and agents can
discover, assess, compare, and reuse it instead of rebuilding it in isolation.
includes:
- stable capability ID assignment
- initial discovery and availability classification
- explicit completeness and reliability placeholders
- evidence and relation references
excludes:
- implementing the registered capability
- certifying implementation quality
- operating runtime services for registered capabilities
assumptions:
- unregistered capabilities are invisible for registry-driven reuse
- low-maturity entries are acceptable when evidence gaps are explicit
use_cases:
- UC-RS-001
research_memos:
- specs/UseCaseCatalog.md
- specs/ProductRequirementsDocument.md
availability:
current_level: A4
target_level: A5
current_artifacts:
- templates/capability-entry.template.md
- registry/indexes/capabilities.yaml
- reuse_surface/cli.py
- reuse_surface/hub/
- specs/FederationHubAPI.md
- https://reuse.coulomb.social
target_artifacts:
- packaged container release with documented SLO
consumption_modes:
- informational
- markdown authoring
- cli
- service API
relations:
depends_on: []
supports:
- capability.feature-control.evaluate
- capability.identity.vocabulary-canonicalize
related_to:
- capability.registry.validate
evidence:
documentation:
- INTENT.md
- specs/UseCaseCatalog.md
- specs/FederationHubAPI.md
- docs/deploy/reuse-kubernetes.md
tests:
- tests/test_hub.py
- tests/test_hub_sync.py
- .forgejo/workflows/ci.yml
consumer_feedback:
- >
reuse-surface dogfood (REUSE-WP-0011): production hub registration and
/v1/federated compose succeeded on Railiance01 without write-path
regressions after WP-0011 deploy.
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- making a new capability visible at D0/A0/C0/R0 with minimal friction
- seeding planning discussions before implementation exists
not_recommended_for:
- treating registry presence as proof of implementation readiness
- skipping explicit evidence for maturity promotion
known_limitations:
- manual index updates are required after adding an entry
- duplicate detection is guidance-only in the MVP
promotion_history:
- date: "2026-06-14"
dimension: discovery
from: D0
to: D1
rationale: Added name, summary, and registry-first intent from INTENT.md.
author: reuse-surface
- date: "2026-06-15"
dimension: discovery
from: D1
to: D3
rationale: Bounded scope with UC-RS-001 and MVP registry artifacts in specs/.
author: reuse-surface
- date: "2026-06-15"
dimension: availability
from: A0
to: A3
rationale: reuse-surface CLI shipped validate, query, and export commands.
author: reuse-surface
- date: "2026-06-15"
dimension: availability
from: A3
to: A4
rationale: >
Hosted federation hub live at reuse.coulomb.social; hub register/update
via HTTP API and reuse-surface hub CLI; production deploy on Railiance01.
author: reuse-surface
- date: "2026-06-16"
dimension: reliability
from: R2
to: R3
rationale: >
CI gates, pytest hub/federation coverage, and production hub smoke support
normal registration workflows with documented limitations.
author: reuse-surface
---
# Capability Registration
## Overview
Registration is the entry point for reuse visibility. A capability that is not
registered cannot be discovered through the registry surface, even if code or
documentation exists elsewhere.
## Current reuse mode
**Local registry (A3 CLI):** add Markdown entries under `registry/capabilities/`,
update `registry/indexes/capabilities.yaml`, run `reuse-surface validate`.
**Federation registration (A4 API):** register published index URLs on the hosted
hub (`reuse-surface hub register`, `POST /v1/repos`) for cross-repo discovery
via `GET /v1/federated`.
## Next promotion steps
1. Attach concrete use cases and actors to reach D5.
2. Package hub as a versioned container release with operator SLO (A5).
3. Record consumer expectations and broken expectations as external evidence.

107
docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.validate.md Normal file
View file

@ -0,0 +1,107 @@
---
id: capability.registry.validate
name: Registry Entry Validation
summary: Validate capability registry entries against schema, index consistency, and relation integrity.
owner: reuse-surface
status: draft
domain: helix_forge
tags: [registry, validation, cli]
maturity:
discovery:
current: D4
target: D5
confidence: medium
rationale: UC-RS-023 is implemented via reuse-surface validate with schema and drift checks.
availability:
current: A3
target: A3
confidence: high
rationale: Available as reuse-surface validate CLI command.
external_evidence:
completeness:
level: C3
name: Functional Core
confidence: medium
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- schema validation for entry front matter
- index drift detection
- optional relation integrity checks
broken_expectations: []
out_of_scope_expectations:
- runtime validation of registered capability implementations
reliability:
level: R3
name: Usable
confidence: medium
basis: consumer_quality_signals
known_reliability_risks:
- requires local venv install
- relation warnings require explicit --relations flag
evidence:
satisfied_signals:
- validate --relations --fail-on-warnings in CI
- tests/test_registry.py schema and drift coverage
discovery:
intent: Keep registry data structurally sound so agents and humans can trust discovery metadata.
includes:
- JSON Schema validation
- index drift warnings
- relation reference checks
excludes:
- validating implementation code in other repos
use_cases:
- UC-RS-023
research_memos:
- specs/UseCaseCatalog.md
availability:
current_level: A3
target_level: A3
current_artifacts:
- reuse_surface/cli.py
- schemas/capability.schema.yaml
consumption_modes:
- cli
relations:
depends_on:
- capability.registry.register
supports: []
related_to:
- capability.registry.register
evidence:
documentation:
- tools/README.md
- .forgejo/workflows/ci.yml
tests:
- tests/test_registry.py
consumer_feedback:
- >
reuse-surface CI: registry changes fail when schema validation or relation
checks warn with --fail-on-warnings, giving agents a dependable pre-merge gate.
consumer_guidance:
recommended_for:
- pre-commit and CI validation of registry changes
not_recommended_for:
- certifying business correctness of capability claims
known_limitations:
- warnings do not fail CI unless --fail-on-warnings is set
promotion_history:
- date: "2026-06-16"
dimension: reliability
from: R2
to: R3
rationale: CI fail-on-warnings and pytest registry coverage support dependable validation.
author: reuse-surface
---
# Registry Entry Validation
Validates registry shape and consistency through the reuse-surface CLI.

49
docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,49 @@
# Manually maintained capability index for humans and agents.
version: 1
updated: "2026-10-13"
domain: helix_forge
capabilities:
- id: capability.infotech.headless-browser
name: Headless Browser Automation
summary: >-
Headless browser automation, screenshots and keyboard trials through
rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4).
Published A5 local container; managed Railiance admission is pending.
Download the Python 3.10+ standalone client from
https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`,
then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01`
with a fresh output directory. This endpoint was verified locally on 2026-10-13
and is ephemeral; it installs no browser for the caller. If unreachable,
follow the local container setup in the capability card or adapt its A2 source
examples; this is an availability gap on the existing capability.
Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
vector: D3 / A5 / C2 / R2
domain: infotech
status: reviewed
owner: reuse-surface
path: registry/capabilities/capability.infotech.headless-browser.md
tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer]
consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container]
- id: capability.registry.register
name: Capability Registration
summary: Register a new capability so it becomes visible for planning and implementation reuse.
vector: D3 / A4 / C2 / R3
domain: helix_forge
status: draft
owner: reuse-surface
path: registry/capabilities/capability.registry.register.md
tags: [registry, governance, meta]
consumption_modes: [informational, markdown authoring, cli, service API]
- id: capability.registry.validate
name: Registry Entry Validation
summary: Validate capability registry entries against schema, index consistency, and relation integrity.
vector: D4 / A3 / C3 / R3
domain: helix_forge
status: draft
owner: reuse-surface
path: registry/capabilities/capability.registry.validate.md
tags: [registry, validation, cli]
consumption_modes: [cli]

18
docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md Normal file
View file

@ -0,0 +1,18 @@
---
id: capability.infotech.runbook-tutorials
name: Runbook-tutorial engine
summary: Engine, local UI and CLI for guided, parameterized operator runbooks: pack specification and validators, runs with evidence and locked records, maturity, attribute sets, projects and whole-project runs. Packs live in the repos that own the procedure.
owner: runbook-tutorials
status: active
domain: infotech
tags:
- runbook
- tutorial
- operator
- guided
---
Working: specifications `runbook-pack/v0.1` and `v0.2` with validators, the engine and local UI, projects and project templates, and the `rtut`
CLI (see `SCOPE.md`). Not built by decision: execution of steps, a cross-repository pack index, a feedback assistant (`workplans/RBT-WP-0006`).
Only the NetKingdom repository provides packs so far, and its three v0.2 packs have not had their first attended run, so this capability is
`active` but has no operational evidence yet. The fleet maturity vector is not assessed here: it needs the fleet's assessment method.

13
docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,13 @@
version: 1
updated: '2026-09-29'
domain: infotech
capabilities:
- id: capability.infotech.runbook-tutorials
name: Runbook-tutorial engine
summary: Engine, local UI and CLI for guided, parameterized operator runbooks; packs live in the repos that own the procedure.
domain: infotech
status: active
owner: runbook-tutorials
path: registry/capabilities/capability.infotech.runbook-tutorials.md
tags: [runbook, tutorial, operator, guided]
consumption_modes: [git clone, cli]

48
docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/capabilities/execution.sandbox-provision.md Normal file
View file

@ -0,0 +1,48 @@
---
id: capability.execution.sandbox-provision
name: Sandbox Provisioning
summary: Isolated execution environments for agentic development, e2e testing, and bounded automations — profile-based provision, TTL teardown, and State Hub lifecycle registration.
owner: sand-boxer
status: draft
domain: infotech
tags: [sandbox, isolation, provision, e2e, agentic, execution, profile]
maturity:
discovery:
current: D5
target: D6
confidence: high
rationale: >
Charter (INTENT.md), meta-framework spec, extension SDK, integration docs,
and research synthesis. Capability indexed in registry/.
availability:
current: A5
target: A5
confidence: high
rationale: >
CLI v0 (create/destroy/snapshot/TTL), HTTP API, CoulombCore remote smoke.
Cloud adapters E2B/Modal + routing + credits (SAND-WP-0010).
external_evidence:
completeness:
level: C5
name: Mature
confidence: high
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- profile-based create/destroy/snapshot/restore via CLI
- TTL extend and expire/reap (SAND-WP-0009)
- E2B and Modal cloud adapters with BYOK (SAND-WP-0010)
- State Hub lifecycle events on transitions
- wise-validator and the-custodian migration arc complete
- extension SDK with compose-ssh, vm-packer attach, saas-stub, e2b, modal
broken_expectations:
- sandboxer01 dedicated host not live (CoulombCore interim)
out_of_scope_expectations:
- agent harness and tool orchestration (glas-harness)
- e2e test semantics (wise-validator)
consumption_modes:
- CLI (sandboxer)
- core library (Python)
- HTTP API (uvicorn sandboxer.api.app:app)

23
docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,23 @@
version: 1
updated: '2026-06-22'
domain: infotech
capabilities:
- id: capability.execution.sandbox-provision
name: Sandbox Provisioning
summary: Isolated execution environments for agentic development, e2e testing, and bounded automations — profile-based provision, TTL teardown, and State Hub lifecycle registration.
vector: D4 / A2 / C2 / R1
domain: infotech
status: draft
owner: sand-boxer
path: registry/capabilities/execution.sandbox-provision.md
tags:
- sandbox
- isolation
- provision
- e2e
- agentic
- execution
- profile
consumption_modes:
- CLI
- core library

19
docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md Normal file
View file

@ -0,0 +1,19 @@
---
id: capability.infotech.sbom-management
type: capability
name: SBOM management
repo: sbom-nexus
domain: infotech
status: emerging
interfaces:
- http
- cli
---
# SBOM management
Capture repository dependency evidence, preserve immutable SBOM snapshot
history, query current inventory and licence signals, and select a deterministic
bounded fleet catch-up queue.
The extraction interface is documented in `ProductRequirementsDocument.md`.

6
docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,6 @@
schema: reuse-surface.capability-index.v1
repo: sbom-nexus
capabilities:
- id: capability.infotech.sbom-management
path: registry/capabilities/capability.infotech.sbom-management.md
status: emerging

121
docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/capabilities/capability.infotech.repo-template.md Normal file
View file

@ -0,0 +1,121 @@
---
id: capability.infotech.repo-template
name: Coulomb Repository Template
summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.
owner: repo-seed
status: draft
domain: infotech
tags:
- template
- bootstrap
- state-hub
- onboarding
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: >
Template purpose, consumer guide, and validation checklist are documented.
Scope boundaries are explicit in SCOPE.md.
availability:
current: A3
target: A4
confidence: medium
rationale: >
Consumers clone or copy repo-seed and run statehub register. Template
files are markdown/git artifacts without a hosted provisioning API.
external_evidence:
completeness:
level: C2
confidence: medium
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- agent instruction scaffold (AGENTS.md, CLAUDE.md, .claude/rules/)
- registry directory scaffold
- statehub register consumer documentation
- template validation checklist for bootstrap verification
- bootstrap workplan pattern (WP-0001)
broken_expectations: []
out_of_scope_expectations:
- automated repo creation on Gitea
- runtime application code generation
reliability:
level: R2
confidence: medium
basis: consumer_quality_signals
known_reliability_risks:
- register output evolves with state-hub releases; checklist must be revalidated
- LLM inference path depends on llm-connect availability
discovery:
intent: >
Give new Coulomb repositories a consistent starting point for agent
coordination, capability registry growth, and State Hub workplan tracking.
includes:
- git template files for agent instructions and registry scaffold
- documentation for statehub register usage
- consumer validation checklist
- bootstrap workplan convention
excludes:
- application runtime implementation
- owning downstream project code
assumptions:
- consumers have access to state-hub CLI and API
- workplans remain canonical in repo files (ADR-001)
use_cases: []
research_memos:
- docs/statehub-register.md
- docs/template-validation-checklist.md
availability:
current_level: A3
target_level: A4
current_artifacts:
- README.md
- AGENTS.md
- CLAUDE.md
- .claude/rules/
- registry/
- docs/statehub-register.md
- docs/template-validation-checklist.md
consumption_modes:
- git clone
- informational
relations:
depends_on:
- capability.statehub.workstream-coordinate
supports: []
related_to:
- capability.registry.register
evidence:
documentation:
- docs/statehub-register.md
- docs/template-validation-checklist.md
- SCOPE.md
tests: []
consumer_guidance:
recommended_for:
- bootstrapping new Coulomb domain repositories
- standardizing agent onboarding and workplan conventions
not_recommended_for:
- repos that already have mature agent instructions and hub registration
- application templates with heavy code generation requirements
known_limitations:
- register must be run separately after cloning
- fix-consistency requires operator access to state-hub checkout
---
# Coulomb Repository Template
`repo-seed` is the canonical git template for new Coulomb repositories. Clone it,
run `statehub register`, complete the bootstrap workplan, and sync with
`make fix-consistency`.
See `docs/statehub-register.md` for the consumer workflow and
`docs/template-validation-checklist.md` for verification steps.

14
docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,14 @@
version: 1
updated: '2026-06-24'
domain: infotech
capabilities:
- id: capability.infotech.repo-template
name: Coulomb Repository Template
summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.
vector: D3 / A3 / C2 / R2
domain: infotech
status: draft
owner: repo-seed
path: registry/capabilities/capability.infotech.repo-template.md
tags: [template, bootstrap, state-hub, onboarding]
consumption_modes: [git clone, informational]

91
docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.progress-log.md Normal file
View file

@ -0,0 +1,91 @@
---
id: capability.statehub.progress-log
name: Work Progress Logging
summary: Record progress events, decisions, and session notes against workstreams and tasks in State Hub.
owner: state-hub
status: draft
domain: helix_forge
tags: [state-hub, progress, coordination]
maturity:
discovery:
current: D4
target: D5
confidence: medium
rationale: Progress API and agent session protocol are documented in state-hub AGENTS.md.
availability:
current: A4
target: A6
confidence: medium
rationale: Available via State Hub HTTP POST /progress/ endpoint.
external_evidence:
completeness:
level: C3
name: Functional Core
confidence: medium
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- progress events attach to workstreams
- agents can log session summaries
broken_expectations: []
out_of_scope_expectations:
- replacing git commit history
reliability:
level: R3
name: Usable
confidence: medium
basis: consumer_quality_signals
known_reliability_risks:
- depends on hub availability and tunnel health for remote agents
evidence:
satisfied_signals:
- reuse-surface AGENTS.md session-close protocol cites POST /progress/
- cross-repo agents log progress with workstream_id linkage
discovery:
intent: Provide auditable progress memory for cross-repo agent and operator work.
includes:
- progress event creation
- workstream and task linkage
- author attribution
excludes:
- canonical workplan storage
use_cases: []
availability:
current_level: A4
target_level: A6
current_artifacts:
- state-hub/api/
consumption_modes:
- service API
relations:
depends_on:
- capability.statehub.workstream-coordinate
supports: []
related_to:
- capability.statehub.workstream-coordinate
evidence:
documentation:
- AGENTS.md
consumer_feedback:
- >
reuse-surface agents (REUSE-WP-0012): session-close progress posts to State
Hub succeeded for workstream fb0b6067 during federation workplan work.
consumer_guidance:
recommended_for:
- closing agent sessions with hub progress notes
not_recommended_for:
- authoritative task status (use workplan files + fix-consistency)
known_limitations:
- hub must be running locally or via tunnel
---
# Work Progress Logging
Progress logging complements file-backed workplans with live session memory in
State Hub.

121
docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md Normal file
View file

@ -0,0 +1,121 @@
---
id: capability.statehub.workstream-coordinate
name: Workstream And Task Coordination
summary: Track active workstreams, tasks, progress, and consistency across domain repositories through a local-first coordination service.
owner: state-hub
status: draft
domain: helix_forge
tags:
- state-hub
- coordination
- workplans
maturity:
discovery:
current: D4
target: D5
confidence: medium
rationale: >
State Hub intent, scope, and ADR-001 workplan conventions are documented;
concrete agent workflows are still being standardized across repos.
availability:
current: A4
target: A6
confidence: medium
rationale: >
Consumers integrate through the State Hub HTTP API and custodian scripts.
Managed platform operation is the natural target for multi-repo agents.
external_evidence:
completeness:
level: C3
name: Functional Core
confidence: medium
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- workstream and task tracking via HTTP API
- workplan file to database consistency sync
- progress event logging
broken_expectations:
- no native MCP server for all agent environments
out_of_scope_expectations:
- replacing git-backed workplan canon
- identity authority
reliability:
level: R2
name: Tolerable
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- depends on local hub availability and operator maintenance
discovery:
intent: >
Give agents and operators a live, queryable memory of work across domains
without replacing file-backed workplans and governance canon.
includes:
- workstream and task indexing
- progress and decision events
- repo consistency synchronization
- inbox and human-review flags
excludes:
- canon ownership
- task factory for all work origins
- identity authority
assumptions:
- workplans remain authoritative in git for ADR-001 repos
use_cases:
- UC-RS-013
research_memos:
- state-hub/INTENT.md
availability:
current_level: A4
target_level: A6
current_artifacts:
- state-hub/api/
- state-hub/scripts/consistency_check.py
target_artifacts:
- state-hub/platform/state-hub-service
consumption_modes:
- service API
- HTTP REST
relations:
depends_on:
- capability.infotech.hub-core-library
supports:
- capability.registry.register
- capability.infotech.core-hub
related_to:
- capability.statehub.progress-log
- capability.infotech.hub-core-library
- capability.infotech.core-hub
evidence:
documentation:
- state-hub/INTENT.md
- state-hub/AGENTS.md
tests: []
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- cross-repo agent orientation and task status sync
- logging progress after workplan changes
not_recommended_for:
- storing canonical requirements or architecture canon
- assuming hub state overrides git workplan files
known_limitations:
- requires running State Hub locally or via tunnel
---
# Workstream And Task Coordination
## Overview
State Hub provides live coordination for helix_forge repositories while
workplans remain file-backed. This entry represents the service/API consumption
mode for cross-repo agent work.

35
docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,35 @@
version: 1
updated: '2026-06-16'
domain: helix_forge
capabilities:
- id: capability.statehub.progress-log
name: Work Progress Logging
summary: Record progress events, decisions, and session notes against workstreams
and tasks in State Hub.
vector: D4 / A4 / C3 / R3
domain: helix_forge
status: draft
owner: state-hub
path: registry/capabilities/capability.statehub.progress-log.md
tags:
- state-hub
- progress
- coordination
consumption_modes:
- service API
- id: capability.statehub.workstream-coordinate
name: Workstream And Task Coordination
summary: Track active workstreams, tasks, progress, and consistency across domain
repositories.
vector: D4 / A4 / C3 / R2
domain: helix_forge
status: draft
owner: state-hub
path: registry/capabilities/capability.statehub.workstream-coordinate.md
tags:
- state-hub
- coordination
- workplans
consumption_modes:
- service API
- HTTP REST

4
docs/assessments/netkingdom-2026-10-14/registry-before/tenant-engine/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,4 @@
version: 1
updated: '2026-07-23'
domain: infotech
capabilities: []

131
docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md Normal file
View file

@ -0,0 +1,131 @@
---
id: capability.agents.custodian-runtime-tooling
name: Custodian Runtime And Repo-Classification Tooling
summary: 'Generic tooling from The Custodian''s runtime and ecosystem-management surface: an agent runtime
framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across
the workstation''s 61 repos.'
owner: the-custodian
status: draft
domain: custodian
tags:
- agents
- runtime
- classification
maturity:
discovery:
current: D2
target: D4
confidence: medium
rationale: This repo's README and canon content are marked confidential/proprietary; this entry deliberately
scopes to the generic, non-proprietary tooling surface only (runtime/ agent framework, tools/ classification
scripts), which is separately reusable and does not disclose canon/memory contents.
availability:
current: A1
target: A2
confidence: medium
rationale: '`runtime/agent.py` plus context/actions/tool_adapters/policies modules form a real Python
package (own pyproject, tests, README) under `runtime/`; `tools/` holds standalone scripts (batch_author_repo_classifications.py,
human_review_classifications.py, validate_repo_classification.py, push_repo_classifications.sh,
patch-forgejo-remote-urls.sh) used for ecosystem-wide repo classification and the Gitea-to-Forgejo
remote URL migration.'
external_evidence:
completeness:
level: C1
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- standalone agent-runtime package under runtime/ with its own tests
- repo-classification batch/review/validate/push scripts used across the workstation roster
- a patch-forgejo-remote-urls.sh script directly relevant to REUSE-WP-0019
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- repo root is confidential/proprietary (NDA); this entry's scope is deliberately narrow and must
not be widened to canon/memory contents without explicit review
discovery:
intent: Expose only the generic, non-confidential tooling that emerged from The Custodian's ecosystem-management
work — an agent runtime framework and repo-classification batch tooling — as reusable, without describing
canon or memory content.
includes:
- runtime/ agent framework (context, actions, tool adapters, policies)
- repo-classification batch/review/validate/push scripts
- patch-forgejo-remote-urls.sh
excludes:
- canon/ (curated knowledge substrate) and memory/ (operational logs) — confidential, out of registry
scope entirely
- governance/constitution content
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A1
target_level: A2
current_artifacts:
- '`runtime/` Python package'
- '`tools/*.py` and `tools/*.sh` classification scripts'
target_artifacts: []
consumption_modes:
- library import (runtime/)
- cli (tools/ scripts)
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- runtime/README.md
tests:
- runtime/tests/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- ecosystem-management tooling reuse (repo classification batching, Forgejo remote-URL migration) —
not for canon/governance content, which is out of scope
not_recommended_for:
- any attempt to reuse or reference canon/memory contents (confidential, NDA-protected, explicitly excluded
from this entry)
known_limitations:
- registry entry intentionally narrow; confidentiality boundary must be respected in any future promotion
promotion_history: []
---
# Custodian Runtime And Repo-Classification Tooling
## Overview
The Custodian's repository root is confidential and proprietary. This capability entry deliberately scopes only to its generic, non-confidential tooling surface: the `runtime/` agent framework (context, actions, tool adapters, policies) and the `tools/` repo-classification batch/review/validate/push scripts — including `patch-forgejo-remote-urls.sh`, directly relevant to the ecosystem's Gitea-to-Forgejo transition. Canon and memory content are explicitly excluded from this entry.
## Assessment notes
### Discovery
This repo's README and canon content are marked confidential/proprietary; this entry deliberately scopes to the generic, non-proprietary tooling surface only (runtime/ agent framework, tools/ classification scripts), which is separately reusable and does not disclose canon/memory contents.
### Availability
`runtime/agent.py` plus context/actions/tool_adapters/policies modules form a real Python package (own pyproject, tests, README) under `runtime/`; `tools/` holds standalone scripts (batch_author_repo_classifications.py, human_review_classifications.py, validate_repo_classification.py, push_repo_classifications.sh, patch-forgejo-remote-urls.sh) used for ecosystem-wide repo classification and the Gitea-to-Forgejo remote URL migration.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

21
docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,21 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.agents.custodian-runtime-tooling
name: Custodian Runtime And Repo-Classification Tooling
summary: 'Generic tooling from The Custodian''s runtime and ecosystem-management surface: an agent runtime
framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across
the workstation''s 61 repos.'
vector: D2 / A1 / C1 / R0
domain: custodian
status: draft
owner: the-custodian
path: registry/capabilities/capability.agents.custodian-runtime-tooling.md
tags:
- agents
- runtime
- classification
consumption_modes:
- library import (runtime/)
- cli (tools/ scripts)

123
docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/capabilities/capability.identity.user-engine.md Normal file
View file

@ -0,0 +1,123 @@
---
id: capability.identity.user-engine
name: Headless Multi-Tenant User Engine
summary: Headless, multi-application, multi-tenant user management engine covering registration, identity/factor
models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.
owner: user-engine
status: draft
domain: communication
tags:
- identity
- user-management
- multi-tenant
maturity:
discovery:
current: D4
target: D5
confidence: high
rationale: 'Unusually large documentation set for its size: docs/development.md, configuration.md,
contracts.md, canon-mapping.md, canon-interface-card.yaml, family-dataspace-onboarding.md, registration-identity-and-factor-model.md,
prepared-accounts-and-entitlement-claims.md, hats-realms-services-assets-access-profiles.md, onboarding-journeys-and-welcome-protocols.md,
and more — scope and contracts are thoroughly documented.'
availability:
current: A1
target: A3
confidence: medium
rationale: Python package with `make test`; no packaged distribution or hosted service confirmed in
this sweep.
external_evidence:
completeness:
level: C2
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- registration/identity/factor model documented
- entitlement claims and access-profile model (hats/realms/services/assets) documented
- canon mapping and interface card present
broken_expectations: []
out_of_scope_expectations: []
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- breadth of documented scope not independently verified against implementation completeness in this
sweep
discovery:
intent: Provide a headless, multi-application, multi-tenant user-management engine covering the full
registration-to-entitlement lifecycle, reusable across NetKingdom-family applications.
includes:
- multi-tenant registration and identity/factor model
- entitlement claims and hats/realms/services/assets access profiles
- onboarding journeys and welcome protocols
excludes:
- IAM/OIDC protocol implementation itself (see key-cape, net-kingdom)
assumptions: []
use_cases: []
research_memos: []
availability:
current_level: A1
target_level: A3
current_artifacts:
- Python package (`user-engine`)
target_artifacts: []
consumption_modes:
- library import
relations:
depends_on: []
supports: []
related_to: []
evidence:
documentation:
- docs/contracts.md
- docs/registration-identity-and-factor-model.md
- docs/canon-mapping.md
tests:
- tests/
consumer_feedback: []
bug_reports: []
incidents: []
consumer_guidance:
recommended_for:
- multi-tenant applications needing a headless user/identity/entitlement engine
not_recommended_for:
- needs for the IAM/OIDC protocol layer itself (see key-cape/net-kingdom)
known_limitations:
- large documented scope; implementation completeness not independently verified in this sweep
promotion_history: []
---
# Headless Multi-Tenant User Engine
## Overview
`user-engine` is a headless, multi-application, multi-tenant user-management engine: registration, identity/factor models, prepared accounts and entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys, documented in unusual depth for its size.
## Assessment notes
### Discovery
Unusually large documentation set for its size: docs/development.md, configuration.md, contracts.md, canon-mapping.md, canon-interface-card.yaml, family-dataspace-onboarding.md, registration-identity-and-factor-model.md, prepared-accounts-and-entitlement-claims.md, hats-realms-services-assets-access-profiles.md, onboarding-journeys-and-welcome-protocols.md, and more — scope and contracts are thoroughly documented.
### Availability
Python package with `make test`; no packaged distribution or hosted service confirmed in this sweep.
### Completeness
First-pass honest assessment from the REUSE-WP-0017 coverage campaign
(reuse-surface). No external consumer feedback exists yet; levels reflect
scope-vs-intent documentation quality, not internal code quality.
### Reliability
No production consumer telemetry exists yet; reliability level is
intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence.
## Promotion checklist
- [x] ID follows `capability.<domain>.<name>` pattern
- [x] Maturity enums match `specs/CapabilityMaturityStandard.md`
- [x] `external_evidence` is populated separately from `maturity`
- [ ] Relations reference valid capability IDs (none yet)
- [x] Index entry added in `registry/indexes/capabilities.yaml`

19
docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,19 @@
version: 1
updated: '2026-07-06'
domain: helix_forge
capabilities:
- id: capability.identity.user-engine
name: Headless Multi-Tenant User Engine
summary: Headless, multi-application, multi-tenant user management engine covering registration, identity/factor
models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.
vector: D4 / A1 / C2 / R0
domain: communication
status: draft
owner: user-engine
path: registry/capabilities/capability.identity.user-engine.md
tags:
- identity
- user-management
- multi-tenant
consumption_modes:
- library import

905
docs/assessments/netkingdom-2026-10-14/registry-changes.json Normal file
View file

@ -0,0 +1,905 @@
[
{
"repo": "access-engine",
"path": "registry/capabilities/capability.authorization.policy-evaluate.md",
"before_sha256": "aaeb31f583f35a16abff75674227aff7f8a45ebd481c14470932d1adfeffe680",
"after_sha256": "a209848f31635e4637b481fc4fefca2331957ebb89b0ae2198b90affeae247fc",
"operation": "write"
},
{
"repo": "access-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "e78fd82c4b4cec018acb09344793845ffa8ae24dd39d95bca562e8dbcf89abcd",
"after_sha256": "7d59022dac9da4d8dcbecab936d3cea9b154c8c51478b378932fd9ebe5ec7e02",
"operation": "write"
},
{
"repo": "activity-core",
"path": "registry/capabilities/capability.activity.event-coordinate.md",
"before_sha256": "1f9e305b00680e7cc93ec5c1fa3c3ffa6fc710b7a44737327727786e0c122872",
"after_sha256": "72f5366d6eae0a26568ad62ea646b928ac96adaa7fcb864fb9934d405475f03b",
"operation": "write"
},
{
"repo": "activity-core",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "4579700304a50d05cb5371749feb4294dce13c9b76f849248efe5a59a7d5968a",
"after_sha256": "536d359366ccf3db3b2b0d390635bc2c5311bd37ac7ff89dae11d809ef15b848",
"operation": "write"
},
{
"repo": "agentic-resources",
"path": "registry/NO_CAPABILITIES.md",
"before_sha256": "1628a447745bb24d4e7bc55b9586a718064c4d8e249e055fa58310705a8c9e0e",
"after_sha256": null,
"operation": "delete"
},
{
"repo": "agentic-resources",
"path": "registry/capabilities/capability.agents.performance-learning.md",
"before_sha256": null,
"after_sha256": "2d9988711c84968dc86a9149caed87f09362916d23b82cd28d3f7ad947378e8b",
"operation": "write"
},
{
"repo": "agentic-resources",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86",
"after_sha256": "42986b7a274ef510166e566a9756d594a6f88706189bc97ac889bab86b20240d",
"operation": "write"
},
{
"repo": "approval-engine",
"path": "registry/capabilities/capability.security.approval-lifecycle.md",
"before_sha256": null,
"after_sha256": "bb1e47b94183c41d45c2dccb7ae5bc1f7bc98ad3f0ef5c4ee6d0cd1c5b5b06bb",
"operation": "write"
},
{
"repo": "approval-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "b6812fd12dc530270fb66bae592c828f56f17f2fc86759cb04d750162fc619a4",
"operation": "write"
},
{
"repo": "audit-core",
"path": "registry/capabilities/capability.audit.event-retain.md",
"before_sha256": "679d47a986b9d6bf5c24cd5d995ce19236daf35f5d542365e907afc822be49b4",
"after_sha256": "88f58dc61aef8746124827f47eac5dd20ec5761e11551a864a3c5d5a7f28f172",
"operation": "write"
},
{
"repo": "audit-core",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "b9247a087984a636ef4b421c92f9c280572161f358559cf0e5fb7f5f8f1a598e",
"after_sha256": "6a1d7dbb442f0fd0e481d54fb0acbee37ef2e693198b6f2108e154d3c3795e0e",
"operation": "write"
},
{
"repo": "coordination-engine",
"path": "registry/NO_CAPABILITIES.md",
"before_sha256": "92e03b7609777348fd1c7609e8fa4922730378f3870496c9580f9b27a9fe0a4b",
"after_sha256": null,
"operation": "delete"
},
{
"repo": "coordination-engine",
"path": "registry/capabilities/capability.coordination.cross-owner-work.md",
"before_sha256": null,
"after_sha256": "f4a7a4ee2bf689056eb02d647ae97a94dd1a16462180fbed6762a006983fe7ae",
"operation": "write"
},
{
"repo": "coordination-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86",
"after_sha256": "f7a2c140ac1a7628a2106b1047b59e208879257b23ffed6dceef8ecf6c3bd420",
"operation": "write"
},
{
"repo": "emergent-security",
"path": "registry/capabilities/capability.security.agent-knowledge.md",
"before_sha256": null,
"after_sha256": "66bdfd445f0292c0b9fec6999c3d7ca6134a2a1b1f781a6fc6cfa4bd62baa34c",
"operation": "write"
},
{
"repo": "emergent-security",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "268d9192dc9b97da462d46fe5b40ea33e678840b23944ab0cd73622c130bdef6",
"operation": "write"
},
{
"repo": "fin-hub",
"path": "registry/capabilities/capability.finance.security-budget-evidence.md",
"before_sha256": null,
"after_sha256": "314525b624e290bffb3817f3fe0e4a5f6d729ac93d1be485fa06fbe8896d0576",
"operation": "write"
},
{
"repo": "fin-hub",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "c6bb1aa6b770f684721fae9f1576f2c2f0128d1b758f4e33b8a277e0b4ff087a",
"operation": "write"
},
{
"repo": "gate-house",
"path": "registry/capabilities/capability.security.doctrine-review.md",
"before_sha256": null,
"after_sha256": "55964589de53f6b07c184b0d8e18e511fbc870ceff0f5f28fa2b015b97568d26",
"operation": "write"
},
{
"repo": "gate-house",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "2b63d94375d29649c41a7eae7cfb3f6e35210fd3438aa5013f3ddc22a662511a",
"operation": "write"
},
{
"repo": "glas-harness",
"path": "registry/capabilities/capability.execution.profile-harness.md",
"before_sha256": null,
"after_sha256": "6eea0a69ea80236bdd30379b189eb1c1e8b50d95e89eac8b43ec8fbf51ad659f",
"operation": "write"
},
{
"repo": "glas-harness",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86",
"after_sha256": "8f86dbdaf6535c909ff19967f7806d85c1f7a09db1e999033abf9b9007ed805b",
"operation": "write"
},
{
"repo": "info-tech-canon",
"path": "registry/capabilities/capability.infotech.canon-service.md",
"before_sha256": "d07fdd36dc877681e6111eedc435defeed188b55092312273b51aa433846b323",
"after_sha256": "db9721777788773026d646462fad03df04cf3d1846a0ebf5d1cf1a809ea9f945",
"operation": "write"
},
{
"repo": "info-tech-canon",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "b8a294905a361a3cc8df8ddb9c725e89310426c3539e5e9a00a1160aed00b858",
"after_sha256": "6015ec78772586e6e351422741430be8c40d7c7116403ee4b92933df342c4c72",
"operation": "write"
},
{
"repo": "informed-decision",
"path": "registry/capabilities/capability.security.human-decision-workspace.md",
"before_sha256": null,
"after_sha256": "d64c27fcfe13ffcf0de9db7a916044f93d45b36a1dff26486efa3ac0f5ca4fc1",
"operation": "write"
},
{
"repo": "informed-decision",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "b43ea44c725dcbd59fe957ffc307805e0aabc23b60a4a9049005c70ca4871a62",
"operation": "write"
},
{
"repo": "issue-core",
"path": "registry/capabilities/capability.infotech.issue-tracking.md",
"before_sha256": "61ff410aa7a86d5f50238395919e361fa96f01214a1ba3c14ef53a065f84ec29",
"after_sha256": "60282cc3b4ab58a9df621b895bfd1e7b485d6b7ef47bde11f7d339907aeb262b",
"operation": "write"
},
{
"repo": "issue-core",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "ceb4ba66ad67c8db1e4e5fe83305f1e4552dc6358daf00862255614d17802051",
"after_sha256": "70eb00870ed87072aeb0f7c38de0a879f1b3910fe6f976b982a191e261e8e7be",
"operation": "write"
},
{
"repo": "key-cape",
"path": "registry/capabilities/capability.iam.key-cape.md",
"before_sha256": "ca65622d7d7443c5ca67f59bfe6bccb2ac5b3d17aac042adcf43ef782b455158",
"after_sha256": "c987ddd0155c248e35409878e9b2dc36ffd18bbd1b82fce8a90157fc4224a915",
"operation": "write"
},
{
"repo": "key-cape",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "efd1dc5095124a0978986af4f0c0555be44ec1b7bb50d3e2417cfedeceb12420",
"after_sha256": "901d15c15cacd844cf19a1a7b74c890ce5e0b00a3372a9e10bd7114f328596c8",
"operation": "write"
},
{
"repo": "kings-guard",
"path": "registry/capabilities/capability.security.posture-assessment.md",
"before_sha256": null,
"after_sha256": "e6bb4704a9e008dc8bbe8a2b14be880c8b8122ace4f2828b3fbee6ecf2583a89",
"operation": "write"
},
{
"repo": "kings-guard",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "8a143864a6ce9a7b6c5a0f64eb75f67cfa99c2b9b155baac4f81a261d3a5312c",
"operation": "write"
},
{
"repo": "maturity-engine",
"path": "registry/capabilities/capability.security.maturity-claims.md",
"before_sha256": null,
"after_sha256": "498736f3da2eaa4e1a3f9f223820eb630a8fa72be4a9c1423dc7c1722b55c28f",
"operation": "write"
},
{
"repo": "maturity-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "42b4cd1f9c6fe0960acadd10a337a579a6313fa46c2ff5a2a34bbacf2749d049",
"operation": "write"
},
{
"repo": "net-kingdom",
"path": "registry/capabilities/capability.security.iam-tooling-suite.md",
"before_sha256": "653a18602efce1938ed05206f2514c41fafb7fc7c4f968248bce85e31bd8633e",
"after_sha256": "235773e0913ec2f2cb4b8d5ac09839851bf9af7c7c5cb38b5207a3305e2eaf15",
"operation": "write"
},
{
"repo": "net-kingdom",
"path": "registry/capabilities/capability.security.scenario-compose.md",
"before_sha256": null,
"after_sha256": "e9bab551d4ca5afac63cc70b59a783e6da96a1a361cc713fab31dbff604d351f",
"operation": "write"
},
{
"repo": "net-kingdom",
"path": "registry/capabilities/capability.security.posture-feedback.md",
"before_sha256": null,
"after_sha256": "470ffa52b5da01ee6562de7654503da592c456c80eaa4a1b623d92594cfbb00f",
"operation": "write"
},
{
"repo": "net-kingdom",
"path": "registry/capabilities/capability.security.case-contracts.md",
"before_sha256": null,
"after_sha256": "6880ee826febb8cb6da0c804ec59558fffbcaa22e3893065a2d9f2bb1d6b6732",
"operation": "write"
},
{
"repo": "net-kingdom",
"path": "registry/capabilities/capability.security.bootstrap-recovery.md",
"before_sha256": null,
"after_sha256": "f98058ad567bc1fc8f0f8b5ae9c337a93bec87434ec3b0060488ae8335f5dd50",
"operation": "write"
},
{
"repo": "net-kingdom",
"path": "registry/capabilities/capability.security.emission-profile.md",
"before_sha256": null,
"after_sha256": "575b651fe421659594deef4381bff6f20ff09acffd4f68e36dfd18060742aaed",
"operation": "write"
},
{
"repo": "net-kingdom",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "edad1cc15d3eec0aaa02517a8ccf04a00e0a6ceb6c8c7846b46fd5512018c168",
"after_sha256": "6fadeb0e89729a9226d6eebd44fbb07723512a3ebe6737f5a1113b14829447ed",
"operation": "write"
},
{
"repo": "ops-bridge",
"path": "registry/capabilities/capability.ops.tunnel-bridge.md",
"before_sha256": "d291311b5911cc512f05394cf57f804ae26b8844bb972063a42d423060051e9f",
"after_sha256": "1c3a43c90650adb730e86e3aa8df885e0e87499a0228bfb88a31eac699028af9",
"operation": "write"
},
{
"repo": "ops-bridge",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "c1d311ba89d0c06efb86d5648bae87fdc83903ccc359dfc8ce4f9476728fc068",
"after_sha256": "aefd795eb16fcfdebc108450826a0f62e000bc61e9d78007bc6221bc2328e40c",
"operation": "write"
},
{
"repo": "ops-mason",
"path": "registry/capabilities/capability.security.structure-construction.md",
"before_sha256": null,
"after_sha256": "7d6699c19f89d1ab916e0e2da6f7a36232b4960f693b042bf4374c86b7115f13",
"operation": "write"
},
{
"repo": "ops-mason",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "5eb499bc819c874835b8e6727ccbd5f9889ebb6f25a90018e3e574e5b6082b32",
"operation": "write"
},
{
"repo": "ops-warden",
"path": "registry/capabilities/capability.security.ssh-certificate-issuance.md",
"before_sha256": "76196d038635dd2114854b233dab9ebeaf91a8c7ceb9de222997674cce36b58a",
"after_sha256": "f48c749ec3342b57d94866c847be5f3ff10934bfa86b5953b729afde6d3e6b5f",
"operation": "write"
},
{
"repo": "ops-warden",
"path": "registry/capabilities/capability.security.access-routing.md",
"before_sha256": null,
"after_sha256": "e3d5b2737fa743174216e0b106cba8ae861b9a1fd7797331a041ffa941a3beae",
"operation": "write"
},
{
"repo": "ops-warden",
"path": "registry/capabilities/capability.security.case-follow-through.md",
"before_sha256": null,
"after_sha256": "8a69a28b2f17ee247305fae6201decb0805ff903ced37ab91d8c6c5dbe8a681d",
"operation": "write"
},
{
"repo": "ops-warden",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "795194870562a3273125b78f6460c2b27dfff1de956e79298dc9600cb520c633",
"after_sha256": "4d3aba70ead10c826814dc766f9d23e3e0ce52475330acf57905bf62b01c819c",
"operation": "write"
},
{
"repo": "policy-nexus",
"path": "registry/capabilities/capability.security.policy-publication.md",
"before_sha256": null,
"after_sha256": "b961365f5a8a067226290e56cc31f6c254c345451d1830f032b670c013575d8a",
"operation": "write"
},
{
"repo": "policy-nexus",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "c1eb3e23621de354a9081cbf29a2f3d772b5f8538aaceca417574cde5a04c021",
"operation": "write"
},
{
"repo": "rail-kubernetes",
"path": "registry/capabilities/capability.railiance.kubernetes-rail.md",
"before_sha256": null,
"after_sha256": "896feea967e22f276287408aaae6e34b95839e29a18c4fdc30e4c83baa30e05f",
"operation": "write"
},
{
"repo": "rail-kubernetes",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "699f69facea1ce4e71d90fe0790db19b68d3a546015453651d3afc808d31d09d",
"operation": "write"
},
{
"repo": "railiance-apps",
"path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md",
"before_sha256": "c312d273ac62128642c1d55e6a993ee998f69dbec173594f78a809cb6e2db497",
"after_sha256": "ad24b7656512f93698af3182a3187c2e32efd5e74ae69007cb86eb7cd889528f",
"operation": "write"
},
{
"repo": "railiance-apps",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "2f01f8e8099e9130350db943be800b0eaf0cd3b65d22bc4e7f5b832b055efbad",
"after_sha256": "2a550acf8545e95bd81842bb1b00f4db46c4dbb42b522823f043e948667ddf2c",
"operation": "write"
},
{
"repo": "railiance-bootstrap",
"path": "registry/capabilities/capability.railiance.bootstrap-sequencing.md",
"before_sha256": null,
"after_sha256": "9bbfe970a0bca433f5e4f0e13f244d26ff97280db0123533ea403cc1bbaaa790",
"operation": "write"
},
{
"repo": "railiance-bootstrap",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86",
"after_sha256": "feefcc699e045a1a72f254d71f46460ad2362ed23c9de6e54c952711fcb33788",
"operation": "write"
},
{
"repo": "railiance-cluster",
"path": "registry/capabilities/capability.railiance.cluster-bootstrap.md",
"before_sha256": "d8cb1061eb7ce2f528eb1514975ce978755de1b4a0f067755429e5379e42fe4d",
"after_sha256": "dec1d194f06a35a35d80ed5bd4f59a7a309737ae611fafd52d6aad9896346d78",
"operation": "write"
},
{
"repo": "railiance-cluster",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "3946542cfb17368e405fa31c0f2b37073e4b9d0162410b5b916875e3d335565c",
"after_sha256": "0e67a2aca183ee7ef9c4c04e618fcb03647120f456a133e84a8f42c2b8d8fcde",
"operation": "write"
},
{
"repo": "railiance-enablement",
"path": "registry/capabilities/capability.railiance.ci-enablement.md",
"before_sha256": "24f46220be11362de2da38d908dc9decd9999a7c46779b586d1a79859890d182",
"after_sha256": "3f90be42901660ed177f2636455919c21adf382ac6118950f0ec52526ba6e147",
"operation": "write"
},
{
"repo": "railiance-enablement",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "503bbc9ce27b9048fe1c86624883c7c7d366561c9371f2952757bc93de06ebbd",
"after_sha256": "4b1f91b0da94e3098916f3e360b20b9926be4dd8683d6fb167a027aaf04ebfac",
"operation": "write"
},
{
"repo": "railiance-fabric",
"path": "registry/capabilities/capability.railiance.fabric-graph.md",
"before_sha256": "51ff86d99777b422eb44b55bba4eb4aa915c23b8243ea3dace995449c97ccd67",
"after_sha256": "25ad5efa3f874c60c4adc4f0eb46b4ce27805659062c0453a581e8d5b146443d",
"operation": "write"
},
{
"repo": "railiance-fabric",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "13c4da2de7e45f42ea1c6e6099bb011245f986250d7e31984725e1953ac4ba46",
"after_sha256": "f473644906fe3f331702b407c3519e6a3cd0d96d362cf30d80e03aac53c3b862",
"operation": "write"
},
{
"repo": "railiance-forge",
"path": "registry/capabilities/capability.railiance.forge-infrastructure.md",
"before_sha256": "bb811c687874c7f65d0baf6719ea44477a6b22f9793ff57d2234d454fc8c3966",
"after_sha256": "a974968ea22aa2ce39f243677ae6a7997e2850f0b5630c4fd0107819a8151135",
"operation": "write"
},
{
"repo": "railiance-forge",
"path": "registry/capabilities/capability.security.forge-secret-prevention.md",
"before_sha256": null,
"after_sha256": "54a1797dfcaa724be1b837bc69abc3df7e5546289c3a7faf333d7bc0b580b8f7",
"operation": "write"
},
{
"repo": "railiance-forge",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "70bd7584464d89616fa707d4a1a1877e3fafc3f635414f6e7974fbfafd2d8587",
"after_sha256": "4df605d617b7656ffb94a43ab4633c8fc69ec723f68f5f5b8d5f24ad8efb6b98",
"operation": "write"
},
{
"repo": "railiance-infra",
"path": "registry/capabilities/capability.railiance.infra-provisioning.md",
"before_sha256": "284a6120e78fce726409feb3ccd718d8316df50dfc544e94b638744daee5d899",
"after_sha256": "3a66a7ef7ea692f9908c054e7d689a374b816aeb0beefade6b42d697d3112f9f",
"operation": "write"
},
{
"repo": "railiance-infra",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "067d7142a60637bd10224a1651d36dcc7c03945f98cfe960231ab11318a7352e",
"after_sha256": "14a76b1f1dd317a1d426502ff5f80780e9551cd1cd600543de6fb9a84cb8ada2",
"operation": "write"
},
{
"repo": "railiance-master",
"path": "registry/capabilities/capability.railiance.security-consumption-contracts.md",
"before_sha256": null,
"after_sha256": "0477910eaabec436e7fa1cc8244bed5b1319436f6fa22e20086fb0f676f3de14",
"operation": "write"
},
{
"repo": "railiance-master",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "f36cb2765ec04064314f43866f9a87a94a4f0f728adfaad46739f232b4986c0a",
"operation": "write"
},
{
"repo": "railiance-platform",
"path": "registry/capabilities/capability.railiance.platform-services.md",
"before_sha256": "569a812003ccf78e16cbceda7748d2997552ca6784899aabbf25edd9201cd1d9",
"after_sha256": "ac900d26de158ea990bd5f666dcaa1dc8e715e6f1e5b6594b3ab23e2c208b8b6",
"operation": "write"
},
{
"repo": "railiance-platform",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "844a6ce477df5536159133160f3370e94adaf40e0e47955ee6f386f13cda588e",
"after_sha256": "0315d526165368e0a513de6b15932778d43c3e6045c589c95060f555fca3202e",
"operation": "write"
},
{
"repo": "railiance-telemetry",
"path": "registry/capabilities/capability.observability.security-signals.md",
"before_sha256": null,
"after_sha256": "5a4ccfe91855a423cce8fe4f6432a15eb78acd2f1413475d4e5ceeb415b15f3d",
"operation": "write"
},
{
"repo": "railiance-telemetry",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "82f3f2d188e2d7ebea71b7262e106c5f48feaf39a2da881bb645ff9352884205",
"operation": "write"
},
{
"repo": "rapp-openbao",
"path": "registry/capabilities/capability.railiance.openbao-package.md",
"before_sha256": null,
"after_sha256": "9de890da536c34ac2b50576e2c4a9c03792c8a07545d2a0566ace68ac10a293e",
"operation": "write"
},
{
"repo": "rapp-openbao",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64",
"operation": "write"
},
{
"repo": "rapp-playwright",
"path": "registry/capabilities/capability.railiance.browser-verification.md",
"before_sha256": null,
"after_sha256": "ad1f3f14ccabec8b25a4a0125ad3ea6c065c3216b6bc6f84552f6c1435e5d042",
"operation": "write"
},
{
"repo": "rapp-playwright",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "79645df817858f96230f2443d66796d1078185c7afef5948f6a38632234d33bb",
"operation": "write"
},
{
"repo": "rapp-policy-nexus",
"path": "registry/capabilities/capability.railiance.policy-publication-package.md",
"before_sha256": null,
"after_sha256": "21415ed5e89dcf8bd2df0c8bc99b07d2c87173809c37fa2582de6d336918a126",
"operation": "write"
},
{
"repo": "rapp-policy-nexus",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00",
"operation": "write"
},
{
"repo": "rapp-postgres",
"path": "registry/capabilities/capability.railiance.postgres-isolation-recovery.md",
"before_sha256": null,
"after_sha256": "64503872abb24bb28f291264e860ab094c6abb721fbfe90b47258ad13b77af44",
"operation": "write"
},
{
"repo": "rapp-postgres",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776",
"operation": "write"
},
{
"repo": "rapp-telemetry",
"path": "registry/capabilities/capability.railiance.telemetry-package.md",
"before_sha256": null,
"after_sha256": "a67dbf6905223c04b1c003d5f967841038743c8c1479812f5cf0bb55ad6cee77",
"operation": "write"
},
{
"repo": "rapp-telemetry",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4",
"operation": "write"
},
{
"repo": "rapp-tenant-engine",
"path": "registry/capabilities/capability.railiance.tenant-engine-package.md",
"before_sha256": null,
"after_sha256": "e7cf0485cfdb6f497281638d81f908b5c2fe1053125c6ef28130504909d1d49e",
"operation": "write"
},
{
"repo": "rapp-tenant-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732",
"operation": "write"
},
{
"repo": "rapp-user-engine",
"path": "registry/capabilities/capability.railiance.user-engine-package.md",
"before_sha256": null,
"after_sha256": "84ec4fdce99134c88c110104cac93bdea36cffb5ba34e046b9ad161fb860dce2",
"operation": "write"
},
{
"repo": "rapp-user-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc",
"operation": "write"
},
{
"repo": "reef-railiance",
"path": "registry/capabilities/capability.railiance.substrate-bindings.md",
"before_sha256": null,
"after_sha256": "4df6529b95c9aff89f67de20cf19b5ad20ffdb0af6eff57936c693e4c7897af0",
"operation": "write"
},
{
"repo": "reef-railiance",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "84a89c376021e3cb980c02c41d1a31396b874bebcc3801c2d1a9a33ae4195eb5",
"operation": "write"
},
{
"repo": "rein-aharness",
"path": "registry/capabilities/capability.execution.scheduled-agent-rein.md",
"before_sha256": null,
"after_sha256": "85231cd1f473ed28cf826fa561f098e8b829efb9177108e9678fcb4f3205d513",
"operation": "write"
},
{
"repo": "rein-aharness",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "20990ed0e016b3330a0d44e9b86bfff8966e82bc8800469ec0f320cfa8a63fbc",
"operation": "write"
},
{
"repo": "rein-openweights",
"path": "registry/capabilities/capability.execution.openweight-rein.md",
"before_sha256": null,
"after_sha256": "cfb35d7d7285e5e632e09869457ccd262aa0ceb3f8a6c3461f5a6d4f82002810",
"operation": "write"
},
{
"repo": "rein-openweights",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "2f4e59b2dbc7ea6078405f5c2f2be0aebd9434bee171a429b9ebe6baa83f3c2b",
"operation": "write"
},
{
"repo": "repo-manager",
"path": "registry/capabilities/capability.security.repository-secret-prevention.md",
"before_sha256": null,
"after_sha256": "67f2846ff664489c938edc6ba4f65369ea0d3d5fd24fb7dbd287b9ee903281be",
"operation": "write"
},
{
"repo": "repo-manager",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "ba068a8dd7a282664e94e2acdbbb170a2ba48e260e7ce0ec8eaaa8aee6f9e7c2",
"operation": "write"
},
{
"repo": "resource-control",
"path": "registry/capabilities/capability.resources.security-capacity.md",
"before_sha256": null,
"after_sha256": "013900e2dc836b3eb3bc4470f0f27308cb9a923575aea998eb4693302df7ebd8",
"operation": "write"
},
{
"repo": "resource-control",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "31b16f7d824e376f21de44aff46d5d532d3679d5e72035ce84813572b11bbd44",
"operation": "write"
},
{
"repo": "reuse-surface",
"path": "registry/capabilities/capability.registry.register.md",
"before_sha256": "7702e46c4115f9dffbce47c366891a311362e3d3eb3f1bcf45729d40635c536e",
"after_sha256": "f0a188e7ff8a2057b4eb9a0fb998e6b777d893cad5f024a507ca22639958fb2b",
"operation": "write"
},
{
"repo": "reuse-surface",
"path": "registry/capabilities/capability.registry.validate.md",
"before_sha256": "d5a7b7d9a339606bdbdc51c93ffdba358a4316b9f7508993d4a58b617b898a76",
"after_sha256": "dfbfeec7c795e9e666860913400b777718dd99d1eb1ed1146715edf51a3f846a",
"operation": "write"
},
{
"repo": "reuse-surface",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "200412c7a3f82b228912a8a36bf1ae69cb67c6f8a118fae619d0c8abaa6fd9f6",
"after_sha256": "a77c952e9e1a37a3504ccd7001a7a2493d60d46f147f277071829cd05646e31c",
"operation": "write"
},
{
"repo": "risk-nexus",
"path": "registry/capabilities/capability.security.risk-register.md",
"before_sha256": null,
"after_sha256": "f71a783e4bf946271b471c39921f88a21772cf5424017eea5b7660bb3614deb6",
"operation": "write"
},
{
"repo": "risk-nexus",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "53f0bf9e0aa06a6db0aa991f0ebdaa1d2bf74cfaf4e30eed8c003a4d2186a746",
"operation": "write"
},
{
"repo": "role-engine",
"path": "registry/capabilities/capability.organization.role-catalog.md",
"before_sha256": null,
"after_sha256": "e9b6bfdedafcaf2e61145d33bddcd24f85b281b42853d27c0e512f985726d5f1",
"operation": "write"
},
{
"repo": "role-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "1188e02e0333664b3554d11c59c12942fef9e29e6491b186dcec67e6ae3e8a5c",
"operation": "write"
},
{
"repo": "runbook-tutorials",
"path": "registry/capabilities/capability.infotech.runbook-tutorials.md",
"before_sha256": "9e22f7b357ce207fd77ad9cb170ba2ddeeed51e939d22f18dd76ff8b85fdeaea",
"after_sha256": "f25e5d9b0a061b65b0f6cc02f2f961cdcb71f7b09cfc76e42d36ae959033962f",
"operation": "write"
},
{
"repo": "runbook-tutorials",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "4ff0949db41cafa761d3aec672fc376c5a424f90d8c1084f27975091d4e40a3a",
"after_sha256": "a74fa708c4fea755f5c52504bd227393888cca78c043349cdc182c4d783390e5",
"operation": "write"
},
{
"repo": "sand-boxer",
"path": "registry/capabilities/execution.sandbox-provision.md",
"before_sha256": "34def3b3742df4af67e6f3e8e53d77288b1273869cc7b9583d2f388a998bc4ec",
"after_sha256": "64c68c78b383541c9e9fb832f215ca360733d692289331f012d7b8479ef81a6a",
"operation": "write"
},
{
"repo": "sand-boxer",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "2c51e1829bb318f366bc94a7cbd99613d7286a1812a9c3fa82892a9b9bbbf87d",
"after_sha256": "a182d5672d088e80b79eacff9cb37fc2f3518c3c100537e18d125abc7f169e96",
"operation": "write"
},
{
"repo": "sbom-nexus",
"path": "registry/capabilities/capability.infotech.sbom-management.md",
"before_sha256": "77dffddd091d5cab2d65b4edef82f4660cb194a30f519b6b78f348082bb39f1d",
"after_sha256": "f9dafe83c7d497a7c412106e2ce743bd34d75e419d075a5b19fd99ded87f2a72",
"operation": "write"
},
{
"repo": "sbom-nexus",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "fe489981819ca807058298915d80d35da7acf05f7d2c5c600742d2e342805ff4",
"after_sha256": "ed6efd581483d0058a3928b365b933cbbd98c035b0a75c866156a69961d74edc",
"operation": "write"
},
{
"repo": "secrets-engine",
"path": "registry/capabilities/capability.infotech.repo-template.md",
"before_sha256": "edfb14edaf244cd52c2bac0439383a40bc8bc8e94403dd2ae19e2ce202981217",
"after_sha256": null,
"operation": "delete"
},
{
"repo": "secrets-engine",
"path": "registry/capabilities/capability.security.credential-lifecycle.md",
"before_sha256": null,
"after_sha256": "84accd50647b46594ad1f456b157b71c9ad32fe202072773675923584408d4e0",
"operation": "write"
},
{
"repo": "secrets-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "8cb4e4baacd95a070a96db6d72f4fb3019cffda95606c65896f796ccac0c9c7c",
"after_sha256": "d5d903336d05ccd0b75a49f7be7e866ef89c6bdb6444e8c747a5ffa934a6bbe2",
"operation": "write"
},
{
"repo": "security-canon",
"path": "registry/capabilities/capability.security.practice-canon.md",
"before_sha256": null,
"after_sha256": "e189be678ef2510848caa5f5b3c190ecd9f7db9db8be762e9e215ae6827e62d5",
"operation": "write"
},
{
"repo": "security-canon",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "9b9f9348e560a72d8032f62b2ba4820d81fe182353ccc886e4f5c57cbdea563f",
"operation": "write"
},
{
"repo": "state-hub",
"path": "registry/capabilities/capability.statehub.workstream-coordinate.md",
"before_sha256": "e0638d981eec171f5602ecf3f7fdab538b4619721d39a7bd6da23ff5370092d4",
"after_sha256": "818428997975e8f2d64d85946937b4076806a9eedda1a31d1f701f80d1a6cf31",
"operation": "write"
},
{
"repo": "state-hub",
"path": "registry/capabilities/capability.statehub.progress-log.md",
"before_sha256": "b5603db4665ab9cfc83021675c2be1a8050e2ee01d55d932c9a3b7b8ee697a38",
"after_sha256": "71dacad9cca8df30d487720e3072a278c489e6c52d74b3fcb84f26d61c07c846",
"operation": "write"
},
{
"repo": "state-hub",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "670eb608e5dcfc10d49b15f28ff6b558ac6329f1142f893a7e8a14c9b297b257",
"after_sha256": "eab454bd985ab6ab83c38fd29e6e58ebdfe1e09bbc5388edddaa07a88133619a",
"operation": "write"
},
{
"repo": "tenant-engine",
"path": "registry/capabilities/capability.identity.tenant-facts.md",
"before_sha256": null,
"after_sha256": "504341300c2e0760af214ae33946fdd31ebef605855d1250b34503349ec38370",
"operation": "write"
},
{
"repo": "tenant-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "baab80c50d7f57ec13b795152cc128f92292e19465fe2cb48c44c4e779da54a1",
"after_sha256": "4131f1b63e52306f267204cdfb0faa90d6550f8bca51f97cf1062becea95d805",
"operation": "write"
},
{
"repo": "the-custodian",
"path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md",
"before_sha256": "f03fb35d7e24f9d7fd4505f43d550af54adb59c86a223602b702d3330e0e0921",
"after_sha256": "9e136682c02d963076c89eb1f4d4b956666ece2cf0747db27986a77d0c63d1b0",
"operation": "write"
},
{
"repo": "the-custodian",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "f18cbe0cedf4dea687efccd6fb14d102ac494d8c4ce621f619ade603fc6d2ce7",
"after_sha256": "cfe7f25e91fee824347aa22ccee2a70e7dd58ac06a7106f7e2ec9e54dc163020",
"operation": "write"
},
{
"repo": "user-engine",
"path": "registry/capabilities/capability.identity.user-engine.md",
"before_sha256": "c68b720a06c91acbf4da85d5fc0cc6898a785140857beb93b14f81e7a343ed07",
"after_sha256": "3c9c8f1bb00b66d5f556da9cd33f42470a2e6bcfa3b3f3e9b4e8d1881db5f010",
"operation": "write"
},
{
"repo": "user-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": "1334f4f654260ab4e7d8738776b587c3e190005d07688c9e7c8bfaab9f5d91cc",
"after_sha256": "7133c52c2013cea70d07d33960f145c370d33a8b4397c1dc927769fcaf200cbd",
"operation": "write"
},
{
"repo": "whitehat-security",
"path": "registry/capabilities/capability.security.adversarial-evidence.md",
"before_sha256": null,
"after_sha256": "0fecc5e5ede496b0f5c4a42e1b0166e5c3f156ede9c6f3813d59b6e8eb54c82d",
"operation": "write"
},
{
"repo": "whitehat-security",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "e4bf9bac7f62f60cf10a9fbd25aa8200c22f13d61861862ff5fa1cc90b55f37c",
"operation": "write"
},
{
"repo": "zone-engine",
"path": "registry/capabilities/capability.security.zone-reference.md",
"before_sha256": null,
"after_sha256": "d1b4c433ad91bf4a30b02c353f5cef387b6d63d8f58defabf6f16fed15816aae",
"operation": "write"
},
{
"repo": "zone-engine",
"path": "registry/indexes/capabilities.yaml",
"before_sha256": null,
"after_sha256": "b6b196089a3011f16e8a38f6914589efc72a29ee3aca4bc0c5e3cf30bee97ec4",
"operation": "write"
}
]

655
docs/assessments/netkingdom-2026-10-14/registry-publication.json Normal file
View file

@ -0,0 +1,655 @@
[
{
"repo": "access-engine",
"commit": "62ac2b4e99dec2005c7c407fe633612578a7907d",
"parent": "16ca97b2776789f730cc7049a2d6533612faaccd",
"paths": [
"registry/capabilities/capability.authorization.policy-evaluate.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "activity-core",
"commit": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0",
"parent": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df",
"paths": [
"registry/capabilities/capability.activity.event-coordinate.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "agentic-resources",
"commit": "c4cedab945e047de068428fb943f346f093b22dc",
"parent": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709",
"paths": [
"registry/NO_CAPABILITIES.md",
"registry/capabilities/capability.agents.performance-learning.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "approval-engine",
"commit": "db850aded5fc3b5d35938d26e8084e436a83943b",
"parent": "e1649617e8ad321f79632d5fd33e973ae5d5ae51",
"paths": [
"registry/capabilities/capability.security.approval-lifecycle.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "audit-core",
"commit": "8d4bde6ece39ce0df3a3cc49da38613123e8f215",
"parent": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9",
"paths": [
"registry/capabilities/capability.audit.event-retain.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "coordination-engine",
"commit": "16de8fc3f70020df646f1ebdca705a1bf88485a0",
"parent": "c401067842072b75717f76480dd6e7db1836059c",
"paths": [
"registry/NO_CAPABILITIES.md",
"registry/capabilities/capability.coordination.cross-owner-work.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "emergent-security",
"commit": "6eead2a922ae2eb81593213f54bf1f35e1c9970f",
"parent": "4c6fda38298fa50665ead41526b893adf069d335",
"paths": [
"registry/capabilities/capability.security.agent-knowledge.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "fin-hub",
"commit": "cace0fda7474304cc42028287f7ba1327ab07d00",
"parent": "8f527c6705bbf5d7ffed43559411ca748bec8fe4",
"paths": [
"registry/capabilities/capability.finance.security-budget-evidence.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "gate-house",
"commit": "ab1a299674679ccfefa8df84b877614ac44c9d38",
"parent": "bc890c4d050a2e726ce8988a8260ab9caea133e3",
"paths": [
"registry/capabilities/capability.security.doctrine-review.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "glas-harness",
"commit": "dc88f302044c7c2b41795958527e64be8a83e3ab",
"parent": "7b1557ba14f483569b90ebfdc2d0136fa69602fe",
"paths": [
"registry/capabilities/capability.execution.profile-harness.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "info-tech-canon",
"commit": "9b9be2ec8e846ceaa05fa644323b02d8603e39b6",
"parent": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e",
"paths": [
"registry/capabilities/capability.infotech.canon-service.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "informed-decision",
"commit": "faae9cb0dbaf4c8d23f838183f513c302ad3b9f0",
"parent": "ee6a65b80a0fea1a914dfa31434b903669656c09",
"paths": [
"registry/capabilities/capability.security.human-decision-workspace.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "issue-core",
"commit": "1427d268a09b9334a98a167230ec7dd1d4a82053",
"parent": "de368271f6ffc06353ec409998a0d6d0ec0bf25e",
"paths": [
"registry/capabilities/capability.infotech.issue-tracking.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "key-cape",
"commit": "61ee563b1ff7f027527ea0c6d5b0e305ed66e5f0",
"parent": "1344fc80e56315c5c99f58993f9ee02ce79e8a76",
"paths": [
"registry/capabilities/capability.iam.key-cape.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "kings-guard",
"commit": "6aea834dc556067672f31ed762f44a39bad988e3",
"parent": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7",
"paths": [
"registry/capabilities/capability.security.posture-assessment.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "maturity-engine",
"commit": "363e8160a4910766e9380fabee68a8642dd45ccf",
"parent": "2ef97c87a0f818a906aa42942c32d6c69f9ec899",
"paths": [
"registry/capabilities/capability.security.maturity-claims.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": true,
"local_unrelated_head_preserved": "2f1de542cc8f24a79452f906d99f95be39d8b6a9",
"publication_checkout": "/tmp/netkingdom-registry-maturity-engine-vwnfdte1"
},
{
"repo": "net-kingdom",
"commit": "e99c3e9791d1e53e8b0c8030d71b577f611fa901",
"parent": "1a36e857cc5aae6fe738f794417126c46dd94627",
"paths": [
"registry/capabilities/capability.security.iam-tooling-suite.md",
"registry/capabilities/capability.security.scenario-compose.md",
"registry/capabilities/capability.security.posture-feedback.md",
"registry/capabilities/capability.security.case-contracts.md",
"registry/capabilities/capability.security.bootstrap-recovery.md",
"registry/capabilities/capability.security.emission-profile.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "ops-bridge",
"commit": "2246656f43fa5eae3ae917f63ea1dfa3f53f4a00",
"parent": "190ef1e188e12c606f1359325fd9fdd1dbef29e2",
"paths": [
"registry/capabilities/capability.ops.tunnel-bridge.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "ops-mason",
"commit": "6434877a44e20396dc85652ad22a55f0a89d16d0",
"parent": "d86ad141befb6800468f5132d4c7c9ce2f852bb5",
"paths": [
"registry/capabilities/capability.security.structure-construction.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "ops-warden",
"commit": "11b2a9d7bc97f5fe8606927c17fe8acc59b79cd0",
"parent": "6d2f1be9691b19e826898a2166ae4451e4802ae2",
"paths": [
"registry/capabilities/capability.security.ssh-certificate-issuance.md",
"registry/capabilities/capability.security.access-routing.md",
"registry/capabilities/capability.security.case-follow-through.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "policy-nexus",
"commit": "c14561b2e5318e9637ba93e4c96c06a2db92d0c4",
"parent": "f784f017b0822f34c785f0b34c7c55fcf39c9d99",
"paths": [
"registry/capabilities/capability.security.policy-publication.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rail-kubernetes",
"commit": "5fad47fdfb7d4cabc21cf10f52ac733ef59803b0",
"parent": "35159e49c1340b7a0e30c49188975c8839d346f6",
"paths": [
"registry/capabilities/capability.railiance.kubernetes-rail.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-apps",
"commit": "72bcad86d7531bcc27f0e465a9385be559ba0c9f",
"parent": "706461b845086ee2df8ce9acae3dae7feebfffda",
"paths": [
"registry/capabilities/capability.railiance.workload-deployment-tooling.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-bootstrap",
"commit": "70bd14d3b941a49c78bbc51d8faab5ab1da1df76",
"parent": "ae00b2652737aaf18358431e66f59eeb7c01e16b",
"paths": [
"registry/capabilities/capability.railiance.bootstrap-sequencing.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-cluster",
"commit": "750c3e5b9b4623c52bce2b8fbd758f423f81f6c1",
"parent": "12d1e881ff2086566712fbc591db293b38ea2bcf",
"paths": [
"registry/capabilities/capability.railiance.cluster-bootstrap.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-enablement",
"commit": "ce9f6d1be8ff73afdedd6d666a8485e6c7348069",
"parent": "51a7c4cee68b48ed7a236e661b39c1d3cca92063",
"paths": [
"registry/capabilities/capability.railiance.ci-enablement.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-fabric",
"commit": "095342c72ab6f02c72dd5d40e869dcba536bc5c1",
"parent": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e",
"paths": [
"registry/capabilities/capability.railiance.fabric-graph.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-forge",
"commit": "6e8f657e55e96b4e9f3d9d74a27b420b68467e61",
"parent": "a15fac8e938c11b041eb39386f05b63d46ae566a",
"paths": [
"registry/capabilities/capability.railiance.forge-infrastructure.md",
"registry/capabilities/capability.security.forge-secret-prevention.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-infra",
"commit": "c42797a2ddd02270de5f6ad9fbf3270ad5fa171e",
"parent": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca",
"paths": [
"registry/capabilities/capability.railiance.infra-provisioning.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-master",
"commit": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4",
"parent": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7",
"paths": [
"registry/capabilities/capability.railiance.security-consumption-contracts.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-platform",
"commit": "a86dfe2220ed59061d8c1177ecff35d8317f08ee",
"parent": "d303c99e3be993ffa989bc9ba3d7b471903858ce",
"paths": [
"registry/capabilities/capability.railiance.platform-services.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "railiance-telemetry",
"commit": "8cdb2d11dda03bd6839750d059b37932f069e66a",
"parent": "81d905971c38de9aaf11088ba605e112152d8268",
"paths": [
"registry/capabilities/capability.observability.security-signals.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rapp-openbao",
"commit": "35672be138036c8433a5ac5de91e068c03c2b124",
"parent": "13ab9144bbb1d88fe760362df91a83c8b34e4e66",
"paths": [
"registry/capabilities/capability.railiance.openbao-package.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rapp-playwright",
"commit": "4f76a87f67fdd9dab19564bb84235397e2f2470a",
"parent": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb",
"paths": [
"registry/capabilities/capability.railiance.browser-verification.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rapp-policy-nexus",
"commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3",
"parent": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda",
"paths": [
"registry/capabilities/capability.railiance.policy-publication-package.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rapp-postgres",
"commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5",
"parent": "03744030c9258e920f6403a9ce184a26d7b75268",
"paths": [
"registry/capabilities/capability.railiance.postgres-isolation-recovery.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rapp-telemetry",
"commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5",
"parent": "17053dbc47f7c22efd67fd90d06d108d154835fa",
"paths": [
"registry/capabilities/capability.railiance.telemetry-package.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rapp-tenant-engine",
"commit": "9bdc86572728783a5ed94266f04f7b12d414c557",
"parent": "c160be23577ab4d99ee2cd008deb455b07f0597d",
"paths": [
"registry/capabilities/capability.railiance.tenant-engine-package.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rapp-user-engine",
"commit": "2bfcc5f7d43dc4bce88780133ce9ec93acd51f83",
"parent": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c",
"paths": [
"registry/capabilities/capability.railiance.user-engine-package.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "reef-railiance",
"commit": "33b840faac109f134bf1115d631d5b1242052d9a",
"parent": "ffb9e272ce1489cc37cc6388873558d8ba56c239",
"paths": [
"registry/capabilities/capability.railiance.substrate-bindings.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rein-aharness",
"commit": "a58d11ce8ae9ea07baf0682c4f860caa251692b3",
"parent": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42",
"paths": [
"registry/capabilities/capability.execution.scheduled-agent-rein.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "rein-openweights",
"commit": "a2e428a76592d79982ea3c4eba5f137a12fb44e4",
"parent": "e1fccb39b738a5381a9de6e1d799f124797798ce",
"paths": [
"registry/capabilities/capability.execution.openweight-rein.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "repo-manager",
"commit": "97ea2489257de08911cc5da1e1b84d8e15780dc3",
"parent": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa",
"paths": [
"registry/capabilities/capability.security.repository-secret-prevention.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "resource-control",
"commit": "ac4e1c43e6d82ecd81108f3b006454ac6aa76722",
"parent": "3604d468f86ede7d320f4d22dd4aea775306b53f",
"paths": [
"registry/capabilities/capability.resources.security-capacity.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "reuse-surface",
"commit": "bf199707ff7ee9870472622ea73cb180b72acfe3",
"parent": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1",
"paths": [
"registry/capabilities/capability.registry.register.md",
"registry/capabilities/capability.registry.validate.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "risk-nexus",
"commit": "c2b3a9e679acb61d76ef0f7c1a6ec8ae340e6e24",
"parent": "b877231d66e1289dc32fda07ed2c61dcb3e970dc",
"paths": [
"registry/capabilities/capability.security.risk-register.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "role-engine",
"commit": "c9d6d0763542f632f1d9b799d63b6b85cf8eaaab",
"parent": "d231241dbfeeb541b34243f4022883aa6417a1eb",
"paths": [
"registry/capabilities/capability.organization.role-catalog.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "runbook-tutorials",
"commit": "f0ea260895e8ad8e60f24bf64a89be063b7f8e13",
"parent": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e",
"paths": [
"registry/capabilities/capability.infotech.runbook-tutorials.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "sand-boxer",
"commit": "7ddf92070f2fa267d79f8cad0aa07d16f0cd6410",
"parent": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d",
"paths": [
"registry/capabilities/execution.sandbox-provision.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "sbom-nexus",
"commit": "db76194330b9502e9a1085ae25cdd27ce264ec7b",
"parent": "07e998d9abfd4e4fcc74db9e292ed22c6f407522",
"paths": [
"registry/capabilities/capability.infotech.sbom-management.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "secrets-engine",
"commit": "6bd7129eac94131b4cf689e47cbdc9899418beb3",
"parent": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d",
"paths": [
"registry/capabilities/capability.infotech.repo-template.md",
"registry/capabilities/capability.security.credential-lifecycle.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "security-canon",
"commit": "c31c3008a53bcff07be09d0507d4693d27b40a5a",
"parent": "1664a6def20be2759a1e575024563efd27c9f36f",
"paths": [
"registry/capabilities/capability.security.practice-canon.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "state-hub",
"commit": "2a2ac2eb195a073633f4db0f166b927ca1877d67",
"parent": "4ffc7236735afc6223aa613262483ea911307714",
"paths": [
"registry/capabilities/capability.statehub.workstream-coordinate.md",
"registry/capabilities/capability.statehub.progress-log.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "tenant-engine",
"commit": "79a61905957bd78d3f4c93da42d7034ad3e3c8de",
"parent": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c",
"paths": [
"registry/capabilities/capability.identity.tenant-facts.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "the-custodian",
"commit": "e8bd394c8b79741a4bb3b1d09c8b495ca41d7c0f",
"parent": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e",
"paths": [
"registry/capabilities/capability.agents.custodian-runtime-tooling.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "user-engine",
"commit": "2f20c02cad1fcdc6d9070a08ba4d5b688f79b80c",
"parent": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79",
"paths": [
"registry/capabilities/capability.identity.user-engine.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "whitehat-security",
"commit": "42fe7a12c7d9d64142ec0e820ba4e975ffeac593",
"parent": "5587a8f6ac4b129527db819bc72832051c7fcc3b",
"paths": [
"registry/capabilities/capability.security.adversarial-evidence.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
},
{
"repo": "zone-engine",
"commit": "7e7e3f307ca996c373e91009ed1b9b0cbc6fcb9e",
"parent": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0",
"paths": [
"registry/capabilities/capability.security.zone-reference.md",
"registry/indexes/capabilities.yaml"
],
"verified_remote": true,
"isolated_publication": false
}
]

350
docs/assessments/netkingdom-2026-10-14/registry-stage-validation.json Normal file
View file

@ -0,0 +1,350 @@
[
{
"repo": "access-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "activity-core",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "agentic-resources",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "approval-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "audit-core",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "coordination-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "emergent-security",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "fin-hub",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "gate-house",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "glas-harness",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "info-tech-canon",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "informed-decision",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "issue-core",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "key-cape",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "kings-guard",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "maturity-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "net-kingdom",
"entries": 6,
"errors": [],
"warnings": []
},
{
"repo": "ops-bridge",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "ops-mason",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "ops-warden",
"entries": 3,
"errors": [],
"warnings": []
},
{
"repo": "policy-nexus",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rail-kubernetes",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-apps",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-bootstrap",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-cluster",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-enablement",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-fabric",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-forge",
"entries": 2,
"errors": [],
"warnings": []
},
{
"repo": "railiance-infra",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-master",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-platform",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "railiance-telemetry",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rapp-openbao",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rapp-playwright",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rapp-policy-nexus",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rapp-postgres",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rapp-telemetry",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rapp-tenant-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rapp-user-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "reef-railiance",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rein-aharness",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "rein-openweights",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "repo-manager",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "resource-control",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "reuse-surface",
"entries": 3,
"errors": [],
"warnings": []
},
{
"repo": "risk-nexus",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "role-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "runbook-tutorials",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "sand-boxer",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "sbom-nexus",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "secrets-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "security-canon",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "state-hub",
"entries": 2,
"errors": [],
"warnings": []
},
{
"repo": "tenant-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "the-custodian",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "user-engine",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "whitehat-security",
"entries": 1,
"errors": [],
"warnings": []
},
{
"repo": "zone-engine",
"entries": 1,
"errors": [],
"warnings": []
}
]

135
docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md Normal file
View file

@ -0,0 +1,135 @@
---
id: capability.authorization.policy-evaluate
name: Policy evaluation and decision evidence
summary: Check, batch, list-allowed, explain, binding, lifetime and decision records.
owner: access-engine
status: draft
domain: helix_forge
tags:
- authorization
- policy
- flex-auth
- security
- netkingdom
- framework-reuse
maturity:
discovery:
current: D4
target: D6
confidence: medium
rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth
path.
availability:
current: A4
target: A5
confidence: low
rationale: 'Source interface assessed 2026-10-14: Check, batch, list-allowed,
explain, binding, lifetime and decision records. Availability describes the
delivery form, not production acceptance. One PDP owner with per-consumer deployments;
signed envelope production and consumer adoption are distinct.'
external_evidence:
completeness:
level: C2
name: Partial
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- policy-as-code intent documented
broken_expectations:
- not yet indexed from flex-auth native registry
out_of_scope_expectations:
- identity proofing
reliability:
level: R1
confidence: low
basis: consumer_quality_signals
known_reliability_risks:
- early implementation phase
discovery:
intent: Check, batch, list-allowed, explain, binding, lifetime and decision records
includes:
- Check, batch, list-allowed, explain, binding, lifetime and decision records
excludes:
- One PDP owner with per-consumer deployments; signed envelope production and consumer
adoption are distinct
use_cases:
- 'U03: Application combines identity, tenant and resource facts and enforces a
bound decision'
- 'U04: Protected operation obtains and consumes exact human approval before its
side effect'
- 'U05: Operator provisions and delivers a scoped workload credential through the
approved owner lane'
- 'U06: Operator or automation obtains a bounded SSH certificate and maintains private
connectivity'
availability:
current_level: A4
target_level: A5
current_artifacts:
- SCOPE.md
- README.md
consumption_modes:
- HTTP API
- source
relations:
depends_on:
- capability.identity.subject-resolution
related_to:
- capability.feature-control.evaluate
- capability.security.approval-lifecycle
- capability.iam.key-cape
- capability.identity.tenant-facts
- capability.security.zone-reference
- capability.security.maturity-claims
consumer_guidance:
recommended_for:
- Application combines identity, tenant and resource facts and enforces a bound
decision
- Protected operation obtains and consumes exact human approval before its side
effect
- Operator provisions and delivers a scoped workload credential through the approved
owner lane
- Operator or automation obtains a bounded SSH certificate and maintains private
connectivity
not_recommended_for:
- One PDP owner with per-consumer deployments; signed envelope production and consumer
adoption are distinct
known_limitations:
- One PDP owner with per-consumer deployments; signed envelope production and consumer
adoption are distinct
- 2026-10-14 architecture review estimates operational maturity separately; a registry
entry does not authorize execution or establish deployment.
promotion_history:
- date: '2026-10-14'
dimension: availability
from: A2
to: A4
rationale: Interface-form reassessment from current owner sources; no completeness/reliability
promotion.
author: codex
evidence:
documentation:
- SCOPE.md
- README.md
---
# Policy evaluation and decision evidence
Check, batch, list-allowed, explain, binding, lifetime and decision records.
## Reuse boundary
One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct.
## Supported use cases
- U03: Application combines identity, tenant and resource facts and enforces a bound decision
- U04: Protected operation obtains and consumes exact human approval before its side effect
- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane
- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity
## Evidence and integration
- [SCOPE.md](../../SCOPE.md)
- [README.md](../../README.md)
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

22
docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,22 @@
version: 1
updated: '2026-10-14'
domain: helix_forge
capabilities:
- id: capability.authorization.policy-evaluate
name: Policy evaluation and decision evidence
summary: Check, batch, list-allowed, explain, binding, lifetime and decision records.
domain: helix_forge
status: draft
owner: access-engine
tags:
- authorization
- policy
- flex-auth
- security
- netkingdom
- framework-reuse
vector: D4 / A4 / C2 / R1
path: registry/capabilities/capability.authorization.policy-evaluate.md
consumption_modes:
- HTTP API
- source

122
docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/capabilities/capability.activity.event-coordinate.md Normal file
View file

@ -0,0 +1,122 @@
---
id: capability.activity.event-coordinate
name: Durable automation and bounded operations
summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime
sinks.
owner: activity-core
status: draft
domain: helix_forge
tags:
- activity
- coordination
- automation
- security
- netkingdom
- framework-reuse
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: activity-core INTENT defines org-wide event response boundary.
availability:
current: A4
target: A4
confidence: low
rationale: 'Source interface assessed 2026-10-14: Temporal/NATS/webhook/manual
trigger, validated definitions and evidence/runtime sinks. Availability describes
the delivery form, not production acceptance. Not a general shell executor;
first unassisted security-flow cadence acceptance remains open.'
external_evidence:
completeness:
level: C1
name: Fragmentary
confidence: low
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- problem and boundary documented in INTENT
broken_expectations:
- no registry-native automation artifacts indexed yet
out_of_scope_expectations:
- owning domain-specific business logic
reliability:
level: R0
confidence: low
basis: consumer_quality_signals
known_reliability_risks: []
discovery:
intent: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime
sinks
includes:
- Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime
sinks
excludes:
- Not a general shell executor; first unassisted security-flow cadence acceptance
remains open
use_cases:
- 'U09: Maintainer observes posture, prioritizes findings, coordinates work and
verifies outcomes'
- 'U12: Developer builds and publishes through controlled source, dependency and
runner paths'
availability:
current_level: A4
target_level: A4
current_artifacts:
- SCOPE.md
- README.md
consumption_modes:
- HTTP API
- source
relations:
depends_on: []
related_to:
- capability.statehub.workstream-coordinate
- capability.audit.event-retain
- capability.security.iam-tooling-suite
consumer_guidance:
recommended_for:
- Maintainer observes posture, prioritizes findings, coordinates work and verifies
outcomes
- Developer builds and publishes through controlled source, dependency and runner
paths
not_recommended_for:
- Not a general shell executor; first unassisted security-flow cadence acceptance
remains open
known_limitations:
- Not a general shell executor; first unassisted security-flow cadence acceptance
remains open
- 2026-10-14 architecture review estimates operational maturity separately; a registry
entry does not authorize execution or establish deployment.
promotion_history:
- date: '2026-10-14'
dimension: availability
from: A1
to: A4
rationale: Interface-form reassessment from current owner sources; no completeness/reliability
promotion.
author: codex
evidence:
documentation:
- SCOPE.md
- README.md
---
# Durable automation and bounded operations
Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.
## Reuse boundary
Not a general shell executor; first unassisted security-flow cadence acceptance remains open.
## Supported use cases
- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes
- U12: Developer builds and publishes through controlled source, dependency and runner paths
## Evidence and integration
- [SCOPE.md](../../SCOPE.md)
- [README.md](../../README.md)
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

23
docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,23 @@
version: 1
updated: '2026-10-14'
domain: helix_forge
capabilities:
- id: capability.activity.event-coordinate
name: Durable automation and bounded operations
summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime
sinks.
domain: helix_forge
status: draft
owner: activity-core
tags:
- activity
- coordination
- automation
- security
- netkingdom
- framework-reuse
vector: D3 / A4 / C1 / R0
path: registry/capabilities/capability.activity.event-coordinate.md
consumption_modes:
- HTTP API
- source

93
docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/capabilities/capability.agents.performance-learning.md Normal file
View file

@ -0,0 +1,93 @@
---
id: capability.agents.performance-learning
owner: agentic-resources
status: draft
domain: infotech
maturity:
discovery:
current: D3
target: D5
confidence: medium
rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
are documented; no exhaustive or generalized maturity claim.
availability:
current: A2
target: A2
confidence: medium
rationale: 'Source interface assessed 2026-10-14: Capture sessions, curate patterns,
distribute lessons and measure outcomes. Availability describes the delivery
form, not production acceptance. Workforce assignments and broader authority
contracts remain proposed.'
external_evidence:
completeness:
level: C1
confidence: low
basis: Source artifacts establish a bounded capability; no independent consumer-completeness
assessment in this review.
reliability:
level: R0
confidence: low
basis: No longitudinal consumer reliability measurement established by this review.
name: Agent performance learning
summary: Capture sessions, curate patterns, distribute lessons and measure outcomes.
tags:
- security
- netkingdom
- framework-reuse
discovery:
intent: Capture sessions, curate patterns, distribute lessons and measure outcomes
includes:
- Capture sessions, curate patterns, distribute lessons and measure outcomes
excludes:
- Workforce assignments and broader authority contracts remain proposed
use_cases:
- 'U09: Maintainer observes posture, prioritizes findings, coordinates work and
verifies outcomes'
- 'U11: Agent executes an attributable bounded task and supplies supervision evidence'
availability:
current_level: A2
target_level: A2
current_artifacts:
- SCOPE.md
consumption_modes:
- CLI
- source
relations:
related_to:
- capability.execution.profile-harness
- capability.activity.event-coordinate
- capability.finance.security-budget-evidence
evidence:
documentation:
- SCOPE.md
consumer_guidance:
recommended_for:
- Maintainer observes posture, prioritizes findings, coordinates work and verifies
outcomes
- Agent executes an attributable bounded task and supplies supervision evidence
not_recommended_for:
- Workforce assignments and broader authority contracts remain proposed
known_limitations:
- Workforce assignments and broader authority contracts remain proposed
- 2026-10-14 architecture review estimates operational maturity separately; a registry
entry does not authorize execution or establish deployment.
---
# Agent performance learning
Capture sessions, curate patterns, distribute lessons and measure outcomes.
## Reuse boundary
Workforce assignments and broader authority contracts remain proposed.
## Supported use cases
- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes
- U11: Agent executes an attributable bounded task and supplies supervision evidence
## Evidence and integration
- [SCOPE.md](../../SCOPE.md)
Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.

19
docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml Normal file
View file

@ -0,0 +1,19 @@
version: 1
updated: '2026-10-14'
domain: helix_forge
capabilities:
- id: capability.agents.performance-learning
name: Agent performance learning
summary: Capture sessions, curate patterns, distribute lessons and measure outcomes.
domain: infotech
status: draft
owner: agentic-resources
tags:
- security
- netkingdom
- framework-reuse
vector: D3 / A2 / C1 / R0
path: registry/capabilities/capability.agents.performance-learning.md
consumption_modes:
- CLI
- source

Some files were not shown because too many files have changed in this diff Show more