From 44483896fb24679734a0358ae47dffad5871ebbc Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 14 Oct 2026 09:13:18 +0200 Subject: [PATCH] docs: review NetKingdom architecture and establish capability inventory --- .../netkingdom-2026-10-14/apply_registry.py | 20 + .../netkingdom-2026-10-14/build_inventory.py | 98 + .../capability-inventory.md | 504 +++ .../commit-scan-diagnosis.json | 10 + .../completion-audit.json | 42 + .../federated-local.yaml | 1502 +++++++++ .../federated-staged.yaml | 1461 ++++++++ .../federation-local.yaml | 244 ++ .../federation-staged.yaml | 236 ++ .../netkingdom-2026-10-14/full-inventory.json | 2987 +++++++++++++++++ .../hosted-after-publication.json | 2154 ++++++++++++ .../hosted-before-federated.json | 1872 +++++++++++ .../hosted-before-repos.json | 714 ++++ .../hosted-verification.json | 61 + .../hub-private-source-pending.json | 104 + .../hub-public-registration-plan.json | 374 +++ .../hub-registration-plan.json | 458 +++ .../hub-registration-proposal.json | 14 + .../hub-registration-receipt.json | 9 + .../netkingdom-2026-10-14/inventory.json | 2905 ++++++++++++++++ .../local-default-federated.yaml | 2516 ++++++++++++++ .../local-default-federation-receipt.json | 8 + .../local-discovery-receipt.json | 21 + .../local-federation-guide.md | 27 + .../local-sources-before.yaml | 431 +++ .../netkingdom-2026-10-14/local-sources.yaml | 577 ++++ .../prepare_local_federation.py | 17 + .../netkingdom-2026-10-14/prepare_registry.py | 122 + .../publication-preflight.json | 542 +++ .../publication_preflight.py | 18 + .../netkingdom-2026-10-14/publish_registry.py | 44 + .../published-source-verification.json | 1194 +++++++ .../netkingdom-2026-10-14/register_hub.py | 43 + .../registry-application.json | 6 + ...apability.authorization.policy-evaluate.md | 80 + .../registry/indexes/capabilities.yaml | 19 + .../capability.activity.event-coordinate.md | 77 + .../registry/indexes/capabilities.yaml | 19 + .../registry/NO_CAPABILITIES.md | 15 + .../registry/indexes/capabilities.yaml | 4 + .../capability.audit.event-retain.md | 88 + .../registry/indexes/capabilities.yaml | 22 + .../registry/NO_CAPABILITIES.md | 15 + .../registry/indexes/capabilities.yaml | 4 + .../registry/indexes/capabilities.yaml | 4 + .../capability.infotech.canon-service.md | 120 + .../registry/indexes/capabilities.yaml | 21 + .../capability.infotech.issue-tracking.md | 85 + .../registry/indexes/capabilities.yaml | 20 + .../capabilities/capability.iam.key-cape.md | 125 + .../registry/indexes/capabilities.yaml | 21 + .../capability.security.iam-tooling-suite.md | 148 + .../registry/indexes/capabilities.yaml | 21 + .../capability.ops.tunnel-bridge.md | 122 + .../registry/indexes/capabilities.yaml | 20 + ...ility.security.ssh-certificate-issuance.md | 137 + .../registry/indexes/capabilities.yaml | 23 + ...y.railiance.workload-deployment-tooling.md | 127 + .../registry/indexes/capabilities.yaml | 22 + .../registry/indexes/capabilities.yaml | 4 + .../capability.railiance.cluster-bootstrap.md | 122 + .../registry/indexes/capabilities.yaml | 21 + .../capability.railiance.ci-enablement.md | 125 + .../registry/indexes/capabilities.yaml | 22 + .../capability.railiance.fabric-graph.md | 122 + .../registry/indexes/capabilities.yaml | 22 + ...pability.railiance.forge-infrastructure.md | 129 + .../registry/indexes/capabilities.yaml | 22 + ...capability.railiance.infra-provisioning.md | 131 + .../registry/indexes/capabilities.yaml | 22 + .../capability.railiance.platform-services.md | 122 + .../registry/indexes/capabilities.yaml | 20 + .../capability.registry.register.md | 199 ++ .../capability.registry.validate.md | 107 + .../registry/indexes/capabilities.yaml | 49 + .../capability.infotech.runbook-tutorials.md | 18 + .../registry/indexes/capabilities.yaml | 13 + .../execution.sandbox-provision.md | 48 + .../registry/indexes/capabilities.yaml | 23 + .../capability.infotech.sbom-management.md | 19 + .../registry/indexes/capabilities.yaml | 6 + .../capability.infotech.repo-template.md | 121 + .../registry/indexes/capabilities.yaml | 14 + .../capability.statehub.progress-log.md | 91 + ...pability.statehub.workstream-coordinate.md | 121 + .../registry/indexes/capabilities.yaml | 35 + .../registry/indexes/capabilities.yaml | 4 + ...bility.agents.custodian-runtime-tooling.md | 131 + .../registry/indexes/capabilities.yaml | 21 + .../capability.identity.user-engine.md | 123 + .../registry/indexes/capabilities.yaml | 19 + .../registry-changes.json | 905 +++++ .../registry-publication.json | 655 ++++ .../registry-stage-validation.json | 350 ++ ...apability.authorization.policy-evaluate.md | 135 + .../registry/indexes/capabilities.yaml | 22 + .../capability.activity.event-coordinate.md | 122 + .../registry/indexes/capabilities.yaml | 23 + .../capability.agents.performance-learning.md | 93 + .../registry/indexes/capabilities.yaml | 19 + .../capability.security.approval-lifecycle.md | 112 + .../registry/indexes/capabilities.yaml | 20 + .../capability.audit.event-retain.md | 115 + .../registry/indexes/capabilities.yaml | 19 + ...apability.coordination.cross-owner-work.md | 91 + .../registry/indexes/capabilities.yaml | 19 + .../capability.security.agent-knowledge.md | 103 + .../registry/indexes/capabilities.yaml | 20 + ...bility.finance.security-budget-evidence.md | 92 + .../registry/indexes/capabilities.yaml | 19 + .../capability.security.doctrine-review.md | 100 + .../registry/indexes/capabilities.yaml | 18 + .../capability.execution.profile-harness.md | 91 + .../registry/indexes/capabilities.yaml | 20 + .../capability.infotech.canon-service.md | 124 + .../registry/indexes/capabilities.yaml | 22 + ...ility.security.human-decision-workspace.md | 106 + .../registry/indexes/capabilities.yaml | 19 + .../capability.infotech.issue-tracking.md | 110 + .../registry/indexes/capabilities.yaml | 22 + .../capabilities/capability.iam.key-cape.md | 138 + .../registry/indexes/capabilities.yaml | 21 + .../capability.security.posture-assessment.md | 102 + .../registry/indexes/capabilities.yaml | 20 + .../capability.security.maturity-claims.md | 101 + .../registry/indexes/capabilities.yaml | 20 + .../capability.security.bootstrap-recovery.md | 100 + .../capability.security.case-contracts.md | 110 + .../capability.security.emission-profile.md | 97 + .../capability.security.iam-tooling-suite.md | 133 + .../capability.security.posture-feedback.md | 101 + .../capability.security.scenario-compose.md | 101 + .../registry/indexes/capabilities.yaml | 98 + .../capability.ops.tunnel-bridge.md | 111 + .../registry/indexes/capabilities.yaml | 23 + ...ability.security.structure-construction.md | 103 + .../registry/indexes/capabilities.yaml | 19 + .../capability.security.access-routing.md | 104 + ...capability.security.case-follow-through.md | 104 + ...ility.security.ssh-certificate-issuance.md | 138 + .../registry/indexes/capabilities.yaml | 54 + .../capability.security.policy-publication.md | 103 + .../registry/indexes/capabilities.yaml | 19 + .../capability.railiance.kubernetes-rail.md | 93 + .../registry/indexes/capabilities.yaml | 19 + ...y.railiance.workload-deployment-tooling.md | 118 + .../registry/indexes/capabilities.yaml | 23 + ...pability.railiance.bootstrap-sequencing.md | 90 + .../registry/indexes/capabilities.yaml | 18 + .../capability.railiance.cluster-bootstrap.md | 116 + .../registry/indexes/capabilities.yaml | 23 + .../capability.railiance.ci-enablement.md | 116 + .../registry/indexes/capabilities.yaml | 23 + .../capability.railiance.fabric-graph.md | 128 + .../registry/indexes/capabilities.yaml | 23 + ...pability.railiance.forge-infrastructure.md | 124 + ...bility.security.forge-secret-prevention.md | 96 + .../registry/indexes/capabilities.yaml | 38 + ...capability.railiance.infra-provisioning.md | 123 + .../registry/indexes/capabilities.yaml | 23 + ...ailiance.security-consumption-contracts.md | 100 + .../registry/indexes/capabilities.yaml | 18 + .../capability.railiance.platform-services.md | 135 + .../registry/indexes/capabilities.yaml | 24 + ...pability.observability.security-signals.md | 99 + .../registry/indexes/capabilities.yaml | 19 + .../capability.railiance.openbao-package.md | 103 + .../registry/indexes/capabilities.yaml | 19 + ...pability.railiance.browser-verification.md | 94 + .../registry/indexes/capabilities.yaml | 19 + ...ty.railiance.policy-publication-package.md | 94 + .../registry/indexes/capabilities.yaml | 19 + ...y.railiance.postgres-isolation-recovery.md | 99 + .../registry/indexes/capabilities.yaml | 20 + .../capability.railiance.telemetry-package.md | 100 + .../registry/indexes/capabilities.yaml | 19 + ...ability.railiance.tenant-engine-package.md | 94 + .../registry/indexes/capabilities.yaml | 19 + ...apability.railiance.user-engine-package.md | 97 + .../registry/indexes/capabilities.yaml | 19 + ...capability.railiance.substrate-bindings.md | 91 + .../registry/indexes/capabilities.yaml | 18 + ...pability.execution.scheduled-agent-rein.md | 93 + .../registry/indexes/capabilities.yaml | 19 + .../capability.execution.openweight-rein.md | 89 + .../registry/indexes/capabilities.yaml | 19 + ...y.security.repository-secret-prevention.md | 96 + .../registry/indexes/capabilities.yaml | 19 + .../capability.resources.security-capacity.md | 100 + .../registry/indexes/capabilities.yaml | 19 + .../capability.infotech.headless-browser.md | 334 ++ .../capability.registry.register.md | 198 ++ .../capability.registry.validate.md | 134 + .../registry/indexes/capabilities.yaml | 78 + .../capability.security.risk-register.md | 93 + .../registry/indexes/capabilities.yaml | 19 + .../capability.organization.role-catalog.md | 92 + .../registry/indexes/capabilities.yaml | 18 + .../capability.infotech.runbook-tutorials.md | 100 + .../registry/indexes/capabilities.yaml | 19 + .../execution.sandbox-provision.md | 115 + .../registry/indexes/capabilities.yaml | 26 + .../capability.infotech.sbom-management.md | 96 + .../registry/indexes/capabilities.yaml | 21 + ...apability.security.credential-lifecycle.md | 108 + .../registry/indexes/capabilities.yaml | 20 + .../capability.security.practice-canon.md | 101 + .../registry/indexes/capabilities.yaml | 18 + .../capability.statehub.progress-log.md | 118 + ...pability.statehub.workstream-coordinate.md | 128 + .../registry/indexes/capabilities.yaml | 41 + .../capability.identity.tenant-facts.md | 99 + .../registry/indexes/capabilities.yaml | 19 + ...bility.agents.custodian-runtime-tooling.md | 128 + .../registry/indexes/capabilities.yaml | 22 + .../capability.identity.user-engine.md | 134 + .../registry/indexes/capabilities.yaml | 23 + ...apability.security.adversarial-evidence.md | 104 + .../registry/indexes/capabilities.yaml | 19 + .../capability.security.zone-reference.md | 100 + .../registry/indexes/capabilities.yaml | 19 + .../review-integrity.json | 10 + .../source-test-receipt.json | 30 + .../supplement/apply_registry.py | 20 + .../supplement/build_inventory.py | 32 + .../supplement/federated-staged.yaml | 47 + .../supplement/federation-staged.yaml | 12 + .../supplement/hosted-before-federated.json | 1929 +++++++++++ .../supplement/hosted-before-repos.json | 714 ++++ .../supplement/inventory.json | 77 + .../supplement/prepare_registry.py | 124 + .../supplement/publication-preflight.json | 20 + .../supplement/publication_preflight.py | 18 + .../supplement/publish_registry.py | 44 + .../supplement/registry-application.json | 6 + .../supplement/registry-changes.json | 30 + .../supplement/registry-publication.json | 24 + .../supplement/registry-stage-validation.json | 14 + .../capability.railiance.knative-rail.md | 105 + .../registry/indexes/capabilities.yaml | 19 + ...pability.railiance.sbom-runtime-package.md | 108 + .../registry/indexes/capabilities.yaml | 20 + .../supplement/use-cases.json | 16 + .../supplement/verification-staged.json | 23 + .../supplement/verify_registry.py | 62 + .../netkingdom-2026-10-14/use-cases.json | 16 + .../verification-local.json | 371 ++ .../verification-staged.json | 359 ++ .../verify_publication.py | 33 + .../netkingdom-2026-10-14/verify_registry.py | 62 + ...netkingdom-security-architecture-review.md | 161 + ...etkingdom-architecture-review-and-reuse.md | 68 + 252 files changed, 40311 insertions(+) create mode 100644 docs/assessments/netkingdom-2026-10-14/apply_registry.py create mode 100644 docs/assessments/netkingdom-2026-10-14/build_inventory.py create mode 100644 docs/assessments/netkingdom-2026-10-14/capability-inventory.md create mode 100644 docs/assessments/netkingdom-2026-10-14/commit-scan-diagnosis.json create mode 100644 docs/assessments/netkingdom-2026-10-14/completion-audit.json create mode 100644 docs/assessments/netkingdom-2026-10-14/federated-local.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/federated-staged.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/federation-local.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/federation-staged.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/full-inventory.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-after-publication.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-before-repos.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-verification.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-public-registration-plan.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-registration-plan.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-registration-proposal.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-registration-receipt.json create mode 100644 docs/assessments/netkingdom-2026-10-14/inventory.json create mode 100644 docs/assessments/netkingdom-2026-10-14/local-default-federated.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/local-default-federation-receipt.json create mode 100644 docs/assessments/netkingdom-2026-10-14/local-discovery-receipt.json create mode 100644 docs/assessments/netkingdom-2026-10-14/local-federation-guide.md create mode 100644 docs/assessments/netkingdom-2026-10-14/local-sources-before.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/local-sources.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/prepare_local_federation.py create mode 100644 docs/assessments/netkingdom-2026-10-14/prepare_registry.py create mode 100644 docs/assessments/netkingdom-2026-10-14/publication-preflight.json create mode 100644 docs/assessments/netkingdom-2026-10-14/publication_preflight.py create mode 100644 docs/assessments/netkingdom-2026-10-14/publish_registry.py create mode 100644 docs/assessments/netkingdom-2026-10-14/published-source-verification.json create mode 100644 docs/assessments/netkingdom-2026-10-14/register_hub.py create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-application.json create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/capabilities/capability.activity.event-coordinate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/NO_CAPABILITIES.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/capabilities/capability.audit.event-retain.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/NO_CAPABILITIES.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/glas-harness/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/capabilities/capability.infotech.issue-tracking.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/capabilities/capability.iam.key-cape.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-bootstrap/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/capabilities/capability.railiance.platform-services.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.register.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.validate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/capabilities/execution.sandbox-provision.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/capabilities/capability.infotech.repo-template.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.progress-log.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/tenant-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/capabilities/capability.identity.user-engine.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-changes.json create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-publication.json create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage-validation.json create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/capabilities/capability.activity.event-coordinate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/capabilities/capability.agents.performance-learning.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/capabilities/capability.security.approval-lifecycle.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/capabilities/capability.audit.event-retain.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/capabilities/capability.coordination.cross-owner-work.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/capabilities/capability.security.agent-knowledge.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/capabilities/capability.finance.security-budget-evidence.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/capabilities/capability.security.doctrine-review.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/capabilities/capability.execution.profile-harness.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/capabilities/capability.security.human-decision-workspace.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/capabilities/capability.infotech.issue-tracking.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/capabilities/capability.iam.key-cape.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/capabilities/capability.security.posture-assessment.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/capabilities/capability.security.maturity-claims.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.bootstrap-recovery.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.case-contracts.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.emission-profile.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.posture-feedback.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.scenario-compose.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/capabilities/capability.security.structure-construction.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.access-routing.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.case-follow-through.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/capabilities/capability.security.policy-publication.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/capabilities/capability.railiance.kubernetes-rail.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/capabilities/capability.railiance.bootstrap-sequencing.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.security.forge-secret-prevention.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/capabilities/capability.railiance.security-consumption-contracts.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/capabilities/capability.railiance.platform-services.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/capabilities/capability.observability.security-signals.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/capabilities/capability.railiance.openbao-package.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/capabilities/capability.railiance.browser-verification.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/capabilities/capability.railiance.policy-publication-package.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/capabilities/capability.railiance.postgres-isolation-recovery.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/capabilities/capability.railiance.telemetry-package.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/capabilities/capability.railiance.tenant-engine-package.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/capabilities/capability.railiance.user-engine-package.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/capabilities/capability.railiance.substrate-bindings.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/capabilities/capability.execution.scheduled-agent-rein.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/capabilities/capability.execution.openweight-rein.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/capabilities/capability.security.repository-secret-prevention.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/capabilities/capability.resources.security-capacity.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.infotech.headless-browser.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.register.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.validate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/capabilities/capability.security.risk-register.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/capabilities/capability.organization.role-catalog.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/capabilities/execution.sandbox-provision.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/capabilities/capability.security.credential-lifecycle.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/capabilities/capability.security.practice-canon.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.progress-log.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/capabilities/capability.identity.tenant-facts.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/capabilities/capability.identity.user-engine.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/capabilities/capability.security.adversarial-evidence.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/capabilities/capability.security.zone-reference.md create mode 100644 docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/review-integrity.json create mode 100644 docs/assessments/netkingdom-2026-10-14/source-test-receipt.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/apply_registry.py create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/build_inventory.py create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/federated-staged.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/federation-staged.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-federated.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-repos.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/inventory.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/prepare_registry.py create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/publication-preflight.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/publication_preflight.py create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/publish_registry.py create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-application.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-changes.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-publication.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage-validation.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/capabilities/capability.railiance.knative-rail.md create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/capabilities/capability.railiance.sbom-runtime-package.md create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/use-cases.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/verification-staged.json create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/verify_registry.py create mode 100644 docs/assessments/netkingdom-2026-10-14/use-cases.json create mode 100644 docs/assessments/netkingdom-2026-10-14/verification-local.json create mode 100644 docs/assessments/netkingdom-2026-10-14/verification-staged.json create mode 100644 docs/assessments/netkingdom-2026-10-14/verify_publication.py create mode 100644 docs/assessments/netkingdom-2026-10-14/verify_registry.py create mode 100644 docs/netkingdom-security-architecture-review.md create mode 100644 workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md diff --git a/docs/assessments/netkingdom-2026-10-14/apply_registry.py b/docs/assessments/netkingdom-2026-10-14/apply_registry.py new file mode 100644 index 00000000..d8ad3e01 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/apply_registry.py @@ -0,0 +1,20 @@ +"""Apply only the hash-pinned, reviewed metadata patch; never stage or commit.""" +from pathlib import Path +import hashlib,json +OUT=Path(__file__).resolve().parent;BASE=Path('/home/worsch') +changes=json.loads((OUT/'registry-changes.json').read_text()) +# Check the entire patch before the first write. Do not overwrite concurrent edits. +for c in changes: + p=BASE/c['repo']/c['path'];actual=hashlib.sha256(p.read_bytes()).hexdigest() if p.exists() else None + if actual!=c['before_sha256']:raise SystemExit('Concurrent change: '+str(p)) + if c['operation']=='write': + stage=OUT/'registry-stage'/c['repo']/c['path'] + if hashlib.sha256(stage.read_bytes()).hexdigest()!=c['after_sha256']:raise SystemExit('Staged digest differs: '+str(stage)) +for c in changes: + p=BASE/c['repo']/c['path'] + if p.exists(): + backup=OUT/'registry-before'/c['repo']/c['path'];backup.parent.mkdir(parents=True,exist_ok=True);backup.write_bytes(p.read_bytes()) + if c['operation']=='delete':p.unlink() + else:p.parent.mkdir(parents=True,exist_ok=True);p.write_bytes((OUT/'registry-stage'/c['repo']/c['path']).read_bytes()) +(OUT/'registry-application.json').write_text(json.dumps({'applied':len(changes),'repositories':len({c['repo'] for c in changes}),'verified_sha256':True,'git_staging_or_commits':False},indent=2)+'\n') +print('Applied',len(changes),'reviewed metadata edits') diff --git a/docs/assessments/netkingdom-2026-10-14/build_inventory.py b/docs/assessments/netkingdom-2026-10-14/build_inventory.py new file mode 100644 index 00000000..1e244120 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/build_inventory.py @@ -0,0 +1,98 @@ +"""Build the review's explicit capability denominator and staged registry patch.""" +from pathlib import Path +import hashlib, json, subprocess, yaml +BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent +# repo | id suffix | capability | availability | operational estimate (1..5) | surface | limitation | use cases | artifacts +DATA=''' +security-canon|security.practice-canon|Security practice and authority vocabulary|A0|2|Versioned SEC-DSM and Mode of Authority documents|Normative practice; no runtime control or certification|U01 U07 U10 U14|SCOPE.md;infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md +net-kingdom|security.iam-tooling-suite|NetKingdom security architecture and conformance tooling|A2|2|Versioned IAM, layer, tenancy and credential contracts plus validators|Mixed accepted and proposed standards; framework integration remains incomplete|U01 U02 U03 U14|SCOPE.md;SECURITY-COMPANION.md +net-kingdom|security.scenario-compose|Deterministic security scenario composition|A2|2|CLI selects pinned providers and orders trust transitions|Plan only; execution.permitted is always false|U01 U14|tools/security-scenario-composer/README.md;tools/security-scenario-composer/security_scenario_composer.py +net-kingdom|security.posture-feedback|Deterministic posture feedback|A2|2|CLI evaluates evidence age and posture into owner-routed findings|Proposal only; no policy changes or remediation execution|U09 U14|tools/posture-feedback/README.md;tools/posture-feedback/posture_feedback.py +net-kingdom|security.case-contracts|Security case types and instance validation|A2|2|Versioned types, cases and schema validation|Type acknowledgment, case acceptance, structural materialization and native execution are distinct|U01 U05 U06|tools/security-case-types/README.md;canon/standards/security-case-types_v0.1.md +net-kingdom|security.bootstrap-recovery|Guarded bootstrap and recovery preparation|A2|2|Local identity, bootstrap console, encrypted custody handoff and caller tools|Source repairs and disposable native fixtures do not prove estate root isolation or recovery|U10|tools/security-bootstrap-console/README.md;tools/custody-record/README.md +net-kingdom|security.emission-profile|Security emission cadence validation|A2|2|Security profile over generic emission contracts and validator|Profile adoption and source completeness require owner-native evidence|U08 U09|tools/emission-cadence-profile/README.md +key-cape|iam.key-cape|OIDC identity and assurance|A4|3|OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI|Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates|U02 U03 U04 U10|SCOPE.md;README.md +user-engine|identity.user-engine|User lifecycle and account journeys|A4|3|Accounts, identity links, membership, MFA and recovery portal, advisory catalog|Application readback is advisory; applications must enforce their own authorization|U02 U03 U10|SCOPE.md;README.md +tenant-engine|identity.tenant-facts|Tenant lifecycle and guardrail facts|A4|3|Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store|Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate|U03 U04|SCOPE.md;README.md +zone-engine|security.zone-reference|Zone membership reference conformance|A2|2|Offline resolution, exception and lineage checks|No live zone engine, PDP or protected side effects|U01 U03 U14|SCOPE.md;README.md +access-engine|authorization.policy-evaluate|Policy evaluation and decision evidence|A4|3|Check, batch, list-allowed, explain, binding, lifetime and decision records|One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct|U03 U04 U05 U06|SCOPE.md;README.md +approval-engine|security.approval-lifecycle|Bound approval lifecycle|A4|2|Authenticated issue, claim, revoke, supersede and atomic consume API with outbox|Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open|U04 U05 U06|SCOPE.md;approval_engine/api.py;docs/production-dependencies.md +secrets-engine|security.credential-lifecycle|Cataloged credential lifecycle|A2|2|CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke|Production protected execution and independently anchored PDP authentication remain incomplete|U04 U05 U07|SCOPE.md;src/secrets_engine/decision_check.py +ops-warden|security.ssh-certificate-issuance|Decision-bound SSH certificates|A3|3|warden sign with local and OpenBao backends and adm/agt/atm actors|Direct Tooling contact is a declared gap; certificate reachability is not target authorization|U06|SCOPE.md;README.md +ops-warden|security.access-routing|Credential routing and contained access|A3|3|warden route and access catalog; exact lane conduit and secret-exec routing|Routing grants no authority; interim delegates and attended high-risk lanes persist|U04 U05 U06|SCOPE.md;wiki/CredentialRouting.md +ops-warden|security.case-follow-through|Security case operational follow-through|A2|2|KnownSecurityCase route, plan and operational receipts|Execution requires accepted structure and exact owner contracts; case closure is not automatic|U01 U05 U06|workplans/WARDEN-WP-0044-security-case-follow-through.md +ops-mason|security.structure-construction|Reviewed security structure construction|A2|2|Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply|Founder plan gate is an explicit exception; not full PDP conformance|U01 U05 U06|SCOPE.md;docs/construction-plan-format.md +ops-bridge|ops.tunnel-bridge|SSH tunnel lifecycle|A2|3|Named tunnels, reconnect, health and TTL-aware cert_command|Private transport does not authenticate applications or decide access|U06|SCOPE.md +audit-core|audit.event-retain|Independent audit custody|A4|3|Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation|Custody after arrival does not prove source completeness; freshness bounds integrity assertions|U08 U09 U10|SCOPE.md;docs/stream-completeness.md +maturity-engine|security.maturity-claims|Evidence-based maturity claims and gap register|A2|2|SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory|No production deployment claimed; levels supply facts and cannot authorize actions|U09 U14|SCOPE.md;docs/claim-contract.md +kings-guard|security.posture-assessment|Security posture assessment and response proposals|A2|2|Normalized observation evaluator, cadence checks and secret-use snapshot adapter|Bounded reference pilot; containment proposals only; deployed-stream admission remains open|U08 U09|SCOPE.md;docs/SecretUseSnapshotAdmission.md +whitehat-security|security.adversarial-evidence|Authorized adversarial evidence harness|A2|2|Offline ASM and tenancy calibrations and engagement admission|Live probes require a complete engagement; no blanket target authorization|U03 U08 U10 U14|SCOPE.md;README.md +gate-house|security.doctrine-review|Security doctrine and architecture review|A0|3|Layer rules, authority context, ASM criteria and interpretations|Staff judgment; no runtime PDP, credential issuer or automatic enforcement|U01 U09 U14|SCOPE.md;INTENT.md +emergent-security|security.agent-knowledge|Verified security orientation for agents|A2|2|Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports|Current start card withheld for source drift; orientation never grants authority|U01 U11 U14|SCOPE.md;knowledge/cards/start.md +informed-decision|security.human-decision-workspace|Human security decision presentation and disposition|A4|3|Headless lifecycle and browser workspace with exact native approval references|Initial audience is bounded; Approval Engine owns approval state, Access Engine decides|U04 U05 U09|SCOPE.md;README.md +policy-nexus|security.policy-publication|Policy publication with source provenance|A2|3|Generated immutable publication, source currency and stable policy URLs|Publication does not ratify policy or enforce it|U01 U09 U14|README.md;docs/publication-contract.md +risk-nexus|security.risk-register|Security risk and exception review register|A2|2|Markdown findings and Python review, verification and due-work reports|Judgment remains human or agent; no live EUR risk gate or autonomous response|U09 U14|SCOPE.md +role-engine|organization.role-catalog|Organizational role definitions|A0|1|Versioned documentation catalog|Not IAM roles, assignments or runtime authorization|U01 U11|README.md;INTENT.md +glas-harness|execution.profile-harness|Profile-bound agent execution lifecycle|A3|2|Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration|No ready profile asserted by SCOPE; Custodian native isolation remains open|U11|SCOPE.md;README.md +sand-boxer|execution.sandbox-provision|Sandbox establishment and lifecycle|A5|2|Profiles, extensions, provision, checkpoints, TTL teardown and telemetry|Backend-specific guarantees; a created sandbox alone proves no credential isolation|U11 U14|SCOPE.md;README.md +rein-aharness|execution.scheduled-agent-rein|Scheduled agent intake and harness routing|A2|3|Activity Core lease claim/heartbeat and Glas profile execution|Legacy paths are time-gated; task success is not privileged authority|U09 U11|SCOPE.md;README.md +rein-openweights|execution.openweight-rein|Bounded open-weight agent execution|A2|2|Tool loop, path guards, turn/budget limits and verified-commit result|Provider credential acquisition and runtime authority need separate custody controls|U11|SCOPE.md;README.md +agentic-resources|agents.performance-learning|Agent performance learning|A2|2|Capture sessions, curate patterns, distribute lessons and measure outcomes|Workforce assignments and broader authority contracts remain proposed|U09 U11|SCOPE.md +runbook-tutorials|infotech.runbook-tutorials|Guided administrative runbooks|A2|2|Pack schema, loader, local UI/CLI, gates, verification and rollback evidence|Owner supplies procedures; UI progress is not runtime approval|U05 U10 U14|SCOPE.md;docs/pack-spec.md +repo-manager|security.repository-secret-prevention|Repository metadata and staged-secret prevention|A2|3|Repository observation plus pinned staged-blob scanner and hook integration|Local hooks are bypassable; coverage is exact-checkout scoped|U07 U12|SCOPE.md;README.md +sbom-nexus|infotech.sbom-management|Dependency provenance and SBOM evidence|A4|3|Controlled archive ingest, immutable snapshots, freshness and license review|SBOM and license evidence do not prove vulnerability exploitability or artifact trust|U12 U09|README.md +activity-core|activity.event-coordinate|Durable automation and bounded operations|A4|3|Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks|Not a general shell executor; first unassisted security-flow cadence acceptance remains open|U09 U12|SCOPE.md;README.md +issue-core|infotech.issue-tracking|External issue tracker connector|A2|2|CLI and Python adapters for external issue systems|Internal work originates in owner files; external projection is optional|U09|README.md +state-hub|statehub.workstream-coordinate|Cross-repository work tracking|A4|3|File-derived workplans, tasks, dependencies, decisions and coordination views|Read/cache/index of owner work; not runtime approval authority|U09|README.md;SCOPE.md +state-hub|statehub.progress-log|Progress and work evidence indexing|A4|3|REST progress and task evidence references|Not independent security event custody|U08 U09|README.md;SCOPE.md +the-custodian|agents.custodian-runtime-tooling|Generic agent runtime and repository tooling|A2|2|Agent runtime modules and repository classification tooling|Only generic tooling is reusable; confidential canon and session memory are excluded|U09 U11 U14|runtime/README.md +coordination-engine|coordination.cross-owner-work|Cross-owner coordination lifecycle|A2|2|Observation, lease, wake-up, checkpoint and receipt contracts/runtime|Coordinates owners without replacing their execution or security authority|U09|SCOPE.md;spec/cross-owner-wait-mode-v0.1.md +reuse-surface|registry.register|Capability registry and federation|A3|3|Owner Markdown entries, indexes, federation hub and planning queries|Discovery is not readiness; empty and stale entries need evidence-led maintenance|U01 U09 U14|docs/RegistryFederation.md;specs/CapabilityMaturityStandard.md +reuse-surface|registry.validate|Capability registry validation|A3|3|Schema, index consistency and relation checks|Schema validity alone proves neither capability behavior nor hosted freshness|U01 U14|docs/RegistryFederation.md;schemas/capability.schema.yaml +info-tech-canon|infotech.canon-service|Shared semantic contracts and validation|A4|2|Markdown canon with library, CLI and read-only API|Mixed seed/candidate maturity; validation is not owner runtime conformance|U01 U08 U14|SCOPE.md +railiance-master|railiance.security-consumption-contracts|Platform security consumption architecture|A0|2|Rail/rapp/reef boundaries, exposure and security consumption contracts|Architecture declarations do not prove implementation or production admission|U01 U13 U14|SCOPE.md;docs/netkingdom-security-consumption-contract.md +railiance-platform|railiance.platform-services|Secret custody and platform data services|A2|3|OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts|Package ownership is split to rapp repos; caches and object services are demand-led|U04 U05 U07 U10 U13|SCOPE.md;docs/openbao.md +railiance-infra|railiance.infra-provisioning|Host convergence and security baseline|A2|3|Ansible inventory, firewall, SSH bootstrap and baseline verification|Current hosts differ from the retained Hetzner provisioning path|U06 U10 U13|SCOPE.md +railiance-cluster|railiance.cluster-bootstrap|Kubernetes runtime and cluster controls|A2|3|k3s, ingress, CNI, operators and kubeconfig/runtime checks|Single-node runtime and workload recovery are distinct from bootstrap success|U10 U13|SCOPE.md +railiance-enablement|railiance.ci-enablement|Developer delivery and CI templates|A2|2|Reusable CI workflows, build and deployment patterns|Templates do not prove mandatory checks or runner isolation|U12 U14|SCOPE.md +railiance-forge|railiance.forge-infrastructure|Source forge, registries and runner substrate|A2|3|Forgejo operation, package registries and runner lifecycle|Runner workload authority and independent verification coverage remain open|U12|SCOPE.md;workplans/FORGE-WP-0006-independent-secret-detection.md +railiance-forge|security.forge-secret-prevention|Independent introduced-history secret prevention|A2|3|Pinned receive adapter, lifecycle template and fail-closed scan|Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate|U07 U12|workplans/FORGE-WP-0006-independent-secret-detection.md +railiance-apps|railiance.workload-deployment-tooling|Workload release configuration and guards|A2|3|Helm/manifests, exact image pins, application runbooks and rollout/rollback|Release settings depend on underlying platform and workload owners|U12 U13|SCOPE.md +railiance-bootstrap|railiance.bootstrap-sequencing|Bootstrap sequencing contracts|A0|1|Bare-VM to estate sequence and handoff contract|End-to-end unattended rebuild is not established|U10 U14|SCOPE.md +rail-kubernetes|railiance.kubernetes-rail|Generic Kubernetes workload lifecycle|A2|2|Workload declaration, rollout, observe, promote and rollback surfaces|Compatibility extraction remains; not cluster or application-domain ownership|U13 U14|SCOPE.md +reef-railiance|railiance.substrate-bindings|Substrate topology and bindings|A0|2|Grouped home-reef identity, topology and placement declarations|Declarations are not automatic placement or authorization|U13 U14|SCOPE.md +railiance-fabric|railiance.fabric-graph|Infrastructure ownership and dependency graph|A2|2|Schemas, validation, graph queries and State Hub exports|Graph assertions need current owner evidence; not an enforcement registry|U09 U13 U14|SCOPE.md +rapp-openbao|railiance.openbao-package|Managed OpenBao deployment package|A2|3|Helm values, package deploy/status/smoke/rollback and custody boundary|Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit|U04 U10 U13|README.md;docs/retained-s3-handoff.md +rapp-postgres|railiance.postgres-isolation-recovery|Database isolation and recovery package|A2|3|CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures|Host-loss proof and consumer schemas stay with their owners|U03 U10 U13|SCOPE.md +rapp-user-engine|railiance.user-engine-package|User Engine runtime package|A2|3|Pinned deployment, dedicated CNPG, ExternalSecret references and rollback|Domain, identity, PDP and custody authority are separate|U02 U10 U13|SCOPE.md +rapp-tenant-engine|railiance.tenant-engine-package|Tenant Engine runtime package|A2|2|Package declaration, smoke and rollback|No tenant-domain ownership or credential values|U03 U13|SCOPE.md +rapp-policy-nexus|railiance.policy-publication-package|Policy publication runtime package|A2|3|Immutable image, non-root/read-only runtime and approved TLS exposure|No policy authoring or DNS/issuer administration|U01 U13|SCOPE.md +rapp-playwright|railiance.browser-verification|Managed browser verification pilot|A4|2|Bounded jobs, cancellation, artifacts, origin checks and restart receipts|Pilot deployed; human/agent authentication and per-caller self-service connectivity pending|U02 U14|SCOPE.md +railiance-telemetry|observability.security-signals|Security-relevant telemetry contracts and adapters|A2|2|Signal contract, platform adapters, report exporter and absence/alert rules|Reference receiver is not a second production plane; end-to-end delivery acceptance pending|U08 U09|SCOPE.md;README.md +rapp-telemetry|railiance.telemetry-package|Private monitoring package|A2|2|Prometheus, Alertmanager and Grafana package with isolated restore evidence|Private installation only; recurring recovery capture and audited confirmation pending|U08 U09 U10|SCOPE.md +resource-control|resources.security-capacity|Capacity and recovery resource planning|A2|2|Provider-neutral inventory, procurement evidence and optimization reports|No payment authority or irreversible procurement; metrics do not prove usable runtime capacity|U09 U10 U13|SCOPE.md +fin-hub|finance.security-budget-evidence|Budget and cost evidence for security operations|A4|2|Budget, commitment, spend attribution and planning-evidence consumption|No verified concurrent runtime EUR risk/cost enforcement for agents|U09 U11|SCOPE.md +''' +rows=[] +for line in DATA.strip().splitlines(): + repo,suffix,name,a,op,surface,limit,ucs,arts=line.split('|') + rows.append(dict(repo=repo,id='capability.'+suffix,name=name,availability=a,operational_estimate=int(op),surface=surface,limitation=limit,use_cases=ucs.split(),artifacts=arts.split(';'))) +# Source and current registry evidence, content hashes only (never credentials). +repos={} +for repo in sorted({r['repo'] for r in rows}): + root=BASE/repo + def git(*args): + p=subprocess.run(['git','-C',str(root),*args],capture_output=True,text=True);return p.stdout.strip() + ix=root/'registry/indexes/capabilities.yaml' + index=yaml.safe_load(ix.read_text()) if ix.exists() else {} + sources=sorted(set(['INTENT.md','SCOPE.md','README.md']+[a for r in rows if r['repo']==repo for a in r['artifacts']])) + hashes={p:'sha256:'+hashlib.sha256((root/p).read_bytes()).hexdigest() for p in sources if (root/p).is_file()} + missing=[p for r in rows if r['repo']==repo for p in r['artifacts'] if not (root/p).is_file()] + repos[repo]={'head':git('rev-parse','HEAD'),'branch':git('branch','--show-current'),'dirty_paths':git('status','--short').splitlines(),'source_sha256':hashes,'missing_review_artifacts':missing,'existing_index':index} + for r in [x for x in rows if x['repo']==repo]: + old=next((c for c in (index or {}).get('capabilities',[]) if c.get('id')==r['id']),None) + r['existing_entry_path']=old.get('path') if old else None + r['prior_vector']=old.get('vector') if old else None + r['vector']='D3 / '+r['availability']+' / C1 / R0' +(OUT/'inventory.json').write_text(json.dumps({'as_of':'2026-10-14','capabilities':rows,'repositories':repos},indent=2)+'\n') +print(json.dumps({'repos':len(repos),'capabilities':len(rows),'existing':sum(bool(r['existing_entry_path']) for r in rows),'missing_artifacts':{k:v['missing_review_artifacts'] for k,v in repos.items() if v['missing_review_artifacts']}},indent=2)) diff --git a/docs/assessments/netkingdom-2026-10-14/capability-inventory.md b/docs/assessments/netkingdom-2026-10-14/capability-inventory.md new file mode 100644 index 00000000..5b02cb26 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/capability-inventory.md @@ -0,0 +1,504 @@ +# NetKingdom repository and capability inventory + +Assessed 2026-10-14. See the [architecture review](../../netkingdom-security-architecture-review.md) for use cases U01–U14, evidence rules, operational maturity M1–M5 and D/A/C/R definitions. Existing external evidence levels are owner claims, not newly certified scores. + +**60 capability-owning repositories, 70 reviewed capabilities, plus two inspected nonproviders.** + +## access-engine + +Source revision `16ca97b2776789f730cc7049a2d6533612faaccd`. [Owner scope](../../../../access-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Policy evaluation and decision evidence](../../../../access-engine/SCOPE.md)
`capability.authorization.policy-evaluate` | Check, batch, list-allowed, explain, binding, lifetime and decision records.
U03, U04, U05, U06 | D4 / A4 / C2 / R1
M3 estimate | One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct. | + +## activity-core + +Source revision `83e6446807c4b36f3aa5023a5c16d4c7df8bd3df`. [Owner scope](../../../../activity-core/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Durable automation and bounded operations](../../../../activity-core/SCOPE.md)
`capability.activity.event-coordinate` | Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.
U09, U12 | D3 / A4 / C1 / R0
M3 estimate | Not a general shell executor; first unassisted security-flow cadence acceptance remains open. | + +## agentic-resources + +Source revision `65b3a5cb6bf3eb214b492b95a38f2eb729f89709`. [Owner scope](../../../../agentic-resources/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Agent performance learning](../../../../agentic-resources/SCOPE.md)
`capability.agents.performance-learning` | Capture sessions, curate patterns, distribute lessons and measure outcomes.
U09, U11 | D3 / A2 / C1 / R0
M2 estimate | Workforce assignments and broader authority contracts remain proposed. | + +## approval-engine + +Source revision `e1649617e8ad321f79632d5fd33e973ae5d5ae51`. [Owner scope](../../../../approval-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Bound approval lifecycle](../../../../approval-engine/SCOPE.md)
`capability.security.approval-lifecycle` | Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.
U04, U05, U06 | D3 / A4 / C1 / R0
M2 estimate | Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open. | + +## audit-core + +Source revision `f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9`. [Owner scope](../../../../audit-core/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Independent audit custody](../../../../audit-core/SCOPE.md)
`capability.audit.event-retain` | Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.
U08, U09, U10 | D3 / A4 / C3 / R2
M3 estimate | Custody after arrival does not prove source completeness; freshness bounds integrity assertions. | + +## coordination-engine + +Source revision `c401067842072b75717f76480dd6e7db1836059c`. [Owner scope](../../../../coordination-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Cross-owner coordination lifecycle](../../../../coordination-engine/SCOPE.md)
`capability.coordination.cross-owner-work` | Observation, lease, wake-up, checkpoint and receipt contracts/runtime.
U09 | D3 / A2 / C1 / R0
M2 estimate | Coordinates owners without replacing their execution or security authority. | + +## emergent-security + +Source revision `4c6fda38298fa50665ead41526b893adf069d335`. [Owner scope](../../../../emergent-security/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Verified security orientation for agents](../../../../emergent-security/SCOPE.md)
`capability.security.agent-knowledge` | Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports.
U01, U11, U14 | D3 / A2 / C1 / R0
M2 estimate | Current start card withheld for source drift; orientation never grants authority. | + +## fin-hub + +Source revision `8f527c6705bbf5d7ffed43559411ca748bec8fe4`. [Owner scope](../../../../fin-hub/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Budget and cost evidence for security operations](../../../../fin-hub/SCOPE.md)
`capability.finance.security-budget-evidence` | Budget, commitment, spend attribution and planning-evidence consumption.
U09, U11 | D3 / A4 / C1 / R0
M2 estimate | No verified concurrent runtime EUR risk/cost enforcement for agents. | + +## gate-house + +Source revision `bc890c4d050a2e726ce8988a8260ab9caea133e3`. [Owner scope](../../../../gate-house/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Security doctrine and architecture review](../../../../gate-house/SCOPE.md)
`capability.security.doctrine-review` | Layer rules, authority context, ASM criteria and interpretations.
U01, U09, U14 | D3 / A0 / C1 / R0
M3 estimate | Staff judgment; no runtime PDP, credential issuer or automatic enforcement. | + +## glas-harness + +Source revision `7b1557ba14f483569b90ebfdc2d0136fa69602fe`. [Owner scope](../../../../glas-harness/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Profile-bound agent execution lifecycle](../../../../glas-harness/SCOPE.md)
`capability.execution.profile-harness` | Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration.
U11 | D3 / A3 / C1 / R0
M2 estimate | No ready profile asserted by SCOPE; Custodian native isolation remains open. | + +## info-tech-canon + +Source revision `3d206a56f4ece439f6ee87f9ee4d1800ab82166e`. [Owner scope](../../../../info-tech-canon/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Shared semantic contracts and validation](../../../../info-tech-canon/SCOPE.md)
`capability.infotech.canon-service` | Markdown canon with library, CLI and read-only API.
U01, U08, U14 | D2 / A4 / C1 / R0
M2 estimate | Mixed seed/candidate maturity; validation is not owner runtime conformance. | + +## informed-decision + +Source revision `ee6a65b80a0fea1a914dfa31434b903669656c09`. [Owner scope](../../../../informed-decision/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Human security decision presentation and disposition](../../../../informed-decision/SCOPE.md)
`capability.security.human-decision-workspace` | Headless lifecycle and browser workspace with exact native approval references.
U04, U05, U09 | D3 / A4 / C1 / R0
M3 estimate | Initial audience is bounded; Approval Engine owns approval state, Access Engine decides. | + +## issue-core + +Source revision `de368271f6ffc06353ec409998a0d6d0ec0bf25e`. [Owner scope](../../../../issue-core/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [External issue tracker connector](../../../../issue-core/README.md)
`capability.infotech.issue-tracking` | CLI and Python adapters for external issue systems.
U09 | D4 / A2 / C2 / R1
M2 estimate | Internal work originates in owner files; external projection is optional. | + +## key-cape + +Source revision `1344fc80e56315c5c99f58993f9ee02ce79e8a76`. [Owner scope](../../../../key-cape/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [OIDC identity and assurance](../../../../key-cape/SCOPE.md)
`capability.iam.key-cape` | OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.
U02, U03, U04, U10 | D4 / A4 / C2 / R1
M3 estimate | Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates. | + +## kings-guard + +Source revision `af02e2547598d6ec0e83f482d9ea3ef943ea67b7`. [Owner scope](../../../../kings-guard/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Security posture assessment and response proposals](../../../../kings-guard/SCOPE.md)
`capability.security.posture-assessment` | Normalized observation evaluator, cadence checks and secret-use snapshot adapter.
U08, U09 | D3 / A2 / C1 / R0
M2 estimate | Bounded reference pilot; containment proposals only; deployed-stream admission remains open. | + +## maturity-engine + +Source revision `2f1de542cc8f24a79452f906d99f95be39d8b6a9`. [Owner scope](../../../../maturity-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Evidence-based maturity claims and gap register](../../../../maturity-engine/SCOPE.md)
`capability.security.maturity-claims` | SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory.
U09, U14 | D3 / A2 / C1 / R0
M2 estimate | No production deployment claimed; levels supply facts and cannot authorize actions. | + +## net-kingdom + +Source revision `1a36e857cc5aae6fe738f794417126c46dd94627`. [Owner scope](../../../../net-kingdom/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [NetKingdom security architecture and conformance tooling](../../../../net-kingdom/SCOPE.md)
`capability.security.iam-tooling-suite` | Versioned IAM, layer, tenancy and credential contracts plus validators.
U01, U02, U03, U14 | D3 / A2 / C1 / R1
M2 estimate | Mixed accepted and proposed standards; framework integration remains incomplete. | +| [Deterministic security scenario composition](../../../../net-kingdom/tools/security-scenario-composer/README.md)
`capability.security.scenario-compose` | CLI selects pinned providers and orders trust transitions.
U01, U14 | D3 / A2 / C1 / R0
M2 estimate | Plan only; execution.permitted is always false. | +| [Deterministic posture feedback](../../../../net-kingdom/tools/posture-feedback/README.md)
`capability.security.posture-feedback` | CLI evaluates evidence age and posture into owner-routed findings.
U09, U14 | D3 / A2 / C1 / R0
M2 estimate | Proposal only; no policy changes or remediation execution. | +| [Security case types and instance validation](../../../../net-kingdom/tools/security-case-types/README.md)
`capability.security.case-contracts` | Versioned types, cases and schema validation.
U01, U05, U06 | D3 / A2 / C1 / R0
M2 estimate | Type acknowledgment, case acceptance, structural materialization and native execution are distinct. | +| [Guarded bootstrap and recovery preparation](../../../../net-kingdom/tools/security-bootstrap-console/README.md)
`capability.security.bootstrap-recovery` | Local identity, bootstrap console, encrypted custody handoff and caller tools.
U10 | D3 / A2 / C1 / R0
M2 estimate | Source repairs and disposable native fixtures do not prove estate root isolation or recovery. | +| [Security emission cadence validation](../../../../net-kingdom/tools/emission-cadence-profile/README.md)
`capability.security.emission-profile` | Security profile over generic emission contracts and validator.
U08, U09 | D3 / A2 / C1 / R0
M2 estimate | Profile adoption and source completeness require owner-native evidence. | + +## ops-bridge + +Source revision `190ef1e188e12c606f1359325fd9fdd1dbef29e2`. [Owner scope](../../../../ops-bridge/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [SSH tunnel lifecycle](../../../../ops-bridge/SCOPE.md)
`capability.ops.tunnel-bridge` | Named tunnels, reconnect, health and TTL-aware cert_command.
U06 | D3 / A2 / C2 / R1
M3 estimate | Private transport does not authenticate applications or decide access. | + +## ops-mason + +Source revision `d86ad141befb6800468f5132d4c7c9ce2f852bb5`. [Owner scope](../../../../ops-mason/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Reviewed security structure construction](../../../../ops-mason/SCOPE.md)
`capability.security.structure-construction` | Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.
U01, U05, U06 | D3 / A2 / C1 / R0
M2 estimate | Founder plan gate is an explicit exception; not full PDP conformance. | + +## ops-warden + +Source revision `6d2f1be9691b19e826898a2166ae4451e4802ae2`. [Owner scope](../../../../ops-warden/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Decision-bound SSH certificates](../../../../ops-warden/SCOPE.md)
`capability.security.ssh-certificate-issuance` | warden sign with local and OpenBao backends and adm/agt/atm actors.
U06 | D4 / A3 / C3 / R2
M3 estimate | Direct Tooling contact is a declared gap; certificate reachability is not target authorization. | +| [Credential routing and contained access](../../../../ops-warden/SCOPE.md)
`capability.security.access-routing` | warden route and access catalog; exact lane conduit and secret-exec routing.
U04, U05, U06 | D3 / A3 / C1 / R0
M3 estimate | Routing grants no authority; interim delegates and attended high-risk lanes persist. | +| [Security case operational follow-through](../../../../ops-warden/workplans/WARDEN-WP-0044-security-case-follow-through.md)
`capability.security.case-follow-through` | KnownSecurityCase route, plan and operational receipts.
U01, U05, U06 | D3 / A2 / C1 / R0
M2 estimate | Execution requires accepted structure and exact owner contracts; case closure is not automatic. | + +## policy-nexus + +Source revision `f784f017b0822f34c785f0b34c7c55fcf39c9d99`. [Owner scope](../../../../policy-nexus/README.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Policy publication with source provenance](../../../../policy-nexus/README.md)
`capability.security.policy-publication` | Generated immutable publication, source currency and stable policy URLs.
U01, U09, U14 | D3 / A2 / C1 / R0
M3 estimate | Publication does not ratify policy or enforce it. | + +## rail-knative + +Source revision `cd38dba3653e7fc85d3b2d3a074811b9a7216f25`. [Owner scope](../../../../rail-knative/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Knative workload lifecycle](../../../../rail-knative/SCOPE.md)
`capability.railiance.knative-rail` | Derived rail for activation, revisions, traffic, scaling and rollback.
U09, U13, U14 | D3 / A2 / C1 / R0
M3 estimate | Inherits Kubernetes common contract; verified readiness is not production approval. | + +## rail-kubernetes + +Source revision `35159e49c1340b7a0e30c49188975c8839d346f6`. [Owner scope](../../../../rail-kubernetes/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Generic Kubernetes workload lifecycle](../../../../rail-kubernetes/SCOPE.md)
`capability.railiance.kubernetes-rail` | Workload declaration, rollout, observe, promote and rollback surfaces.
U13, U14 | D3 / A2 / C1 / R0
M2 estimate | Compatibility extraction remains; not cluster or application-domain ownership. | + +## railiance-apps + +Source revision `706461b845086ee2df8ce9acae3dae7feebfffda`. [Owner scope](../../../../railiance-apps/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Workload release configuration and guards](../../../../railiance-apps/SCOPE.md)
`capability.railiance.workload-deployment-tooling` | Helm/manifests, exact image pins, application runbooks and rollout/rollback.
U12, U13 | D3 / A2 / C1 / R1
M3 estimate | Release settings depend on underlying platform and workload owners. | + +## railiance-bootstrap + +Source revision `ae00b2652737aaf18358431e66f59eeb7c01e16b`. [Owner scope](../../../../railiance-bootstrap/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Bootstrap sequencing contracts](../../../../railiance-bootstrap/SCOPE.md)
`capability.railiance.bootstrap-sequencing` | Bare-VM to estate sequence and handoff contract.
U10, U14 | D3 / A0 / C1 / R0
M1 estimate | End-to-end unattended rebuild is not established. | + +## railiance-cluster + +Source revision `12d1e881ff2086566712fbc591db293b38ea2bcf`. [Owner scope](../../../../railiance-cluster/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Kubernetes runtime and cluster controls](../../../../railiance-cluster/SCOPE.md)
`capability.railiance.cluster-bootstrap` | k3s, ingress, CNI, operators and kubeconfig/runtime checks.
U10, U13 | D3 / A2 / C1 / R0
M3 estimate | Single-node runtime and workload recovery are distinct from bootstrap success. | + +## railiance-enablement + +Source revision `51a7c4cee68b48ed7a236e661b39c1d3cca92063`. [Owner scope](../../../../railiance-enablement/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Developer delivery and CI templates](../../../../railiance-enablement/SCOPE.md)
`capability.railiance.ci-enablement` | Reusable CI workflows, build and deployment patterns.
U12, U14 | D3 / A2 / C2 / R1
M2 estimate | Templates do not prove mandatory checks or runner isolation. | + +## railiance-fabric + +Source revision `96d19127125e85bdab7ff0ff79fc3ecf7d19045e`. [Owner scope](../../../../railiance-fabric/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Infrastructure ownership and dependency graph](../../../../railiance-fabric/SCOPE.md)
`capability.railiance.fabric-graph` | Schemas, validation, graph queries and State Hub exports.
U09, U13, U14 | D3 / A2 / C1 / R0
M2 estimate | Graph assertions need current owner evidence; not an enforcement registry. | + +## railiance-forge + +Source revision `a15fac8e938c11b041eb39386f05b63d46ae566a`. [Owner scope](../../../../railiance-forge/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Source forge, registries and runner substrate](../../../../railiance-forge/SCOPE.md)
`capability.railiance.forge-infrastructure` | Forgejo operation, package registries and runner lifecycle.
U12 | D3 / A2 / C1 / R0
M3 estimate | Runner workload authority and independent verification coverage remain open. | +| [Independent introduced-history secret prevention](../../../../railiance-forge/workplans/FORGE-WP-0006-independent-secret-detection.md)
`capability.security.forge-secret-prevention` | Pinned receive adapter, lifecycle template and fail-closed scan.
U07, U12 | D3 / A2 / C1 / R0
M3 estimate | Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate. | + +## railiance-infra + +Source revision `ef64e324b61e9aa9b9ed03aad7dd2101915057ca`. [Owner scope](../../../../railiance-infra/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Host convergence and security baseline](../../../../railiance-infra/SCOPE.md)
`capability.railiance.infra-provisioning` | Ansible inventory, firewall, SSH bootstrap and baseline verification.
U06, U10, U13 | D4 / A2 / C2 / R1
M3 estimate | Current hosts differ from the retained Hetzner provisioning path. | + +## railiance-master + +Source revision `865c3bed86b3992244b29d6f1d6b8ebbe8db78c7`. [Owner scope](../../../../railiance-master/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Platform security consumption architecture](../../../../railiance-master/SCOPE.md)
`capability.railiance.security-consumption-contracts` | Rail/rapp/reef boundaries, exposure and security consumption contracts.
U01, U13, U14 | D3 / A0 / C1 / R0
M2 estimate | Architecture declarations do not prove implementation or production admission. | + +## railiance-platform + +Source revision `d303c99e3be993ffa989bc9ba3d7b471903858ce`. [Owner scope](../../../../railiance-platform/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Secret custody and platform data services](../../../../railiance-platform/SCOPE.md)
`capability.railiance.platform-services` | OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.
U04, U05, U07, U10, U13 | D3 / A2 / C1 / R0
M3 estimate | Package ownership is split to rapp repos; caches and object services are demand-led. | + +## railiance-telemetry + +Source revision `81d905971c38de9aaf11088ba605e112152d8268`. [Owner scope](../../../../railiance-telemetry/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Security-relevant telemetry contracts and adapters](../../../../railiance-telemetry/SCOPE.md)
`capability.observability.security-signals` | Signal contract, platform adapters, report exporter and absence/alert rules.
U08, U09 | D3 / A2 / C1 / R0
M2 estimate | Reference receiver is not a second production plane; end-to-end delivery acceptance pending. | + +## rapp-openbao + +Source revision `13ab9144bbb1d88fe760362df91a83c8b34e4e66`. [Owner scope](../../../../rapp-openbao/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Managed OpenBao deployment package](../../../../rapp-openbao/README.md)
`capability.railiance.openbao-package` | Helm values, package deploy/status/smoke/rollback and custody boundary.
U04, U10, U13 | D3 / A2 / C1 / R0
M3 estimate | Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit. | + +## rapp-playwright + +Source revision `2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb`. [Owner scope](../../../../rapp-playwright/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Managed browser verification pilot](../../../../rapp-playwright/SCOPE.md)
`capability.railiance.browser-verification` | Bounded jobs, cancellation, artifacts, origin checks and restart receipts.
U02, U14 | D3 / A4 / C1 / R0
M2 estimate | Pilot deployed; human/agent authentication and per-caller self-service connectivity pending. | + +## rapp-policy-nexus + +Source revision `d3fee97d32ad47e3a7e3201a9c5b7209b4333fda`. [Owner scope](../../../../rapp-policy-nexus/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Policy publication runtime package](../../../../rapp-policy-nexus/SCOPE.md)
`capability.railiance.policy-publication-package` | Immutable image, non-root/read-only runtime and approved TLS exposure.
U01, U13 | D3 / A2 / C1 / R0
M3 estimate | No policy authoring or DNS/issuer administration. | + +## rapp-postgres + +Source revision `03744030c9258e920f6403a9ce184a26d7b75268`. [Owner scope](../../../../rapp-postgres/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Database isolation and recovery package](../../../../rapp-postgres/SCOPE.md)
`capability.railiance.postgres-isolation-recovery` | CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures.
U03, U10, U13 | D3 / A2 / C1 / R0
M3 estimate | Host-loss proof and consumer schemas stay with their owners. | + +## rapp-sbom-nexus + +Source revision `1566bcf69fc0757db5efc67f78b14af10d944c1b`. [Owner scope](../../../../rapp-sbom-nexus/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Private SBOM runtime and dynamic database delivery](../../../../rapp-sbom-nexus/SCOPE.md)
`capability.railiance.sbom-runtime-package` | Immutable deployment, private network policy, dynamic database leases and migration/rollback.
U07, U12, U13 | D3 / A2 / C1 / R0
M3 estimate | Product owns schema and ingestion; database and backup authority remain with platform owners. | + +## rapp-telemetry + +Source revision `17053dbc47f7c22efd67fd90d06d108d154835fa`. [Owner scope](../../../../rapp-telemetry/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Private monitoring package](../../../../rapp-telemetry/SCOPE.md)
`capability.railiance.telemetry-package` | Prometheus, Alertmanager and Grafana package with isolated restore evidence.
U08, U09, U10 | D3 / A2 / C1 / R0
M2 estimate | Private installation only; recurring recovery capture and audited confirmation pending. | + +## rapp-tenant-engine + +Source revision `c160be23577ab4d99ee2cd008deb455b07f0597d`. [Owner scope](../../../../rapp-tenant-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Tenant Engine runtime package](../../../../rapp-tenant-engine/SCOPE.md)
`capability.railiance.tenant-engine-package` | Package declaration, smoke and rollback.
U03, U13 | D3 / A2 / C1 / R0
M2 estimate | No tenant-domain ownership or credential values. | + +## rapp-user-engine + +Source revision `15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c`. [Owner scope](../../../../rapp-user-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [User Engine runtime package](../../../../rapp-user-engine/SCOPE.md)
`capability.railiance.user-engine-package` | Pinned deployment, dedicated CNPG, ExternalSecret references and rollback.
U02, U10, U13 | D3 / A2 / C1 / R0
M3 estimate | Domain, identity, PDP and custody authority are separate. | + +## reef-railiance + +Source revision `ffb9e272ce1489cc37cc6388873558d8ba56c239`. [Owner scope](../../../../reef-railiance/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Substrate topology and bindings](../../../../reef-railiance/SCOPE.md)
`capability.railiance.substrate-bindings` | Grouped home-reef identity, topology and placement declarations.
U13, U14 | D3 / A0 / C1 / R0
M2 estimate | Declarations are not automatic placement or authorization. | + +## rein-aharness + +Source revision `398949a3d34b6c9faae0fa1d0ff0aa039565aa42`. [Owner scope](../../../../rein-aharness/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Scheduled agent intake and harness routing](../../../../rein-aharness/SCOPE.md)
`capability.execution.scheduled-agent-rein` | Activity Core lease claim/heartbeat and Glas profile execution.
U09, U11 | D3 / A2 / C1 / R0
M3 estimate | Legacy paths are time-gated; task success is not privileged authority. | + +## rein-openweights + +Source revision `e1fccb39b738a5381a9de6e1d799f124797798ce`. [Owner scope](../../../../rein-openweights/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Bounded open-weight agent execution](../../../../rein-openweights/SCOPE.md)
`capability.execution.openweight-rein` | Tool loop, path guards, turn/budget limits and verified-commit result.
U11 | D3 / A2 / C1 / R0
M2 estimate | Provider credential acquisition and runtime authority need separate custody controls. | + +## repo-manager + +Source revision `7677b00f69cd6362ac16a1021dc180ec6df4ebfa`. [Owner scope](../../../../repo-manager/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Repository metadata and staged-secret prevention](../../../../repo-manager/SCOPE.md)
`capability.security.repository-secret-prevention` | Repository observation plus pinned staged-blob scanner and hook integration.
U07, U12 | D3 / A2 / C1 / R0
M3 estimate | Local hooks are bypassable; coverage is exact-checkout scoped. | + +## resource-control + +Source revision `3604d468f86ede7d320f4d22dd4aea775306b53f`. [Owner scope](../../../../resource-control/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Capacity and recovery resource planning](../../../../resource-control/SCOPE.md)
`capability.resources.security-capacity` | Provider-neutral inventory, procurement evidence and optimization reports.
U09, U10, U13 | D3 / A2 / C1 / R0
M2 estimate | No payment authority or irreversible procurement; metrics do not prove usable runtime capacity. | + +## reuse-surface + +Source revision `a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1`. [Owner scope](../../../../reuse-surface/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Capability registry and federation](../../../../reuse-surface/docs/RegistryFederation.md)
`capability.registry.register` | Owner Markdown entries, indexes, federation hub and planning queries.
U01, U09, U14 | D3 / A3 / C2 / R3
M3 estimate | Discovery is not readiness; empty and stale entries need evidence-led maintenance. | +| [Capability registry validation](../../../../reuse-surface/docs/RegistryFederation.md)
`capability.registry.validate` | Schema, index consistency and relation checks.
U01, U14 | D4 / A3 / C3 / R3
M3 estimate | Schema validity alone proves neither capability behavior nor hosted freshness. | + +## risk-nexus + +Source revision `b877231d66e1289dc32fda07ed2c61dcb3e970dc`. [Owner scope](../../../../risk-nexus/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Security risk and exception review register](../../../../risk-nexus/SCOPE.md)
`capability.security.risk-register` | Markdown findings and Python review, verification and due-work reports.
U09, U14 | D3 / A2 / C1 / R0
M2 estimate | Judgment remains human or agent; no live EUR risk gate or autonomous response. | + +## role-engine + +Source revision `d231241dbfeeb541b34243f4022883aa6417a1eb`. [Owner scope](../../../../role-engine/README.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Organizational role definitions](../../../../role-engine/README.md)
`capability.organization.role-catalog` | Versioned documentation catalog.
U01, U11 | D3 / A0 / C1 / R0
M1 estimate | Not IAM roles, assignments or runtime authorization. | + +## runbook-tutorials + +Source revision `df97fadf5decfcdb5c3c6ab90211226335ffdf8e`. [Owner scope](../../../../runbook-tutorials/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Guided administrative runbooks](../../../../runbook-tutorials/SCOPE.md)
`capability.infotech.runbook-tutorials` | Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.
U05, U10, U14 | D3 / A2 / C1 / R0
M2 estimate | Owner supplies procedures; UI progress is not runtime approval. | + +## sand-boxer + +Source revision `b06d94f02b037764ff41c73c8ab43f4c8f5d309d`. [Owner scope](../../../../sand-boxer/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Sandbox establishment and lifecycle](../../../../sand-boxer/SCOPE.md)
`capability.execution.sandbox-provision` | Profiles, extensions, provision, checkpoints, TTL teardown and telemetry.
U11, U14 | D5 / A5 / C5 / R0
M2 estimate | Backend-specific guarantees; a created sandbox alone proves no credential isolation. | + +## sbom-nexus + +Source revision `07e998d9abfd4e4fcc74db9e292ed22c6f407522`. [Owner scope](../../../../sbom-nexus/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Dependency provenance and SBOM evidence](../../../../sbom-nexus/README.md)
`capability.infotech.sbom-management` | Controlled archive ingest, immutable snapshots, freshness and license review.
U12, U09 | D3 / A4 / C1 / R0
M3 estimate | SBOM and license evidence do not prove vulnerability exploitability or artifact trust. | + +## secrets-engine + +Source revision `d379a3dfba73c42cd97f4d9cba3a02d705155e4d`. [Owner scope](../../../../secrets-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Cataloged credential lifecycle](../../../../secrets-engine/SCOPE.md)
`capability.security.credential-lifecycle` | CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.
U04, U05, U07 | D3 / A2 / C1 / R0
M2 estimate | Production protected execution and independently anchored PDP authentication remain incomplete. | + +## security-canon + +Source revision `1664a6def20be2759a1e575024563efd27c9f36f`. [Owner scope](../../../../security-canon/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Security practice and authority vocabulary](../../../../security-canon/SCOPE.md)
`capability.security.practice-canon` | Versioned SEC-DSM and Mode of Authority documents.
U01, U07, U10, U14 | D3 / A0 / C1 / R0
M2 estimate | Normative practice; no runtime control or certification. | + +## state-hub + +Source revision `8ca9201f6a1445c66fe1d1b0ba0c8d044c131647`. [Owner scope](../../../../state-hub/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Cross-repository work tracking](../../../../state-hub/README.md)
`capability.statehub.workstream-coordinate` | File-derived workplans, tasks, dependencies, decisions and coordination views.
U09 | D4 / A4 / C3 / R2
M3 estimate | Read/cache/index of owner work; not runtime approval authority. | +| [Progress and work evidence indexing](../../../../state-hub/README.md)
`capability.statehub.progress-log` | REST progress and task evidence references.
U08, U09 | D4 / A4 / C3 / R3
M3 estimate | Not independent security event custody. | + +## tenant-engine + +Source revision `1dabbcf47d87d27d118dcf3147d9e3588a807e0c`. [Owner scope](../../../../tenant-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Tenant lifecycle and guardrail facts](../../../../tenant-engine/SCOPE.md)
`capability.identity.tenant-facts` | Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.
U03, U04 | D3 / A4 / C1 / R0
M3 estimate | Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate. | + +## the-custodian + +Source revision `3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e`. [Owner scope](../../../../the-custodian/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Generic agent runtime and repository tooling](../../../../the-custodian/runtime/README.md)
`capability.agents.custodian-runtime-tooling` | Agent runtime modules and repository classification tooling.
U09, U11, U14 | D2 / A2 / C1 / R0
M2 estimate | Only generic tooling is reusable; confidential canon and session memory are excluded. | + +## user-engine + +Source revision `85a419d6c5d0b4434d3ca7f33bde3092f5838f79`. [Owner scope](../../../../user-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [User lifecycle and account journeys](../../../../user-engine/SCOPE.md)
`capability.identity.user-engine` | Accounts, identity links, membership, MFA and recovery portal, advisory catalog.
U02, U03, U10 | D4 / A4 / C2 / R0
M3 estimate | Application readback is advisory; applications must enforce their own authorization. | + +## whitehat-security + +Source revision `5587a8f6ac4b129527db819bc72832051c7fcc3b`. [Owner scope](../../../../whitehat-security/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Authorized adversarial evidence harness](../../../../whitehat-security/SCOPE.md)
`capability.security.adversarial-evidence` | Offline ASM and tenancy calibrations and engagement admission.
U03, U08, U10, U14 | D3 / A2 / C1 / R0
M2 estimate | Live probes require a complete engagement; no blanket target authorization. | + +## zone-engine + +Source revision `b5a6f88a82b125ebc82c0484bec1ea541e4f95d0`. [Owner scope](../../../../zone-engine/SCOPE.md). + +| Capability and stable ID | Reuse surface and use cases | Maturity | Limitation | +| --- | --- | --- | --- | +| [Zone membership reference conformance](../../../../zone-engine/SCOPE.md)
`capability.security.zone-reference` | Offline resolution, exception and lineage checks.
U01, U03, U14 | D3 / A2 / C1 / R0
M2 estimate | No live zone engine, PDP or protected side effects. | + +## Inspected nonproviders + +| Repo | Disposition | +| --- | --- | +| [rapp-secrets-engine](../../../../rapp-secrets-engine/README.md) | Retired compatibility stub. Secrets Engine is a CLI/workflow capability; no independent workload is available. No capability was invented to populate this tombstone. | +| [rapp-forgejo](../../../../rapp-forgejo/README.md) | Placeholder with no family declaration. Current Forgejo deployment responsibility remains in the existing Forge/Apps owners. The package family check reports this missing declaration. | + +The existing reuse-surface `capability.infotech.headless-browser` remains an additional discovery card for selecting browser tooling. The reviewed `rapp-playwright` capability describes the concrete managed package/provider. This review preserves the discovery card and does not treat the two IDs as two independent browser implementations. diff --git a/docs/assessments/netkingdom-2026-10-14/commit-scan-diagnosis.json b/docs/assessments/netkingdom-2026-10-14/commit-scan-diagnosis.json new file mode 100644 index 00000000..6dd61586 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/commit-scan-diagnosis.json @@ -0,0 +1,10 @@ +{ + "initial_commit": "blocked by generic-api-key on inventory JSON", + "diagnosis": "All flagged fields were SHA-256 hashes of source files; each value independently recomputed and matched before changing serialization. No credential contents were collected in these fields.", + "remediation": "Qualify source digest strings with sha256: rather than placing bare hex immediately after API/credential-like filename keys. No scanner exception or rule change.", + "affected_artifacts": [ + "inventory.json", + "full-inventory.json" + ], + "verification": "Normal pre-commit scanner must pass on the revised evidence." +} diff --git a/docs/assessments/netkingdom-2026-10-14/completion-audit.json b/docs/assessments/netkingdom-2026-10-14/completion-audit.json new file mode 100644 index 00000000..aa029d0f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/completion-audit.json @@ -0,0 +1,42 @@ +{ + "objective_achieved": false, + "requirements": [ + { + "requirement": "All relevant repository and capability inventory", + "status": "complete", + "evidence": "full-inventory.json: 60 providers, 70 capabilities; two nonproviders recorded separately" + }, + { + "requirement": "Supported use cases", + "status": "complete", + "evidence": "14 use cases in review, owner entries and inventory" + }, + { + "requirement": "SWOT", + "status": "complete", + "evidence": "Architecture review SWOT table" + }, + { + "requirement": "Maturity estimate", + "status": "complete", + "evidence": "Operational M1\u2013M5 estimates and separate D/A/C/R per capability with limits" + }, + { + "requirement": "Ranked improvements for architecture efficiency and framework reuse", + "status": "complete", + "evidence": "12 ranked recommendations with owners, dependencies, effort and acceptance measures" + }, + { + "requirement": "Owner capability establishment and local reuse-surface discovery", + "status": "complete", + "evidence": "70/70 local schema, relations, index parity and native federation checks; normal CLI discovery; 60 published source registries" + }, + { + "requirement": "Hosted reuse-surface establishment", + "status": "incomplete", + "evidence": "32/70 hosted; 38 registrations pending caller access; seven also require private-source admission" + } + ], + "goal_status": "active", + "remaining_action": "Owner-approved hub-write access and private-source read/disclosure admission; apply exact plan and verify all 70 hosted IDs and source parity." +} diff --git a/docs/assessments/netkingdom-2026-10-14/federated-local.yaml b/docs/assessments/netkingdom-2026-10-14/federated-local.yaml new file mode 100644 index 00000000..c56445d5 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/federated-local.yaml @@ -0,0 +1,1502 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +collision_policy: warn +sources: +- repo: access-engine + count: 1 + index: /home/worsch/access-engine/registry/indexes/capabilities.yaml +- repo: activity-core + count: 1 + index: /home/worsch/activity-core/registry/indexes/capabilities.yaml +- repo: agentic-resources + count: 1 + index: /home/worsch/agentic-resources/registry/indexes/capabilities.yaml +- repo: approval-engine + count: 1 + index: /home/worsch/approval-engine/registry/indexes/capabilities.yaml +- repo: audit-core + count: 1 + index: /home/worsch/audit-core/registry/indexes/capabilities.yaml +- repo: coordination-engine + count: 1 + index: /home/worsch/coordination-engine/registry/indexes/capabilities.yaml +- repo: emergent-security + count: 1 + index: /home/worsch/emergent-security/registry/indexes/capabilities.yaml +- repo: fin-hub + count: 1 + index: /home/worsch/fin-hub/registry/indexes/capabilities.yaml +- repo: gate-house + count: 1 + index: /home/worsch/gate-house/registry/indexes/capabilities.yaml +- repo: glas-harness + count: 1 + index: /home/worsch/glas-harness/registry/indexes/capabilities.yaml +- repo: info-tech-canon + count: 1 + index: /home/worsch/info-tech-canon/registry/indexes/capabilities.yaml +- repo: informed-decision + count: 1 + index: /home/worsch/informed-decision/registry/indexes/capabilities.yaml +- repo: issue-core + count: 1 + index: /home/worsch/issue-core/registry/indexes/capabilities.yaml +- repo: key-cape + count: 1 + index: /home/worsch/key-cape/registry/indexes/capabilities.yaml +- repo: kings-guard + count: 1 + index: /home/worsch/kings-guard/registry/indexes/capabilities.yaml +- repo: maturity-engine + count: 1 + index: /home/worsch/maturity-engine/registry/indexes/capabilities.yaml +- repo: net-kingdom + count: 6 + index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml +- repo: ops-bridge + count: 1 + index: /home/worsch/ops-bridge/registry/indexes/capabilities.yaml +- repo: ops-mason + count: 1 + index: /home/worsch/ops-mason/registry/indexes/capabilities.yaml +- repo: ops-warden + count: 3 + index: /home/worsch/ops-warden/registry/indexes/capabilities.yaml +- repo: policy-nexus + count: 1 + index: /home/worsch/policy-nexus/registry/indexes/capabilities.yaml +- repo: rail-kubernetes + count: 1 + index: /home/worsch/rail-kubernetes/registry/indexes/capabilities.yaml +- repo: railiance-apps + count: 1 + index: /home/worsch/railiance-apps/registry/indexes/capabilities.yaml +- repo: railiance-bootstrap + count: 1 + index: /home/worsch/railiance-bootstrap/registry/indexes/capabilities.yaml +- repo: railiance-cluster + count: 1 + index: /home/worsch/railiance-cluster/registry/indexes/capabilities.yaml +- repo: railiance-enablement + count: 1 + index: /home/worsch/railiance-enablement/registry/indexes/capabilities.yaml +- repo: railiance-fabric + count: 1 + index: /home/worsch/railiance-fabric/registry/indexes/capabilities.yaml +- repo: railiance-forge + count: 2 + index: /home/worsch/railiance-forge/registry/indexes/capabilities.yaml +- repo: railiance-infra + count: 1 + index: /home/worsch/railiance-infra/registry/indexes/capabilities.yaml +- repo: railiance-master + count: 1 + index: /home/worsch/railiance-master/registry/indexes/capabilities.yaml +- repo: railiance-platform + count: 1 + index: /home/worsch/railiance-platform/registry/indexes/capabilities.yaml +- repo: railiance-telemetry + count: 1 + index: /home/worsch/railiance-telemetry/registry/indexes/capabilities.yaml +- repo: rapp-openbao + count: 1 + index: /home/worsch/rapp-openbao/registry/indexes/capabilities.yaml +- repo: rapp-playwright + count: 1 + index: /home/worsch/rapp-playwright/registry/indexes/capabilities.yaml +- repo: rapp-policy-nexus + count: 1 + index: /home/worsch/rapp-policy-nexus/registry/indexes/capabilities.yaml +- repo: rapp-postgres + count: 1 + index: /home/worsch/rapp-postgres/registry/indexes/capabilities.yaml +- repo: rapp-telemetry + count: 1 + index: /home/worsch/rapp-telemetry/registry/indexes/capabilities.yaml +- repo: rapp-tenant-engine + count: 1 + index: /home/worsch/rapp-tenant-engine/registry/indexes/capabilities.yaml +- repo: rapp-user-engine + count: 1 + index: /home/worsch/rapp-user-engine/registry/indexes/capabilities.yaml +- repo: reef-railiance + count: 1 + index: /home/worsch/reef-railiance/registry/indexes/capabilities.yaml +- repo: rein-aharness + count: 1 + index: /home/worsch/rein-aharness/registry/indexes/capabilities.yaml +- repo: rein-openweights + count: 1 + index: /home/worsch/rein-openweights/registry/indexes/capabilities.yaml +- repo: repo-manager + count: 1 + index: /home/worsch/repo-manager/registry/indexes/capabilities.yaml +- repo: resource-control + count: 1 + index: /home/worsch/resource-control/registry/indexes/capabilities.yaml +- repo: reuse-surface + count: 3 + index: /home/worsch/reuse-surface/registry/indexes/capabilities.yaml +- repo: risk-nexus + count: 1 + index: /home/worsch/risk-nexus/registry/indexes/capabilities.yaml +- repo: role-engine + count: 1 + index: /home/worsch/role-engine/registry/indexes/capabilities.yaml +- repo: runbook-tutorials + count: 1 + index: /home/worsch/runbook-tutorials/registry/indexes/capabilities.yaml +- repo: sand-boxer + count: 1 + index: /home/worsch/sand-boxer/registry/indexes/capabilities.yaml +- repo: sbom-nexus + count: 1 + index: /home/worsch/sbom-nexus/registry/indexes/capabilities.yaml +- repo: secrets-engine + count: 1 + index: /home/worsch/secrets-engine/registry/indexes/capabilities.yaml +- repo: security-canon + count: 1 + index: /home/worsch/security-canon/registry/indexes/capabilities.yaml +- repo: state-hub + count: 2 + index: /home/worsch/state-hub/registry/indexes/capabilities.yaml +- repo: tenant-engine + count: 1 + index: /home/worsch/tenant-engine/registry/indexes/capabilities.yaml +- repo: the-custodian + count: 1 + index: /home/worsch/the-custodian/registry/indexes/capabilities.yaml +- repo: user-engine + count: 1 + index: /home/worsch/user-engine/registry/indexes/capabilities.yaml +- repo: whitehat-security + count: 1 + index: /home/worsch/whitehat-security/registry/indexes/capabilities.yaml +- repo: zone-engine + count: 1 + index: /home/worsch/zone-engine/registry/indexes/capabilities.yaml +- repo: rail-knative + count: 1 + index: /home/worsch/rail-knative/registry/indexes/capabilities.yaml +- repo: rapp-sbom-nexus + count: 1 + index: /home/worsch/rapp-sbom-nexus/registry/indexes/capabilities.yaml +capabilities: +- id: capability.activity.event-coordinate + name: Durable automation and bounded operations + summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime + sinks. + domain: helix_forge + status: draft + owner: activity-core + tags: + - activity + - coordination + - automation + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.activity.event-coordinate.md + consumption_modes: + - HTTP API + - source + source_repo: activity-core + source_index: /home/worsch/activity-core/registry/indexes/capabilities.yaml +- id: capability.agents.custodian-runtime-tooling + name: Generic agent runtime and repository tooling + summary: Agent runtime modules and repository classification tooling. + domain: custodian + status: draft + owner: the-custodian + tags: + - agents + - runtime + - classification + - security + - netkingdom + - framework-reuse + vector: D2 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.custodian-runtime-tooling.md + consumption_modes: + - CLI + - source + source_repo: the-custodian + source_index: /home/worsch/the-custodian/registry/indexes/capabilities.yaml +- id: capability.agents.performance-learning + name: Agent performance learning + summary: Capture sessions, curate patterns, distribute lessons and measure outcomes. + domain: infotech + status: draft + owner: agentic-resources + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.performance-learning.md + consumption_modes: + - CLI + - source + source_repo: agentic-resources + source_index: /home/worsch/agentic-resources/registry/indexes/capabilities.yaml +- id: capability.audit.event-retain + name: Independent audit custody + summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. + domain: infotech + status: draft + owner: audit-core + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C3 / R2 + path: registry/capabilities/capability.audit.event-retain.md + consumption_modes: + - HTTP API + - source + source_repo: audit-core + source_index: /home/worsch/audit-core/registry/indexes/capabilities.yaml +- id: capability.authorization.policy-evaluate + name: Policy evaluation and decision evidence + summary: Check, batch, list-allowed, explain, binding, lifetime and decision records. + domain: helix_forge + status: draft + owner: access-engine + tags: + - authorization + - policy + - flex-auth + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.authorization.policy-evaluate.md + consumption_modes: + - HTTP API + - source + source_repo: access-engine + source_index: /home/worsch/access-engine/registry/indexes/capabilities.yaml +- id: capability.coordination.cross-owner-work + name: Cross-owner coordination lifecycle + summary: Observation, lease, wake-up, checkpoint and receipt contracts/runtime. + domain: infotech + status: draft + owner: coordination-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.coordination.cross-owner-work.md + consumption_modes: + - CLI + - source + source_repo: coordination-engine + source_index: /home/worsch/coordination-engine/registry/indexes/capabilities.yaml +- id: capability.execution.openweight-rein + name: Bounded open-weight agent execution + summary: Tool loop, path guards, turn/budget limits and verified-commit result. + domain: infotech + status: draft + owner: rein-openweights + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.openweight-rein.md + consumption_modes: + - CLI + - source + source_repo: rein-openweights + source_index: /home/worsch/rein-openweights/registry/indexes/capabilities.yaml +- id: capability.execution.profile-harness + name: Profile-bound agent execution lifecycle + summary: Typed execution requests, profile/rein resolution, sandbox and cleanup + orchestration. + domain: infotech + status: draft + owner: glas-harness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.execution.profile-harness.md + consumption_modes: + - library + - CLI + source_repo: glas-harness + source_index: /home/worsch/glas-harness/registry/indexes/capabilities.yaml +- id: capability.execution.sandbox-provision + name: Sandbox establishment and lifecycle + summary: Profiles, extensions, provision, checkpoints, TTL teardown and telemetry. + domain: infotech + status: draft + owner: sand-boxer + tags: + - sandbox + - isolation + - provision + - e2e + - agentic + - execution + - profile + - security + - netkingdom + - framework-reuse + vector: D5 / A5 / C5 / R0 + path: registry/capabilities/execution.sandbox-provision.md + consumption_modes: + - containerized service + - CLI + source_repo: sand-boxer + source_index: /home/worsch/sand-boxer/registry/indexes/capabilities.yaml +- id: capability.execution.scheduled-agent-rein + name: Scheduled agent intake and harness routing + summary: Activity Core lease claim/heartbeat and Glas profile execution. + domain: infotech + status: draft + owner: rein-aharness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.scheduled-agent-rein.md + consumption_modes: + - CLI + - source + source_repo: rein-aharness + source_index: /home/worsch/rein-aharness/registry/indexes/capabilities.yaml +- id: capability.finance.security-budget-evidence + name: Budget and cost evidence for security operations + summary: Budget, commitment, spend attribution and planning-evidence consumption. + domain: infotech + status: draft + owner: fin-hub + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.finance.security-budget-evidence.md + consumption_modes: + - HTTP API + - source + source_repo: fin-hub + source_index: /home/worsch/fin-hub/registry/indexes/capabilities.yaml +- id: capability.iam.key-cape + name: OIDC identity and assurance + summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. + domain: infotech + status: draft + owner: key-cape + tags: + - iam + - oidc + - netkingdom + - security + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.iam.key-cape.md + consumption_modes: + - HTTP API + - source + source_repo: key-cape + source_index: /home/worsch/key-cape/registry/indexes/capabilities.yaml +- id: capability.identity.tenant-facts + name: Tenant lifecycle and guardrail facts + summary: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store. + domain: infotech + status: draft + owner: tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.identity.tenant-facts.md + consumption_modes: + - HTTP API + - source + source_repo: tenant-engine + source_index: /home/worsch/tenant-engine/registry/indexes/capabilities.yaml +- id: capability.identity.user-engine + name: User lifecycle and account journeys + summary: Accounts, identity links, membership, MFA and recovery portal, advisory + catalog. + domain: communication + status: draft + owner: user-engine + tags: + - identity + - user-management + - multi-tenant + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R0 + path: registry/capabilities/capability.identity.user-engine.md + consumption_modes: + - HTTP API + - source + source_repo: user-engine + source_index: /home/worsch/user-engine/registry/indexes/capabilities.yaml +- id: capability.infotech.canon-service + name: Shared semantic contracts and validation + summary: Markdown canon with library, CLI and read-only API. + domain: infotech + status: draft + owner: info-tech-canon + tags: + - canon + - infospace + - service + - security + - netkingdom + - framework-reuse + vector: D2 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.canon-service.md + consumption_modes: + - HTTP API + - source + source_repo: info-tech-canon + source_index: /home/worsch/info-tech-canon/registry/indexes/capabilities.yaml +- id: capability.infotech.headless-browser + name: Headless Browser Automation + summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright + 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; + managed Railiance admission is pending. Download the Python 3.10+ standalone client + from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then + `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, follow + the local container setup in the capability card or adapt its A2 source examples; + this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.' + vector: D3 / A5 / C2 / R2 + domain: infotech + status: reviewed + owner: reuse-surface + path: registry/capabilities/capability.infotech.headless-browser.md + tags: + - headless + - browser + - automation + - playwright + - chromium + - testing + - screenshots + - extraction + - firefox + - webkit + - selenium + - puppeteer + consumption_modes: + - informational + - source adaptation + - JavaScript library + - Python library + - cli + - service API + - container + source_repo: reuse-surface + source_index: /home/worsch/reuse-surface/registry/indexes/capabilities.yaml +- id: capability.infotech.issue-tracking + name: External issue tracker connector + summary: CLI and Python adapters for external issue systems. + domain: infotech + status: draft + owner: issue-core + tags: + - issue-tracking + - connector + - work-record + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.infotech.issue-tracking.md + consumption_modes: + - CLI + - source + source_repo: issue-core + source_index: /home/worsch/issue-core/registry/indexes/capabilities.yaml +- id: capability.infotech.runbook-tutorials + name: Guided administrative runbooks + summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. + domain: infotech + status: draft + owner: runbook-tutorials + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.infotech.runbook-tutorials.md + consumption_modes: + - CLI + - source + source_repo: runbook-tutorials + source_index: /home/worsch/runbook-tutorials/registry/indexes/capabilities.yaml +- id: capability.infotech.sbom-management + name: Dependency provenance and SBOM evidence + summary: Controlled archive ingest, immutable snapshots, freshness and license review. + domain: infotech + status: draft + owner: sbom-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.sbom-management.md + consumption_modes: + - HTTP API + - source + source_repo: sbom-nexus + source_index: /home/worsch/sbom-nexus/registry/indexes/capabilities.yaml +- id: capability.observability.security-signals + name: Security-relevant telemetry contracts and adapters + summary: Signal contract, platform adapters, report exporter and absence/alert rules. + domain: infotech + status: draft + owner: railiance-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.observability.security-signals.md + consumption_modes: + - CLI + - source + source_repo: railiance-telemetry + source_index: /home/worsch/railiance-telemetry/registry/indexes/capabilities.yaml +- id: capability.ops.tunnel-bridge + name: SSH tunnel lifecycle + summary: Named tunnels, reconnect, health and TTL-aware cert_command. + domain: infotech + status: draft + owner: ops-bridge + tags: + - ssh + - tunnel + - ops + - connectivity + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.ops.tunnel-bridge.md + consumption_modes: + - CLI + - source + source_repo: ops-bridge + source_index: /home/worsch/ops-bridge/registry/indexes/capabilities.yaml +- id: capability.organization.role-catalog + name: Organizational role definitions + summary: Versioned documentation catalog. + domain: infotech + status: draft + owner: role-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.organization.role-catalog.md + consumption_modes: + - informational + source_repo: role-engine + source_index: /home/worsch/role-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.bootstrap-sequencing + name: Bootstrap sequencing contracts + summary: Bare-VM to estate sequence and handoff contract. + domain: infotech + status: draft + owner: railiance-bootstrap + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.bootstrap-sequencing.md + consumption_modes: + - informational + source_repo: railiance-bootstrap + source_index: /home/worsch/railiance-bootstrap/registry/indexes/capabilities.yaml +- id: capability.railiance.browser-verification + name: Managed browser verification pilot + summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts. + domain: infotech + status: draft + owner: rapp-playwright + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.railiance.browser-verification.md + consumption_modes: + - HTTP API + - source + source_repo: rapp-playwright + source_index: /home/worsch/rapp-playwright/registry/indexes/capabilities.yaml +- id: capability.railiance.ci-enablement + name: Developer delivery and CI templates + summary: Reusable CI workflows, build and deployment patterns. + domain: financials + status: draft + owner: railiance-enablement + tags: + - railiance + - ci-cd + - developer-enablement + - forgejo + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.ci-enablement.md + consumption_modes: + - CLI + - source + source_repo: railiance-enablement + source_index: /home/worsch/railiance-enablement/registry/indexes/capabilities.yaml +- id: capability.railiance.cluster-bootstrap + name: Kubernetes runtime and cluster controls + summary: k3s, ingress, CNI, operators and kubeconfig/runtime checks. + domain: financials + status: draft + owner: railiance-cluster + tags: + - railiance + - kubernetes + - iac + - bootstrap + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.cluster-bootstrap.md + consumption_modes: + - CLI + - source + source_repo: railiance-cluster + source_index: /home/worsch/railiance-cluster/registry/indexes/capabilities.yaml +- id: capability.railiance.fabric-graph + name: Infrastructure ownership and dependency graph + summary: Schemas, validation, graph queries and State Hub exports. + domain: financials + status: draft + owner: railiance-fabric + tags: + - railiance + - graph + - ownership + - discovery + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.fabric-graph.md + consumption_modes: + - CLI + - source + source_repo: railiance-fabric + source_index: /home/worsch/railiance-fabric/registry/indexes/capabilities.yaml +- id: capability.railiance.forge-infrastructure + name: Source forge, registries and runner substrate + summary: Forgejo operation, package registries and runner lifecycle. + domain: financials + status: draft + owner: railiance-forge + tags: + - railiance + - forgejo + - forge + - ci-runner + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.forge-infrastructure.md + consumption_modes: + - CLI + - source + source_repo: railiance-forge + source_index: /home/worsch/railiance-forge/registry/indexes/capabilities.yaml +- id: capability.railiance.infra-provisioning + name: Host convergence and security baseline + summary: Ansible inventory, firewall, SSH bootstrap and baseline verification. + domain: financials + status: draft + owner: railiance-infra + tags: + - railiance + - terraform + - ansible + - infrastructure + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.infra-provisioning.md + consumption_modes: + - CLI + - source + source_repo: railiance-infra + source_index: /home/worsch/railiance-infra/registry/indexes/capabilities.yaml +- id: capability.railiance.knative-rail + name: Knative workload lifecycle + summary: Derived rail for activation, revisions, traffic, scaling and rollback. + domain: infotech + status: draft + owner: rail-knative + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.knative-rail.md + consumption_modes: + - CLI + - source + source_repo: rail-knative + source_index: /home/worsch/rail-knative/registry/indexes/capabilities.yaml +- id: capability.railiance.kubernetes-rail + name: Generic Kubernetes workload lifecycle + summary: Workload declaration, rollout, observe, promote and rollback surfaces. + domain: infotech + status: draft + owner: rail-kubernetes + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.kubernetes-rail.md + consumption_modes: + - CLI + - source + source_repo: rail-kubernetes + source_index: /home/worsch/rail-kubernetes/registry/indexes/capabilities.yaml +- id: capability.railiance.openbao-package + name: Managed OpenBao deployment package + summary: Helm values, package deploy/status/smoke/rollback and custody boundary. + domain: infotech + status: draft + owner: rapp-openbao + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.openbao-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-openbao + source_index: /home/worsch/rapp-openbao/registry/indexes/capabilities.yaml +- id: capability.railiance.platform-services + name: Secret custody and platform data services + summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts. + domain: financials + status: draft + owner: railiance-platform + tags: + - railiance + - platform + - secrets + - postgres + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.platform-services.md + consumption_modes: + - CLI + - source + source_repo: railiance-platform + source_index: /home/worsch/railiance-platform/registry/indexes/capabilities.yaml +- id: capability.railiance.policy-publication-package + name: Policy publication runtime package + summary: Immutable image, non-root/read-only runtime and approved TLS exposure. + domain: infotech + status: draft + owner: rapp-policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.policy-publication-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-policy-nexus + source_index: /home/worsch/rapp-policy-nexus/registry/indexes/capabilities.yaml +- id: capability.railiance.postgres-isolation-recovery + name: Database isolation and recovery package + summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures. + domain: infotech + status: draft + owner: rapp-postgres + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.postgres-isolation-recovery.md + consumption_modes: + - CLI + - source + source_repo: rapp-postgres + source_index: /home/worsch/rapp-postgres/registry/indexes/capabilities.yaml +- id: capability.railiance.sbom-runtime-package + name: Private SBOM runtime and dynamic database delivery + summary: Immutable deployment, private network policy, dynamic database leases and + migration/rollback. + domain: infotech + status: draft + owner: rapp-sbom-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.sbom-runtime-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-sbom-nexus + source_index: /home/worsch/rapp-sbom-nexus/registry/indexes/capabilities.yaml +- id: capability.railiance.security-consumption-contracts + name: Platform security consumption architecture + summary: Rail/rapp/reef boundaries, exposure and security consumption contracts. + domain: infotech + status: draft + owner: railiance-master + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.security-consumption-contracts.md + consumption_modes: + - informational + source_repo: railiance-master + source_index: /home/worsch/railiance-master/registry/indexes/capabilities.yaml +- id: capability.railiance.substrate-bindings + name: Substrate topology and bindings + summary: Grouped home-reef identity, topology and placement declarations. + domain: infotech + status: draft + owner: reef-railiance + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.substrate-bindings.md + consumption_modes: + - informational + source_repo: reef-railiance + source_index: /home/worsch/reef-railiance/registry/indexes/capabilities.yaml +- id: capability.railiance.telemetry-package + name: Private monitoring package + summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence. + domain: infotech + status: draft + owner: rapp-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.telemetry-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-telemetry + source_index: /home/worsch/rapp-telemetry/registry/indexes/capabilities.yaml +- id: capability.railiance.tenant-engine-package + name: Tenant Engine runtime package + summary: Package declaration, smoke and rollback. + domain: infotech + status: draft + owner: rapp-tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.tenant-engine-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-tenant-engine + source_index: /home/worsch/rapp-tenant-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.user-engine-package + name: User Engine runtime package + summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. + domain: infotech + status: draft + owner: rapp-user-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.user-engine-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-user-engine + source_index: /home/worsch/rapp-user-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.workload-deployment-tooling + name: Workload release configuration and guards + summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback. + domain: financials + status: draft + owner: railiance-apps + tags: + - railiance + - kubernetes + - helm + - deployment + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.railiance.workload-deployment-tooling.md + consumption_modes: + - CLI + - source + source_repo: railiance-apps + source_index: /home/worsch/railiance-apps/registry/indexes/capabilities.yaml +- id: capability.registry.register + name: Capability registry and federation + summary: Owner Markdown entries, indexes, federation hub and planning queries. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - governance + - meta + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C2 / R3 + path: registry/capabilities/capability.registry.register.md + consumption_modes: + - library + - CLI + source_repo: reuse-surface + source_index: /home/worsch/reuse-surface/registry/indexes/capabilities.yaml +- id: capability.registry.validate + name: Capability registry validation + summary: Schema, index consistency and relation checks. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - validation + - cli + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R3 + path: registry/capabilities/capability.registry.validate.md + consumption_modes: + - library + - CLI + source_repo: reuse-surface + source_index: /home/worsch/reuse-surface/registry/indexes/capabilities.yaml +- id: capability.resources.security-capacity + name: Capacity and recovery resource planning + summary: Provider-neutral inventory, procurement evidence and optimization reports. + domain: infotech + status: draft + owner: resource-control + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.resources.security-capacity.md + consumption_modes: + - CLI + - source + source_repo: resource-control + source_index: /home/worsch/resource-control/registry/indexes/capabilities.yaml +- id: capability.security.access-routing + name: Credential routing and contained access + summary: warden route and access catalog; exact lane conduit and secret-exec routing. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.security.access-routing.md + consumption_modes: + - library + - CLI + source_repo: ops-warden + source_index: /home/worsch/ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.adversarial-evidence + name: Authorized adversarial evidence harness + summary: Offline ASM and tenancy calibrations and engagement admission. + domain: infotech + status: draft + owner: whitehat-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.adversarial-evidence.md + consumption_modes: + - CLI + - source + source_repo: whitehat-security + source_index: /home/worsch/whitehat-security/registry/indexes/capabilities.yaml +- id: capability.security.agent-knowledge + name: Verified security orientation for agents + summary: Versioned source-pinned cards, read-only CLI, provider adapters and sealed + exports. + domain: infotech + status: draft + owner: emergent-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.agent-knowledge.md + consumption_modes: + - CLI + - source + source_repo: emergent-security + source_index: /home/worsch/emergent-security/registry/indexes/capabilities.yaml +- id: capability.security.approval-lifecycle + name: Bound approval lifecycle + summary: Authenticated issue, claim, revoke, supersede and atomic consume API with + outbox. + domain: infotech + status: draft + owner: approval-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.approval-lifecycle.md + consumption_modes: + - HTTP API + - source + source_repo: approval-engine + source_index: /home/worsch/approval-engine/registry/indexes/capabilities.yaml +- id: capability.security.bootstrap-recovery + name: Guarded bootstrap and recovery preparation + summary: Local identity, bootstrap console, encrypted custody handoff and caller + tools. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.bootstrap-recovery.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.case-contracts + name: Security case types and instance validation + summary: Versioned types, cases and schema validation. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-contracts.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.case-follow-through + name: Security case operational follow-through + summary: KnownSecurityCase route, plan and operational receipts. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-follow-through.md + consumption_modes: + - CLI + - source + source_repo: ops-warden + source_index: /home/worsch/ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.credential-lifecycle + name: Cataloged credential lifecycle + summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke. + domain: infotech + status: draft + owner: secrets-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.credential-lifecycle.md + consumption_modes: + - CLI + - source + source_repo: secrets-engine + source_index: /home/worsch/secrets-engine/registry/indexes/capabilities.yaml +- id: capability.security.doctrine-review + name: Security doctrine and architecture review + summary: Layer rules, authority context, ASM criteria and interpretations. + domain: infotech + status: draft + owner: gate-house + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.doctrine-review.md + consumption_modes: + - informational + source_repo: gate-house + source_index: /home/worsch/gate-house/registry/indexes/capabilities.yaml +- id: capability.security.emission-profile + name: Security emission cadence validation + summary: Security profile over generic emission contracts and validator. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.emission-profile.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.forge-secret-prevention + name: Independent introduced-history secret prevention + summary: Pinned receive adapter, lifecycle template and fail-closed scan. + domain: infotech + status: draft + owner: railiance-forge + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.forge-secret-prevention.md + consumption_modes: + - CLI + - source + source_repo: railiance-forge + source_index: /home/worsch/railiance-forge/registry/indexes/capabilities.yaml +- id: capability.security.human-decision-workspace + name: Human security decision presentation and disposition + summary: Headless lifecycle and browser workspace with exact native approval references. + domain: infotech + status: draft + owner: informed-decision + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.human-decision-workspace.md + consumption_modes: + - HTTP API + - source + source_repo: informed-decision + source_index: /home/worsch/informed-decision/registry/indexes/capabilities.yaml +- id: capability.security.iam-tooling-suite + name: NetKingdom security architecture and conformance tooling + summary: Versioned IAM, layer, tenancy and credential contracts plus validators. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - iam + - kubernetes + - conformance + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.security.iam-tooling-suite.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.maturity-claims + name: Evidence-based maturity claims and gap register + summary: SQLite library and CLI for ladders, evidence expiry, compute, explain and + stance inventory. + domain: infotech + status: draft + owner: maturity-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.maturity-claims.md + consumption_modes: + - CLI + - source + source_repo: maturity-engine + source_index: /home/worsch/maturity-engine/registry/indexes/capabilities.yaml +- id: capability.security.policy-publication + name: Policy publication with source provenance + summary: Generated immutable publication, source currency and stable policy URLs. + domain: infotech + status: draft + owner: policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.policy-publication.md + consumption_modes: + - CLI + - source + source_repo: policy-nexus + source_index: /home/worsch/policy-nexus/registry/indexes/capabilities.yaml +- id: capability.security.posture-assessment + name: Security posture assessment and response proposals + summary: Normalized observation evaluator, cadence checks and secret-use snapshot + adapter. + domain: infotech + status: draft + owner: kings-guard + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-assessment.md + consumption_modes: + - CLI + - source + source_repo: kings-guard + source_index: /home/worsch/kings-guard/registry/indexes/capabilities.yaml +- id: capability.security.posture-feedback + name: Deterministic posture feedback + summary: CLI evaluates evidence age and posture into owner-routed findings. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-feedback.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.practice-canon + name: Security practice and authority vocabulary + summary: Versioned SEC-DSM and Mode of Authority documents. + domain: infotech + status: draft + owner: security-canon + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.practice-canon.md + consumption_modes: + - informational + source_repo: security-canon + source_index: /home/worsch/security-canon/registry/indexes/capabilities.yaml +- id: capability.security.repository-secret-prevention + name: Repository metadata and staged-secret prevention + summary: Repository observation plus pinned staged-blob scanner and hook integration. + domain: infotech + status: draft + owner: repo-manager + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.repository-secret-prevention.md + consumption_modes: + - CLI + - source + source_repo: repo-manager + source_index: /home/worsch/repo-manager/registry/indexes/capabilities.yaml +- id: capability.security.risk-register + name: Security risk and exception review register + summary: Markdown findings and Python review, verification and due-work reports. + domain: infotech + status: draft + owner: risk-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.risk-register.md + consumption_modes: + - CLI + - source + source_repo: risk-nexus + source_index: /home/worsch/risk-nexus/registry/indexes/capabilities.yaml +- id: capability.security.scenario-compose + name: Deterministic security scenario composition + summary: CLI selects pinned providers and orders trust transitions. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.scenario-compose.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.ssh-certificate-issuance + name: Decision-bound SSH certificates + summary: warden sign with local and OpenBao backends and adm/agt/atm actors. + domain: helix_forge + status: draft + owner: ops-warden + tags: + - ssh + - certificate + - ca + - ops-warden + - openbao + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R2 + path: registry/capabilities/capability.security.ssh-certificate-issuance.md + consumption_modes: + - library + - CLI + source_repo: ops-warden + source_index: /home/worsch/ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.structure-construction + name: Reviewed security structure construction + summary: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply. + domain: infotech + status: draft + owner: ops-mason + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.structure-construction.md + consumption_modes: + - CLI + - source + source_repo: ops-mason + source_index: /home/worsch/ops-mason/registry/indexes/capabilities.yaml +- id: capability.security.zone-reference + name: Zone membership reference conformance + summary: Offline resolution, exception and lineage checks. + domain: infotech + status: draft + owner: zone-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.zone-reference.md + consumption_modes: + - CLI + - source + source_repo: zone-engine + source_index: /home/worsch/zone-engine/registry/indexes/capabilities.yaml +- id: capability.statehub.progress-log + name: Progress and work evidence indexing + summary: REST progress and task evidence references. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - progress + - coordination + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R3 + path: registry/capabilities/capability.statehub.progress-log.md + consumption_modes: + - HTTP API + - source + source_repo: state-hub + source_index: /home/worsch/state-hub/registry/indexes/capabilities.yaml +- id: capability.statehub.workstream-coordinate + name: Cross-repository work tracking + summary: File-derived workplans, tasks, dependencies, decisions and coordination + views. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - coordination + - workplans + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R2 + path: registry/capabilities/capability.statehub.workstream-coordinate.md + consumption_modes: + - HTTP API + - source + source_repo: state-hub + source_index: /home/worsch/state-hub/registry/indexes/capabilities.yaml diff --git a/docs/assessments/netkingdom-2026-10-14/federated-staged.yaml b/docs/assessments/netkingdom-2026-10-14/federated-staged.yaml new file mode 100644 index 00000000..e5921301 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/federated-staged.yaml @@ -0,0 +1,1461 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +collision_policy: warn +sources: +- repo: access-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml +- repo: activity-core + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml +- repo: agentic-resources + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml +- repo: approval-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml +- repo: audit-core + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml +- repo: coordination-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml +- repo: emergent-security + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml +- repo: fin-hub + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml +- repo: gate-house + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml +- repo: glas-harness + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml +- repo: info-tech-canon + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml +- repo: informed-decision + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml +- repo: issue-core + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml +- repo: key-cape + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml +- repo: kings-guard + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml +- repo: maturity-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml +- repo: net-kingdom + count: 6 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml +- repo: ops-bridge + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml +- repo: ops-mason + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml +- repo: ops-warden + count: 3 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml +- repo: policy-nexus + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml +- repo: rail-kubernetes + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml +- repo: railiance-apps + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml +- repo: railiance-bootstrap + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml +- repo: railiance-cluster + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml +- repo: railiance-enablement + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml +- repo: railiance-fabric + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml +- repo: railiance-forge + count: 2 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml +- repo: railiance-infra + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml +- repo: railiance-master + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml +- repo: railiance-platform + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml +- repo: railiance-telemetry + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml +- repo: rapp-openbao + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml +- repo: rapp-playwright + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml +- repo: rapp-policy-nexus + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml +- repo: rapp-postgres + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml +- repo: rapp-telemetry + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml +- repo: rapp-tenant-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml +- repo: rapp-user-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml +- repo: reef-railiance + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml +- repo: rein-aharness + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml +- repo: rein-openweights + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml +- repo: repo-manager + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml +- repo: resource-control + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml +- repo: reuse-surface + count: 3 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml +- repo: risk-nexus + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml +- repo: role-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml +- repo: runbook-tutorials + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml +- repo: sand-boxer + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml +- repo: sbom-nexus + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml +- repo: secrets-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml +- repo: security-canon + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml +- repo: state-hub + count: 2 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml +- repo: tenant-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml +- repo: the-custodian + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml +- repo: user-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml +- repo: whitehat-security + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml +- repo: zone-engine + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml +capabilities: +- id: capability.activity.event-coordinate + name: Durable automation and bounded operations + summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime + sinks. + domain: helix_forge + status: draft + owner: activity-core + tags: + - activity + - coordination + - automation + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.activity.event-coordinate.md + consumption_modes: + - HTTP API + - source + source_repo: activity-core + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml +- id: capability.agents.custodian-runtime-tooling + name: Generic agent runtime and repository tooling + summary: Agent runtime modules and repository classification tooling. + domain: custodian + status: draft + owner: the-custodian + tags: + - agents + - runtime + - classification + - security + - netkingdom + - framework-reuse + vector: D2 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.custodian-runtime-tooling.md + consumption_modes: + - CLI + - source + source_repo: the-custodian + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml +- id: capability.agents.performance-learning + name: Agent performance learning + summary: Capture sessions, curate patterns, distribute lessons and measure outcomes. + domain: infotech + status: draft + owner: agentic-resources + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.performance-learning.md + consumption_modes: + - CLI + - source + source_repo: agentic-resources + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml +- id: capability.audit.event-retain + name: Independent audit custody + summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. + domain: infotech + status: draft + owner: audit-core + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C3 / R2 + path: registry/capabilities/capability.audit.event-retain.md + consumption_modes: + - HTTP API + - source + source_repo: audit-core + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml +- id: capability.authorization.policy-evaluate + name: Policy evaluation and decision evidence + summary: Check, batch, list-allowed, explain, binding, lifetime and decision records. + domain: helix_forge + status: draft + owner: access-engine + tags: + - authorization + - policy + - flex-auth + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.authorization.policy-evaluate.md + consumption_modes: + - HTTP API + - source + source_repo: access-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml +- id: capability.coordination.cross-owner-work + name: Cross-owner coordination lifecycle + summary: Observation, lease, wake-up, checkpoint and receipt contracts/runtime. + domain: infotech + status: draft + owner: coordination-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.coordination.cross-owner-work.md + consumption_modes: + - CLI + - source + source_repo: coordination-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml +- id: capability.execution.openweight-rein + name: Bounded open-weight agent execution + summary: Tool loop, path guards, turn/budget limits and verified-commit result. + domain: infotech + status: draft + owner: rein-openweights + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.openweight-rein.md + consumption_modes: + - CLI + - source + source_repo: rein-openweights + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml +- id: capability.execution.profile-harness + name: Profile-bound agent execution lifecycle + summary: Typed execution requests, profile/rein resolution, sandbox and cleanup + orchestration. + domain: infotech + status: draft + owner: glas-harness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.execution.profile-harness.md + consumption_modes: + - library + - CLI + source_repo: glas-harness + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml +- id: capability.execution.sandbox-provision + name: Sandbox establishment and lifecycle + summary: Profiles, extensions, provision, checkpoints, TTL teardown and telemetry. + domain: infotech + status: draft + owner: sand-boxer + tags: + - sandbox + - isolation + - provision + - e2e + - agentic + - execution + - profile + - security + - netkingdom + - framework-reuse + vector: D5 / A5 / C5 / R0 + path: registry/capabilities/execution.sandbox-provision.md + consumption_modes: + - containerized service + - CLI + source_repo: sand-boxer + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml +- id: capability.execution.scheduled-agent-rein + name: Scheduled agent intake and harness routing + summary: Activity Core lease claim/heartbeat and Glas profile execution. + domain: infotech + status: draft + owner: rein-aharness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.scheduled-agent-rein.md + consumption_modes: + - CLI + - source + source_repo: rein-aharness + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml +- id: capability.finance.security-budget-evidence + name: Budget and cost evidence for security operations + summary: Budget, commitment, spend attribution and planning-evidence consumption. + domain: infotech + status: draft + owner: fin-hub + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.finance.security-budget-evidence.md + consumption_modes: + - HTTP API + - source + source_repo: fin-hub + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml +- id: capability.iam.key-cape + name: OIDC identity and assurance + summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. + domain: infotech + status: draft + owner: key-cape + tags: + - iam + - oidc + - netkingdom + - security + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.iam.key-cape.md + consumption_modes: + - HTTP API + - source + source_repo: key-cape + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml +- id: capability.identity.tenant-facts + name: Tenant lifecycle and guardrail facts + summary: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store. + domain: infotech + status: draft + owner: tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.identity.tenant-facts.md + consumption_modes: + - HTTP API + - source + source_repo: tenant-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml +- id: capability.identity.user-engine + name: User lifecycle and account journeys + summary: Accounts, identity links, membership, MFA and recovery portal, advisory + catalog. + domain: communication + status: draft + owner: user-engine + tags: + - identity + - user-management + - multi-tenant + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R0 + path: registry/capabilities/capability.identity.user-engine.md + consumption_modes: + - HTTP API + - source + source_repo: user-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml +- id: capability.infotech.canon-service + name: Shared semantic contracts and validation + summary: Markdown canon with library, CLI and read-only API. + domain: infotech + status: draft + owner: info-tech-canon + tags: + - canon + - infospace + - service + - security + - netkingdom + - framework-reuse + vector: D2 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.canon-service.md + consumption_modes: + - HTTP API + - source + source_repo: info-tech-canon + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml +- id: capability.infotech.headless-browser + name: Headless Browser Automation + summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright + 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; + managed Railiance admission is pending. Download the Python 3.10+ standalone client + from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then + `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, follow + the local container setup in the capability card or adapt its A2 source examples; + this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.' + vector: D3 / A5 / C2 / R2 + domain: infotech + status: reviewed + owner: reuse-surface + path: registry/capabilities/capability.infotech.headless-browser.md + tags: + - headless + - browser + - automation + - playwright + - chromium + - testing + - screenshots + - extraction + - firefox + - webkit + - selenium + - puppeteer + consumption_modes: + - informational + - source adaptation + - JavaScript library + - Python library + - cli + - service API + - container + source_repo: reuse-surface + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml +- id: capability.infotech.issue-tracking + name: External issue tracker connector + summary: CLI and Python adapters for external issue systems. + domain: infotech + status: draft + owner: issue-core + tags: + - issue-tracking + - connector + - work-record + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.infotech.issue-tracking.md + consumption_modes: + - CLI + - source + source_repo: issue-core + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml +- id: capability.infotech.runbook-tutorials + name: Guided administrative runbooks + summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. + domain: infotech + status: draft + owner: runbook-tutorials + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.infotech.runbook-tutorials.md + consumption_modes: + - CLI + - source + source_repo: runbook-tutorials + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml +- id: capability.infotech.sbom-management + name: Dependency provenance and SBOM evidence + summary: Controlled archive ingest, immutable snapshots, freshness and license review. + domain: infotech + status: draft + owner: sbom-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.sbom-management.md + consumption_modes: + - HTTP API + - source + source_repo: sbom-nexus + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml +- id: capability.observability.security-signals + name: Security-relevant telemetry contracts and adapters + summary: Signal contract, platform adapters, report exporter and absence/alert rules. + domain: infotech + status: draft + owner: railiance-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.observability.security-signals.md + consumption_modes: + - CLI + - source + source_repo: railiance-telemetry + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml +- id: capability.ops.tunnel-bridge + name: SSH tunnel lifecycle + summary: Named tunnels, reconnect, health and TTL-aware cert_command. + domain: infotech + status: draft + owner: ops-bridge + tags: + - ssh + - tunnel + - ops + - connectivity + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.ops.tunnel-bridge.md + consumption_modes: + - CLI + - source + source_repo: ops-bridge + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml +- id: capability.organization.role-catalog + name: Organizational role definitions + summary: Versioned documentation catalog. + domain: infotech + status: draft + owner: role-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.organization.role-catalog.md + consumption_modes: + - informational + source_repo: role-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.bootstrap-sequencing + name: Bootstrap sequencing contracts + summary: Bare-VM to estate sequence and handoff contract. + domain: infotech + status: draft + owner: railiance-bootstrap + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.bootstrap-sequencing.md + consumption_modes: + - informational + source_repo: railiance-bootstrap + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml +- id: capability.railiance.browser-verification + name: Managed browser verification pilot + summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts. + domain: infotech + status: draft + owner: rapp-playwright + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.railiance.browser-verification.md + consumption_modes: + - HTTP API + - source + source_repo: rapp-playwright + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml +- id: capability.railiance.ci-enablement + name: Developer delivery and CI templates + summary: Reusable CI workflows, build and deployment patterns. + domain: financials + status: draft + owner: railiance-enablement + tags: + - railiance + - ci-cd + - developer-enablement + - forgejo + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.ci-enablement.md + consumption_modes: + - CLI + - source + source_repo: railiance-enablement + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml +- id: capability.railiance.cluster-bootstrap + name: Kubernetes runtime and cluster controls + summary: k3s, ingress, CNI, operators and kubeconfig/runtime checks. + domain: financials + status: draft + owner: railiance-cluster + tags: + - railiance + - kubernetes + - iac + - bootstrap + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.cluster-bootstrap.md + consumption_modes: + - CLI + - source + source_repo: railiance-cluster + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml +- id: capability.railiance.fabric-graph + name: Infrastructure ownership and dependency graph + summary: Schemas, validation, graph queries and State Hub exports. + domain: financials + status: draft + owner: railiance-fabric + tags: + - railiance + - graph + - ownership + - discovery + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.fabric-graph.md + consumption_modes: + - CLI + - source + source_repo: railiance-fabric + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml +- id: capability.railiance.forge-infrastructure + name: Source forge, registries and runner substrate + summary: Forgejo operation, package registries and runner lifecycle. + domain: financials + status: draft + owner: railiance-forge + tags: + - railiance + - forgejo + - forge + - ci-runner + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.forge-infrastructure.md + consumption_modes: + - CLI + - source + source_repo: railiance-forge + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml +- id: capability.railiance.infra-provisioning + name: Host convergence and security baseline + summary: Ansible inventory, firewall, SSH bootstrap and baseline verification. + domain: financials + status: draft + owner: railiance-infra + tags: + - railiance + - terraform + - ansible + - infrastructure + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.infra-provisioning.md + consumption_modes: + - CLI + - source + source_repo: railiance-infra + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml +- id: capability.railiance.kubernetes-rail + name: Generic Kubernetes workload lifecycle + summary: Workload declaration, rollout, observe, promote and rollback surfaces. + domain: infotech + status: draft + owner: rail-kubernetes + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.kubernetes-rail.md + consumption_modes: + - CLI + - source + source_repo: rail-kubernetes + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml +- id: capability.railiance.openbao-package + name: Managed OpenBao deployment package + summary: Helm values, package deploy/status/smoke/rollback and custody boundary. + domain: infotech + status: draft + owner: rapp-openbao + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.openbao-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-openbao + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml +- id: capability.railiance.platform-services + name: Secret custody and platform data services + summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts. + domain: financials + status: draft + owner: railiance-platform + tags: + - railiance + - platform + - secrets + - postgres + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.platform-services.md + consumption_modes: + - CLI + - source + source_repo: railiance-platform + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml +- id: capability.railiance.policy-publication-package + name: Policy publication runtime package + summary: Immutable image, non-root/read-only runtime and approved TLS exposure. + domain: infotech + status: draft + owner: rapp-policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.policy-publication-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-policy-nexus + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml +- id: capability.railiance.postgres-isolation-recovery + name: Database isolation and recovery package + summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures. + domain: infotech + status: draft + owner: rapp-postgres + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.postgres-isolation-recovery.md + consumption_modes: + - CLI + - source + source_repo: rapp-postgres + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml +- id: capability.railiance.security-consumption-contracts + name: Platform security consumption architecture + summary: Rail/rapp/reef boundaries, exposure and security consumption contracts. + domain: infotech + status: draft + owner: railiance-master + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.security-consumption-contracts.md + consumption_modes: + - informational + source_repo: railiance-master + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml +- id: capability.railiance.substrate-bindings + name: Substrate topology and bindings + summary: Grouped home-reef identity, topology and placement declarations. + domain: infotech + status: draft + owner: reef-railiance + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.substrate-bindings.md + consumption_modes: + - informational + source_repo: reef-railiance + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml +- id: capability.railiance.telemetry-package + name: Private monitoring package + summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence. + domain: infotech + status: draft + owner: rapp-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.telemetry-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-telemetry + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml +- id: capability.railiance.tenant-engine-package + name: Tenant Engine runtime package + summary: Package declaration, smoke and rollback. + domain: infotech + status: draft + owner: rapp-tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.tenant-engine-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-tenant-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.user-engine-package + name: User Engine runtime package + summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. + domain: infotech + status: draft + owner: rapp-user-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.user-engine-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-user-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.workload-deployment-tooling + name: Workload release configuration and guards + summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback. + domain: financials + status: draft + owner: railiance-apps + tags: + - railiance + - kubernetes + - helm + - deployment + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.railiance.workload-deployment-tooling.md + consumption_modes: + - CLI + - source + source_repo: railiance-apps + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml +- id: capability.registry.register + name: Capability registry and federation + summary: Owner Markdown entries, indexes, federation hub and planning queries. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - governance + - meta + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C2 / R3 + path: registry/capabilities/capability.registry.register.md + consumption_modes: + - library + - CLI + source_repo: reuse-surface + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml +- id: capability.registry.validate + name: Capability registry validation + summary: Schema, index consistency and relation checks. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - validation + - cli + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R3 + path: registry/capabilities/capability.registry.validate.md + consumption_modes: + - library + - CLI + source_repo: reuse-surface + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml +- id: capability.resources.security-capacity + name: Capacity and recovery resource planning + summary: Provider-neutral inventory, procurement evidence and optimization reports. + domain: infotech + status: draft + owner: resource-control + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.resources.security-capacity.md + consumption_modes: + - CLI + - source + source_repo: resource-control + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml +- id: capability.security.access-routing + name: Credential routing and contained access + summary: warden route and access catalog; exact lane conduit and secret-exec routing. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.security.access-routing.md + consumption_modes: + - library + - CLI + source_repo: ops-warden + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.adversarial-evidence + name: Authorized adversarial evidence harness + summary: Offline ASM and tenancy calibrations and engagement admission. + domain: infotech + status: draft + owner: whitehat-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.adversarial-evidence.md + consumption_modes: + - CLI + - source + source_repo: whitehat-security + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml +- id: capability.security.agent-knowledge + name: Verified security orientation for agents + summary: Versioned source-pinned cards, read-only CLI, provider adapters and sealed + exports. + domain: infotech + status: draft + owner: emergent-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.agent-knowledge.md + consumption_modes: + - CLI + - source + source_repo: emergent-security + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml +- id: capability.security.approval-lifecycle + name: Bound approval lifecycle + summary: Authenticated issue, claim, revoke, supersede and atomic consume API with + outbox. + domain: infotech + status: draft + owner: approval-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.approval-lifecycle.md + consumption_modes: + - HTTP API + - source + source_repo: approval-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml +- id: capability.security.bootstrap-recovery + name: Guarded bootstrap and recovery preparation + summary: Local identity, bootstrap console, encrypted custody handoff and caller + tools. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.bootstrap-recovery.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.case-contracts + name: Security case types and instance validation + summary: Versioned types, cases and schema validation. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-contracts.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.case-follow-through + name: Security case operational follow-through + summary: KnownSecurityCase route, plan and operational receipts. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-follow-through.md + consumption_modes: + - CLI + - source + source_repo: ops-warden + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.credential-lifecycle + name: Cataloged credential lifecycle + summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke. + domain: infotech + status: draft + owner: secrets-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.credential-lifecycle.md + consumption_modes: + - CLI + - source + source_repo: secrets-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml +- id: capability.security.doctrine-review + name: Security doctrine and architecture review + summary: Layer rules, authority context, ASM criteria and interpretations. + domain: infotech + status: draft + owner: gate-house + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.doctrine-review.md + consumption_modes: + - informational + source_repo: gate-house + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml +- id: capability.security.emission-profile + name: Security emission cadence validation + summary: Security profile over generic emission contracts and validator. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.emission-profile.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.forge-secret-prevention + name: Independent introduced-history secret prevention + summary: Pinned receive adapter, lifecycle template and fail-closed scan. + domain: infotech + status: draft + owner: railiance-forge + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.forge-secret-prevention.md + consumption_modes: + - CLI + - source + source_repo: railiance-forge + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml +- id: capability.security.human-decision-workspace + name: Human security decision presentation and disposition + summary: Headless lifecycle and browser workspace with exact native approval references. + domain: infotech + status: draft + owner: informed-decision + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.human-decision-workspace.md + consumption_modes: + - HTTP API + - source + source_repo: informed-decision + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml +- id: capability.security.iam-tooling-suite + name: NetKingdom security architecture and conformance tooling + summary: Versioned IAM, layer, tenancy and credential contracts plus validators. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - iam + - kubernetes + - conformance + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.security.iam-tooling-suite.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.maturity-claims + name: Evidence-based maturity claims and gap register + summary: SQLite library and CLI for ladders, evidence expiry, compute, explain and + stance inventory. + domain: infotech + status: draft + owner: maturity-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.maturity-claims.md + consumption_modes: + - CLI + - source + source_repo: maturity-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml +- id: capability.security.policy-publication + name: Policy publication with source provenance + summary: Generated immutable publication, source currency and stable policy URLs. + domain: infotech + status: draft + owner: policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.policy-publication.md + consumption_modes: + - CLI + - source + source_repo: policy-nexus + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml +- id: capability.security.posture-assessment + name: Security posture assessment and response proposals + summary: Normalized observation evaluator, cadence checks and secret-use snapshot + adapter. + domain: infotech + status: draft + owner: kings-guard + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-assessment.md + consumption_modes: + - CLI + - source + source_repo: kings-guard + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml +- id: capability.security.posture-feedback + name: Deterministic posture feedback + summary: CLI evaluates evidence age and posture into owner-routed findings. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-feedback.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.practice-canon + name: Security practice and authority vocabulary + summary: Versioned SEC-DSM and Mode of Authority documents. + domain: infotech + status: draft + owner: security-canon + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.practice-canon.md + consumption_modes: + - informational + source_repo: security-canon + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml +- id: capability.security.repository-secret-prevention + name: Repository metadata and staged-secret prevention + summary: Repository observation plus pinned staged-blob scanner and hook integration. + domain: infotech + status: draft + owner: repo-manager + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.repository-secret-prevention.md + consumption_modes: + - CLI + - source + source_repo: repo-manager + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml +- id: capability.security.risk-register + name: Security risk and exception review register + summary: Markdown findings and Python review, verification and due-work reports. + domain: infotech + status: draft + owner: risk-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.risk-register.md + consumption_modes: + - CLI + - source + source_repo: risk-nexus + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml +- id: capability.security.scenario-compose + name: Deterministic security scenario composition + summary: CLI selects pinned providers and orders trust transitions. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.scenario-compose.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.ssh-certificate-issuance + name: Decision-bound SSH certificates + summary: warden sign with local and OpenBao backends and adm/agt/atm actors. + domain: helix_forge + status: draft + owner: ops-warden + tags: + - ssh + - certificate + - ca + - ops-warden + - openbao + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R2 + path: registry/capabilities/capability.security.ssh-certificate-issuance.md + consumption_modes: + - library + - CLI + source_repo: ops-warden + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.structure-construction + name: Reviewed security structure construction + summary: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply. + domain: infotech + status: draft + owner: ops-mason + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.structure-construction.md + consumption_modes: + - CLI + - source + source_repo: ops-mason + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml +- id: capability.security.zone-reference + name: Zone membership reference conformance + summary: Offline resolution, exception and lineage checks. + domain: infotech + status: draft + owner: zone-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.zone-reference.md + consumption_modes: + - CLI + - source + source_repo: zone-engine + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml +- id: capability.statehub.progress-log + name: Progress and work evidence indexing + summary: REST progress and task evidence references. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - progress + - coordination + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R3 + path: registry/capabilities/capability.statehub.progress-log.md + consumption_modes: + - HTTP API + - source + source_repo: state-hub + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml +- id: capability.statehub.workstream-coordinate + name: Cross-repository work tracking + summary: File-derived workplans, tasks, dependencies, decisions and coordination + views. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - coordination + - workplans + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R2 + path: registry/capabilities/capability.statehub.workstream-coordinate.md + consumption_modes: + - HTTP API + - source + source_repo: state-hub + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml diff --git a/docs/assessments/netkingdom-2026-10-14/federation-local.yaml b/docs/assessments/netkingdom-2026-10-14/federation-local.yaml new file mode 100644 index 00000000..cf4ee153 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/federation-local.yaml @@ -0,0 +1,244 @@ +version: 1 +domain: infotech +collision_policy: warn +sources: +- repo: access-engine + index: /home/worsch/access-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: activity-core + index: /home/worsch/activity-core/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: agentic-resources + index: /home/worsch/agentic-resources/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: approval-engine + index: /home/worsch/approval-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: audit-core + index: /home/worsch/audit-core/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: coordination-engine + index: /home/worsch/coordination-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: emergent-security + index: /home/worsch/emergent-security/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: fin-hub + index: /home/worsch/fin-hub/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: gate-house + index: /home/worsch/gate-house/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: glas-harness + index: /home/worsch/glas-harness/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: info-tech-canon + index: /home/worsch/info-tech-canon/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: informed-decision + index: /home/worsch/informed-decision/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: issue-core + index: /home/worsch/issue-core/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: key-cape + index: /home/worsch/key-cape/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: kings-guard + index: /home/worsch/kings-guard/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: maturity-engine + index: /home/worsch/maturity-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: net-kingdom + index: /home/worsch/net-kingdom/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: ops-bridge + index: /home/worsch/ops-bridge/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: ops-mason + index: /home/worsch/ops-mason/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: ops-warden + index: /home/worsch/ops-warden/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: policy-nexus + index: /home/worsch/policy-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rail-kubernetes + index: /home/worsch/rail-kubernetes/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-apps + index: /home/worsch/railiance-apps/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-bootstrap + index: /home/worsch/railiance-bootstrap/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-cluster + index: /home/worsch/railiance-cluster/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-enablement + index: /home/worsch/railiance-enablement/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-fabric + index: /home/worsch/railiance-fabric/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-forge + index: /home/worsch/railiance-forge/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-infra + index: /home/worsch/railiance-infra/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-master + index: /home/worsch/railiance-master/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-platform + index: /home/worsch/railiance-platform/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-telemetry + index: /home/worsch/railiance-telemetry/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-openbao + index: /home/worsch/rapp-openbao/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-playwright + index: /home/worsch/rapp-playwright/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-policy-nexus + index: /home/worsch/rapp-policy-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-postgres + index: /home/worsch/rapp-postgres/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-telemetry + index: /home/worsch/rapp-telemetry/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-tenant-engine + index: /home/worsch/rapp-tenant-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-user-engine + index: /home/worsch/rapp-user-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: reef-railiance + index: /home/worsch/reef-railiance/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rein-aharness + index: /home/worsch/rein-aharness/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rein-openweights + index: /home/worsch/rein-openweights/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: repo-manager + index: /home/worsch/repo-manager/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: resource-control + index: /home/worsch/resource-control/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: reuse-surface + index: /home/worsch/reuse-surface/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: risk-nexus + index: /home/worsch/risk-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: role-engine + index: /home/worsch/role-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: runbook-tutorials + index: /home/worsch/runbook-tutorials/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: sand-boxer + index: /home/worsch/sand-boxer/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: sbom-nexus + index: /home/worsch/sbom-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: secrets-engine + index: /home/worsch/secrets-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: security-canon + index: /home/worsch/security-canon/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: state-hub + index: /home/worsch/state-hub/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: tenant-engine + index: /home/worsch/tenant-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: the-custodian + index: /home/worsch/the-custodian/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: user-engine + index: /home/worsch/user-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: whitehat-security + index: /home/worsch/whitehat-security/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: zone-engine + index: /home/worsch/zone-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rail-knative + index: /home/worsch/rail-knative/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-sbom-nexus + index: /home/worsch/rapp-sbom-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true diff --git a/docs/assessments/netkingdom-2026-10-14/federation-staged.yaml b/docs/assessments/netkingdom-2026-10-14/federation-staged.yaml new file mode 100644 index 00000000..2a39b43d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/federation-staged.yaml @@ -0,0 +1,236 @@ +version: 1 +domain: infotech +collision_policy: warn +sources: +- repo: access-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: activity-core + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: agentic-resources + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: approval-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: audit-core + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: coordination-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: emergent-security + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: fin-hub + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: gate-house + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: glas-harness + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: info-tech-canon + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: informed-decision + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: issue-core + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: key-cape + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: kings-guard + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: maturity-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: net-kingdom + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: ops-bridge + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: ops-mason + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: ops-warden + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: policy-nexus + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rail-kubernetes + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-apps + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-bootstrap + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-cluster + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-enablement + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-fabric + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-forge + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-infra + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-master + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-platform + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: railiance-telemetry + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-openbao + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-playwright + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-policy-nexus + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-postgres + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-telemetry + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-tenant-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-user-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: reef-railiance + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rein-aharness + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rein-openweights + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: repo-manager + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: resource-control + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: reuse-surface + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: risk-nexus + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: role-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: runbook-tutorials + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: sand-boxer + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: sbom-nexus + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: secrets-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: security-canon + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: state-hub + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: tenant-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: the-custodian + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: user-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: whitehat-security + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: zone-engine + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml + enabled: true + required: true diff --git a/docs/assessments/netkingdom-2026-10-14/full-inventory.json b/docs/assessments/netkingdom-2026-10-14/full-inventory.json new file mode 100644 index 00000000..6eca0291 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/full-inventory.json @@ -0,0 +1,2987 @@ +{ + "as_of": "2026-10-14", + "capabilities": [ + { + "repo": "security-canon", + "id": "capability.security.practice-canon", + "name": "Security practice and authority vocabulary", + "availability": "A0", + "operational_estimate": 2, + "surface": "Versioned SEC-DSM and Mode of Authority documents", + "limitation": "Normative practice; no runtime control or certification", + "use_cases": [ + "U01", + "U07", + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.practice-canon.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom security architecture and conformance tooling", + "availability": "A2", + "operational_estimate": 2, + "surface": "Versioned IAM, layer, tenancy and credential contracts plus validators", + "limitation": "Mixed accepted and proposed standards; framework integration remains incomplete", + "use_cases": [ + "U01", + "U02", + "U03", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "SECURITY-COMPANION.md" + ], + "existing_entry_path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "prior_vector": "D3 / A2 / C1 / R1", + "vector": "D3 / A2 / C1 / R1", + "entry_path": "registry/capabilities/capability.security.iam-tooling-suite.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.scenario-compose", + "name": "Deterministic security scenario composition", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI selects pinned providers and orders trust transitions", + "limitation": "Plan only; execution.permitted is always false", + "use_cases": [ + "U01", + "U14" + ], + "artifacts": [ + "tools/security-scenario-composer/README.md", + "tools/security-scenario-composer/security_scenario_composer.py" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.scenario-compose.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.posture-feedback", + "name": "Deterministic posture feedback", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI evaluates evidence age and posture into owner-routed findings", + "limitation": "Proposal only; no policy changes or remediation execution", + "use_cases": [ + "U09", + "U14" + ], + "artifacts": [ + "tools/posture-feedback/README.md", + "tools/posture-feedback/posture_feedback.py" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.posture-feedback.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.case-contracts", + "name": "Security case types and instance validation", + "availability": "A2", + "operational_estimate": 2, + "surface": "Versioned types, cases and schema validation", + "limitation": "Type acknowledgment, case acceptance, structural materialization and native execution are distinct", + "use_cases": [ + "U01", + "U05", + "U06" + ], + "artifacts": [ + "tools/security-case-types/README.md", + "canon/standards/security-case-types_v0.1.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.case-contracts.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.bootstrap-recovery", + "name": "Guarded bootstrap and recovery preparation", + "availability": "A2", + "operational_estimate": 2, + "surface": "Local identity, bootstrap console, encrypted custody handoff and caller tools", + "limitation": "Source repairs and disposable native fixtures do not prove estate root isolation or recovery", + "use_cases": [ + "U10" + ], + "artifacts": [ + "tools/security-bootstrap-console/README.md", + "tools/custody-record/README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.bootstrap-recovery.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.emission-profile", + "name": "Security emission cadence validation", + "availability": "A2", + "operational_estimate": 2, + "surface": "Security profile over generic emission contracts and validator", + "limitation": "Profile adoption and source completeness require owner-native evidence", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "tools/emission-cadence-profile/README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.emission-profile.md" + }, + { + "repo": "key-cape", + "id": "capability.iam.key-cape", + "name": "OIDC identity and assurance", + "availability": "A4", + "operational_estimate": 3, + "surface": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI", + "limitation": "Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates", + "use_cases": [ + "U02", + "U03", + "U04", + "U10" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.iam.key-cape.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A4 / C2 / R1", + "entry_path": "registry/capabilities/capability.iam.key-cape.md" + }, + { + "repo": "user-engine", + "id": "capability.identity.user-engine", + "name": "User lifecycle and account journeys", + "availability": "A4", + "operational_estimate": 3, + "surface": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog", + "limitation": "Application readback is advisory; applications must enforce their own authorization", + "use_cases": [ + "U02", + "U03", + "U10" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.identity.user-engine.md", + "prior_vector": "D4 / A1 / C2 / R0", + "vector": "D4 / A4 / C2 / R0", + "entry_path": "registry/capabilities/capability.identity.user-engine.md" + }, + { + "repo": "tenant-engine", + "id": "capability.identity.tenant-facts", + "name": "Tenant lifecycle and guardrail facts", + "availability": "A4", + "operational_estimate": 3, + "surface": "Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store", + "limitation": "Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate", + "use_cases": [ + "U03", + "U04" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.identity.tenant-facts.md" + }, + { + "repo": "zone-engine", + "id": "capability.security.zone-reference", + "name": "Zone membership reference conformance", + "availability": "A2", + "operational_estimate": 2, + "surface": "Offline resolution, exception and lineage checks", + "limitation": "No live zone engine, PDP or protected side effects", + "use_cases": [ + "U01", + "U03", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.zone-reference.md" + }, + { + "repo": "access-engine", + "id": "capability.authorization.policy-evaluate", + "name": "Policy evaluation and decision evidence", + "availability": "A4", + "operational_estimate": 3, + "surface": "Check, batch, list-allowed, explain, binding, lifetime and decision records", + "limitation": "One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct", + "use_cases": [ + "U03", + "U04", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A4 / C2 / R1", + "entry_path": "registry/capabilities/capability.authorization.policy-evaluate.md" + }, + { + "repo": "approval-engine", + "id": "capability.security.approval-lifecycle", + "name": "Bound approval lifecycle", + "availability": "A4", + "operational_estimate": 2, + "surface": "Authenticated issue, claim, revoke, supersede and atomic consume API with outbox", + "limitation": "Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open", + "use_cases": [ + "U04", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "approval_engine/api.py", + "docs/production-dependencies.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.approval-lifecycle.md" + }, + { + "repo": "secrets-engine", + "id": "capability.security.credential-lifecycle", + "name": "Cataloged credential lifecycle", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke", + "limitation": "Production protected execution and independently anchored PDP authentication remain incomplete", + "use_cases": [ + "U04", + "U05", + "U07" + ], + "artifacts": [ + "SCOPE.md", + "src/secrets_engine/decision_check.py" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.credential-lifecycle.md" + }, + { + "repo": "ops-warden", + "id": "capability.security.ssh-certificate-issuance", + "name": "Decision-bound SSH certificates", + "availability": "A3", + "operational_estimate": 3, + "surface": "warden sign with local and OpenBao backends and adm/agt/atm actors", + "limitation": "Direct Tooling contact is a declared gap; certificate reachability is not target authorization", + "use_cases": [ + "U06" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "prior_vector": "D4 / A3 / C3 / R2", + "vector": "D4 / A3 / C3 / R2", + "entry_path": "registry/capabilities/capability.security.ssh-certificate-issuance.md" + }, + { + "repo": "ops-warden", + "id": "capability.security.access-routing", + "name": "Credential routing and contained access", + "availability": "A3", + "operational_estimate": 3, + "surface": "warden route and access catalog; exact lane conduit and secret-exec routing", + "limitation": "Routing grants no authority; interim delegates and attended high-risk lanes persist", + "use_cases": [ + "U04", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "wiki/CredentialRouting.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A3 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.access-routing.md" + }, + { + "repo": "ops-warden", + "id": "capability.security.case-follow-through", + "name": "Security case operational follow-through", + "availability": "A2", + "operational_estimate": 2, + "surface": "KnownSecurityCase route, plan and operational receipts", + "limitation": "Execution requires accepted structure and exact owner contracts; case closure is not automatic", + "use_cases": [ + "U01", + "U05", + "U06" + ], + "artifacts": [ + "workplans/WARDEN-WP-0044-security-case-follow-through.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.case-follow-through.md" + }, + { + "repo": "ops-mason", + "id": "capability.security.structure-construction", + "name": "Reviewed security structure construction", + "availability": "A2", + "operational_estimate": 2, + "surface": "Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply", + "limitation": "Founder plan gate is an explicit exception; not full PDP conformance", + "use_cases": [ + "U01", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "docs/construction-plan-format.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.structure-construction.md" + }, + { + "repo": "ops-bridge", + "id": "capability.ops.tunnel-bridge", + "name": "SSH tunnel lifecycle", + "availability": "A2", + "operational_estimate": 3, + "surface": "Named tunnels, reconnect, health and TTL-aware cert_command", + "limitation": "Private transport does not authenticate applications or decide access", + "use_cases": [ + "U06" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "prior_vector": "D3 / A2 / C2 / R1", + "vector": "D3 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.ops.tunnel-bridge.md" + }, + { + "repo": "audit-core", + "id": "capability.audit.event-retain", + "name": "Independent audit custody", + "availability": "A4", + "operational_estimate": 3, + "surface": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation", + "limitation": "Custody after arrival does not prove source completeness; freshness bounds integrity assertions", + "use_cases": [ + "U08", + "U09", + "U10" + ], + "artifacts": [ + "SCOPE.md", + "docs/stream-completeness.md" + ], + "existing_entry_path": "registry/capabilities/capability.audit.event-retain.md", + "prior_vector": "D4 provision / A4 / C3 / R2", + "vector": "D3 / A4 / C3 / R2", + "entry_path": "registry/capabilities/capability.audit.event-retain.md" + }, + { + "repo": "maturity-engine", + "id": "capability.security.maturity-claims", + "name": "Evidence-based maturity claims and gap register", + "availability": "A2", + "operational_estimate": 2, + "surface": "SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory", + "limitation": "No production deployment claimed; levels supply facts and cannot authorize actions", + "use_cases": [ + "U09", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "docs/claim-contract.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.maturity-claims.md" + }, + { + "repo": "kings-guard", + "id": "capability.security.posture-assessment", + "name": "Security posture assessment and response proposals", + "availability": "A2", + "operational_estimate": 2, + "surface": "Normalized observation evaluator, cadence checks and secret-use snapshot adapter", + "limitation": "Bounded reference pilot; containment proposals only; deployed-stream admission remains open", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "SCOPE.md", + "docs/SecretUseSnapshotAdmission.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.posture-assessment.md" + }, + { + "repo": "whitehat-security", + "id": "capability.security.adversarial-evidence", + "name": "Authorized adversarial evidence harness", + "availability": "A2", + "operational_estimate": 2, + "surface": "Offline ASM and tenancy calibrations and engagement admission", + "limitation": "Live probes require a complete engagement; no blanket target authorization", + "use_cases": [ + "U03", + "U08", + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.adversarial-evidence.md" + }, + { + "repo": "gate-house", + "id": "capability.security.doctrine-review", + "name": "Security doctrine and architecture review", + "availability": "A0", + "operational_estimate": 3, + "surface": "Layer rules, authority context, ASM criteria and interpretations", + "limitation": "Staff judgment; no runtime PDP, credential issuer or automatic enforcement", + "use_cases": [ + "U01", + "U09", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "INTENT.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.doctrine-review.md" + }, + { + "repo": "emergent-security", + "id": "capability.security.agent-knowledge", + "name": "Verified security orientation for agents", + "availability": "A2", + "operational_estimate": 2, + "surface": "Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports", + "limitation": "Current start card withheld for source drift; orientation never grants authority", + "use_cases": [ + "U01", + "U11", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "knowledge/cards/start.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.agent-knowledge.md" + }, + { + "repo": "informed-decision", + "id": "capability.security.human-decision-workspace", + "name": "Human security decision presentation and disposition", + "availability": "A4", + "operational_estimate": 3, + "surface": "Headless lifecycle and browser workspace with exact native approval references", + "limitation": "Initial audience is bounded; Approval Engine owns approval state, Access Engine decides", + "use_cases": [ + "U04", + "U05", + "U09" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.human-decision-workspace.md" + }, + { + "repo": "policy-nexus", + "id": "capability.security.policy-publication", + "name": "Policy publication with source provenance", + "availability": "A2", + "operational_estimate": 3, + "surface": "Generated immutable publication, source currency and stable policy URLs", + "limitation": "Publication does not ratify policy or enforce it", + "use_cases": [ + "U01", + "U09", + "U14" + ], + "artifacts": [ + "README.md", + "docs/publication-contract.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.policy-publication.md" + }, + { + "repo": "risk-nexus", + "id": "capability.security.risk-register", + "name": "Security risk and exception review register", + "availability": "A2", + "operational_estimate": 2, + "surface": "Markdown findings and Python review, verification and due-work reports", + "limitation": "Judgment remains human or agent; no live EUR risk gate or autonomous response", + "use_cases": [ + "U09", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.risk-register.md" + }, + { + "repo": "role-engine", + "id": "capability.organization.role-catalog", + "name": "Organizational role definitions", + "availability": "A0", + "operational_estimate": 1, + "surface": "Versioned documentation catalog", + "limitation": "Not IAM roles, assignments or runtime authorization", + "use_cases": [ + "U01", + "U11" + ], + "artifacts": [ + "README.md", + "INTENT.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.organization.role-catalog.md" + }, + { + "repo": "glas-harness", + "id": "capability.execution.profile-harness", + "name": "Profile-bound agent execution lifecycle", + "availability": "A3", + "operational_estimate": 2, + "surface": "Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration", + "limitation": "No ready profile asserted by SCOPE; Custodian native isolation remains open", + "use_cases": [ + "U11" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A3 / C1 / R0", + "entry_path": "registry/capabilities/capability.execution.profile-harness.md" + }, + { + "repo": "sand-boxer", + "id": "capability.execution.sandbox-provision", + "name": "Sandbox establishment and lifecycle", + "availability": "A5", + "operational_estimate": 2, + "surface": "Profiles, extensions, provision, checkpoints, TTL teardown and telemetry", + "limitation": "Backend-specific guarantees; a created sandbox alone proves no credential isolation", + "use_cases": [ + "U11", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/execution.sandbox-provision.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D5 / A5 / C5 / R0", + "entry_path": "registry/capabilities/execution.sandbox-provision.md" + }, + { + "repo": "rein-aharness", + "id": "capability.execution.scheduled-agent-rein", + "name": "Scheduled agent intake and harness routing", + "availability": "A2", + "operational_estimate": 3, + "surface": "Activity Core lease claim/heartbeat and Glas profile execution", + "limitation": "Legacy paths are time-gated; task success is not privileged authority", + "use_cases": [ + "U09", + "U11" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.execution.scheduled-agent-rein.md" + }, + { + "repo": "rein-openweights", + "id": "capability.execution.openweight-rein", + "name": "Bounded open-weight agent execution", + "availability": "A2", + "operational_estimate": 2, + "surface": "Tool loop, path guards, turn/budget limits and verified-commit result", + "limitation": "Provider credential acquisition and runtime authority need separate custody controls", + "use_cases": [ + "U11" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.execution.openweight-rein.md" + }, + { + "repo": "agentic-resources", + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "availability": "A2", + "operational_estimate": 2, + "surface": "Capture sessions, curate patterns, distribute lessons and measure outcomes", + "limitation": "Workforce assignments and broader authority contracts remain proposed", + "use_cases": [ + "U09", + "U11" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.agents.performance-learning.md" + }, + { + "repo": "runbook-tutorials", + "id": "capability.infotech.runbook-tutorials", + "name": "Guided administrative runbooks", + "availability": "A2", + "operational_estimate": 2, + "surface": "Pack schema, loader, local UI/CLI, gates, verification and rollback evidence", + "limitation": "Owner supplies procedures; UI progress is not runtime approval", + "use_cases": [ + "U05", + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "docs/pack-spec.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.infotech.runbook-tutorials.md" + }, + { + "repo": "repo-manager", + "id": "capability.security.repository-secret-prevention", + "name": "Repository metadata and staged-secret prevention", + "availability": "A2", + "operational_estimate": 3, + "surface": "Repository observation plus pinned staged-blob scanner and hook integration", + "limitation": "Local hooks are bypassable; coverage is exact-checkout scoped", + "use_cases": [ + "U07", + "U12" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.repository-secret-prevention.md" + }, + { + "repo": "sbom-nexus", + "id": "capability.infotech.sbom-management", + "name": "Dependency provenance and SBOM evidence", + "availability": "A4", + "operational_estimate": 3, + "surface": "Controlled archive ingest, immutable snapshots, freshness and license review", + "limitation": "SBOM and license evidence do not prove vulnerability exploitability or artifact trust", + "use_cases": [ + "U12", + "U09" + ], + "artifacts": [ + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.sbom-management.md", + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.infotech.sbom-management.md" + }, + { + "repo": "activity-core", + "id": "capability.activity.event-coordinate", + "name": "Durable automation and bounded operations", + "availability": "A4", + "operational_estimate": 3, + "surface": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks", + "limitation": "Not a general shell executor; first unassisted security-flow cadence acceptance remains open", + "use_cases": [ + "U09", + "U12" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.activity.event-coordinate.md", + "prior_vector": "D3 / A1 / C1 / R0", + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.activity.event-coordinate.md" + }, + { + "repo": "issue-core", + "id": "capability.infotech.issue-tracking", + "name": "External issue tracker connector", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI and Python adapters for external issue systems", + "limitation": "Internal work originates in owner files; external projection is optional", + "use_cases": [ + "U09" + ], + "artifacts": [ + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.issue-tracking.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.infotech.issue-tracking.md" + }, + { + "repo": "state-hub", + "id": "capability.statehub.workstream-coordinate", + "name": "Cross-repository work tracking", + "availability": "A4", + "operational_estimate": 3, + "surface": "File-derived workplans, tasks, dependencies, decisions and coordination views", + "limitation": "Read/cache/index of owner work; not runtime approval authority", + "use_cases": [ + "U09" + ], + "artifacts": [ + "README.md", + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "prior_vector": "D4 / A4 / C3 / R2", + "vector": "D4 / A4 / C3 / R2", + "entry_path": "registry/capabilities/capability.statehub.workstream-coordinate.md" + }, + { + "repo": "state-hub", + "id": "capability.statehub.progress-log", + "name": "Progress and work evidence indexing", + "availability": "A4", + "operational_estimate": 3, + "surface": "REST progress and task evidence references", + "limitation": "Not independent security event custody", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "README.md", + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.statehub.progress-log.md", + "prior_vector": "D4 / A4 / C3 / R3", + "vector": "D4 / A4 / C3 / R3", + "entry_path": "registry/capabilities/capability.statehub.progress-log.md" + }, + { + "repo": "the-custodian", + "id": "capability.agents.custodian-runtime-tooling", + "name": "Generic agent runtime and repository tooling", + "availability": "A2", + "operational_estimate": 2, + "surface": "Agent runtime modules and repository classification tooling", + "limitation": "Only generic tooling is reusable; confidential canon and session memory are excluded", + "use_cases": [ + "U09", + "U11", + "U14" + ], + "artifacts": [ + "runtime/README.md" + ], + "existing_entry_path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "prior_vector": "D2 / A1 / C1 / R0", + "vector": "D2 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md" + }, + { + "repo": "coordination-engine", + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "availability": "A2", + "operational_estimate": 2, + "surface": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime", + "limitation": "Coordinates owners without replacing their execution or security authority", + "use_cases": [ + "U09" + ], + "artifacts": [ + "SCOPE.md", + "spec/cross-owner-wait-mode-v0.1.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.coordination.cross-owner-work.md" + }, + { + "repo": "reuse-surface", + "id": "capability.registry.register", + "name": "Capability registry and federation", + "availability": "A3", + "operational_estimate": 3, + "surface": "Owner Markdown entries, indexes, federation hub and planning queries", + "limitation": "Discovery is not readiness; empty and stale entries need evidence-led maintenance", + "use_cases": [ + "U01", + "U09", + "U14" + ], + "artifacts": [ + "docs/RegistryFederation.md", + "specs/CapabilityMaturityStandard.md" + ], + "existing_entry_path": "registry/capabilities/capability.registry.register.md", + "prior_vector": "D3 / A4 / C2 / R3", + "vector": "D3 / A3 / C2 / R3", + "entry_path": "registry/capabilities/capability.registry.register.md" + }, + { + "repo": "reuse-surface", + "id": "capability.registry.validate", + "name": "Capability registry validation", + "availability": "A3", + "operational_estimate": 3, + "surface": "Schema, index consistency and relation checks", + "limitation": "Schema validity alone proves neither capability behavior nor hosted freshness", + "use_cases": [ + "U01", + "U14" + ], + "artifacts": [ + "docs/RegistryFederation.md", + "schemas/capability.schema.yaml" + ], + "existing_entry_path": "registry/capabilities/capability.registry.validate.md", + "prior_vector": "D4 / A3 / C3 / R3", + "vector": "D4 / A3 / C3 / R3", + "entry_path": "registry/capabilities/capability.registry.validate.md" + }, + { + "repo": "info-tech-canon", + "id": "capability.infotech.canon-service", + "name": "Shared semantic contracts and validation", + "availability": "A4", + "operational_estimate": 2, + "surface": "Markdown canon with library, CLI and read-only API", + "limitation": "Mixed seed/candidate maturity; validation is not owner runtime conformance", + "use_cases": [ + "U01", + "U08", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.canon-service.md", + "prior_vector": "D2 / A2 / C1 / R0", + "vector": "D2 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.infotech.canon-service.md" + }, + { + "repo": "railiance-master", + "id": "capability.railiance.security-consumption-contracts", + "name": "Platform security consumption architecture", + "availability": "A0", + "operational_estimate": 2, + "surface": "Rail/rapp/reef boundaries, exposure and security consumption contracts", + "limitation": "Architecture declarations do not prove implementation or production admission", + "use_cases": [ + "U01", + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "docs/netkingdom-security-consumption-contract.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.security-consumption-contracts.md" + }, + { + "repo": "railiance-platform", + "id": "capability.railiance.platform-services", + "name": "Secret custody and platform data services", + "availability": "A2", + "operational_estimate": 3, + "surface": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts", + "limitation": "Package ownership is split to rapp repos; caches and object services are demand-led", + "use_cases": [ + "U04", + "U05", + "U07", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md", + "docs/openbao.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.platform-services.md", + "prior_vector": "D3 / A2 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.platform-services.md" + }, + { + "repo": "railiance-infra", + "id": "capability.railiance.infra-provisioning", + "name": "Host convergence and security baseline", + "availability": "A2", + "operational_estimate": 3, + "surface": "Ansible inventory, firewall, SSH bootstrap and baseline verification", + "limitation": "Current hosts differ from the retained Hetzner provisioning path", + "use_cases": [ + "U06", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.railiance.infra-provisioning.md" + }, + { + "repo": "railiance-cluster", + "id": "capability.railiance.cluster-bootstrap", + "name": "Kubernetes runtime and cluster controls", + "availability": "A2", + "operational_estimate": 3, + "surface": "k3s, ingress, CNI, operators and kubeconfig/runtime checks", + "limitation": "Single-node runtime and workload recovery are distinct from bootstrap success", + "use_cases": [ + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "prior_vector": "D3 / A2 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.cluster-bootstrap.md" + }, + { + "repo": "railiance-enablement", + "id": "capability.railiance.ci-enablement", + "name": "Developer delivery and CI templates", + "availability": "A2", + "operational_estimate": 2, + "surface": "Reusable CI workflows, build and deployment patterns", + "limitation": "Templates do not prove mandatory checks or runner isolation", + "use_cases": [ + "U12", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.ci-enablement.md", + "prior_vector": "D3 / A2 / C2 / R1", + "vector": "D3 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.railiance.ci-enablement.md" + }, + { + "repo": "railiance-forge", + "id": "capability.railiance.forge-infrastructure", + "name": "Source forge, registries and runner substrate", + "availability": "A2", + "operational_estimate": 3, + "surface": "Forgejo operation, package registries and runner lifecycle", + "limitation": "Runner workload authority and independent verification coverage remain open", + "use_cases": [ + "U12" + ], + "artifacts": [ + "SCOPE.md", + "workplans/FORGE-WP-0006-independent-secret-detection.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "prior_vector": "D3 / A1 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.forge-infrastructure.md" + }, + { + "repo": "railiance-forge", + "id": "capability.security.forge-secret-prevention", + "name": "Independent introduced-history secret prevention", + "availability": "A2", + "operational_estimate": 3, + "surface": "Pinned receive adapter, lifecycle template and fail-closed scan", + "limitation": "Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate", + "use_cases": [ + "U07", + "U12" + ], + "artifacts": [ + "workplans/FORGE-WP-0006-independent-secret-detection.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.forge-secret-prevention.md" + }, + { + "repo": "railiance-apps", + "id": "capability.railiance.workload-deployment-tooling", + "name": "Workload release configuration and guards", + "availability": "A2", + "operational_estimate": 3, + "surface": "Helm/manifests, exact image pins, application runbooks and rollout/rollback", + "limitation": "Release settings depend on underlying platform and workload owners", + "use_cases": [ + "U12", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "prior_vector": "D3 / A2 / C1 / R1", + "vector": "D3 / A2 / C1 / R1", + "entry_path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md" + }, + { + "repo": "railiance-bootstrap", + "id": "capability.railiance.bootstrap-sequencing", + "name": "Bootstrap sequencing contracts", + "availability": "A0", + "operational_estimate": 1, + "surface": "Bare-VM to estate sequence and handoff contract", + "limitation": "End-to-end unattended rebuild is not established", + "use_cases": [ + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.bootstrap-sequencing.md" + }, + { + "repo": "rail-kubernetes", + "id": "capability.railiance.kubernetes-rail", + "name": "Generic Kubernetes workload lifecycle", + "availability": "A2", + "operational_estimate": 2, + "surface": "Workload declaration, rollout, observe, promote and rollback surfaces", + "limitation": "Compatibility extraction remains; not cluster or application-domain ownership", + "use_cases": [ + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.kubernetes-rail.md" + }, + { + "repo": "reef-railiance", + "id": "capability.railiance.substrate-bindings", + "name": "Substrate topology and bindings", + "availability": "A0", + "operational_estimate": 2, + "surface": "Grouped home-reef identity, topology and placement declarations", + "limitation": "Declarations are not automatic placement or authorization", + "use_cases": [ + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.substrate-bindings.md" + }, + { + "repo": "railiance-fabric", + "id": "capability.railiance.fabric-graph", + "name": "Infrastructure ownership and dependency graph", + "availability": "A2", + "operational_estimate": 2, + "surface": "Schemas, validation, graph queries and State Hub exports", + "limitation": "Graph assertions need current owner evidence; not an enforcement registry", + "use_cases": [ + "U09", + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.fabric-graph.md", + "prior_vector": "D3 / A1 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.fabric-graph.md" + }, + { + "repo": "rapp-openbao", + "id": "capability.railiance.openbao-package", + "name": "Managed OpenBao deployment package", + "availability": "A2", + "operational_estimate": 3, + "surface": "Helm values, package deploy/status/smoke/rollback and custody boundary", + "limitation": "Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit", + "use_cases": [ + "U04", + "U10", + "U13" + ], + "artifacts": [ + "README.md", + "docs/retained-s3-handoff.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.openbao-package.md" + }, + { + "repo": "rapp-postgres", + "id": "capability.railiance.postgres-isolation-recovery", + "name": "Database isolation and recovery package", + "availability": "A2", + "operational_estimate": 3, + "surface": "CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures", + "limitation": "Host-loss proof and consumer schemas stay with their owners", + "use_cases": [ + "U03", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.postgres-isolation-recovery.md" + }, + { + "repo": "rapp-user-engine", + "id": "capability.railiance.user-engine-package", + "name": "User Engine runtime package", + "availability": "A2", + "operational_estimate": 3, + "surface": "Pinned deployment, dedicated CNPG, ExternalSecret references and rollback", + "limitation": "Domain, identity, PDP and custody authority are separate", + "use_cases": [ + "U02", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.user-engine-package.md" + }, + { + "repo": "rapp-tenant-engine", + "id": "capability.railiance.tenant-engine-package", + "name": "Tenant Engine runtime package", + "availability": "A2", + "operational_estimate": 2, + "surface": "Package declaration, smoke and rollback", + "limitation": "No tenant-domain ownership or credential values", + "use_cases": [ + "U03", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.tenant-engine-package.md" + }, + { + "repo": "rapp-policy-nexus", + "id": "capability.railiance.policy-publication-package", + "name": "Policy publication runtime package", + "availability": "A2", + "operational_estimate": 3, + "surface": "Immutable image, non-root/read-only runtime and approved TLS exposure", + "limitation": "No policy authoring or DNS/issuer administration", + "use_cases": [ + "U01", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.policy-publication-package.md" + }, + { + "repo": "rapp-playwright", + "id": "capability.railiance.browser-verification", + "name": "Managed browser verification pilot", + "availability": "A4", + "operational_estimate": 2, + "surface": "Bounded jobs, cancellation, artifacts, origin checks and restart receipts", + "limitation": "Pilot deployed; human/agent authentication and per-caller self-service connectivity pending", + "use_cases": [ + "U02", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.browser-verification.md" + }, + { + "repo": "railiance-telemetry", + "id": "capability.observability.security-signals", + "name": "Security-relevant telemetry contracts and adapters", + "availability": "A2", + "operational_estimate": 2, + "surface": "Signal contract, platform adapters, report exporter and absence/alert rules", + "limitation": "Reference receiver is not a second production plane; end-to-end delivery acceptance pending", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.observability.security-signals.md" + }, + { + "repo": "rapp-telemetry", + "id": "capability.railiance.telemetry-package", + "name": "Private monitoring package", + "availability": "A2", + "operational_estimate": 2, + "surface": "Prometheus, Alertmanager and Grafana package with isolated restore evidence", + "limitation": "Private installation only; recurring recovery capture and audited confirmation pending", + "use_cases": [ + "U08", + "U09", + "U10" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.telemetry-package.md" + }, + { + "repo": "resource-control", + "id": "capability.resources.security-capacity", + "name": "Capacity and recovery resource planning", + "availability": "A2", + "operational_estimate": 2, + "surface": "Provider-neutral inventory, procurement evidence and optimization reports", + "limitation": "No payment authority or irreversible procurement; metrics do not prove usable runtime capacity", + "use_cases": [ + "U09", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.resources.security-capacity.md" + }, + { + "repo": "fin-hub", + "id": "capability.finance.security-budget-evidence", + "name": "Budget and cost evidence for security operations", + "availability": "A4", + "operational_estimate": 2, + "surface": "Budget, commitment, spend attribution and planning-evidence consumption", + "limitation": "No verified concurrent runtime EUR risk/cost enforcement for agents", + "use_cases": [ + "U09", + "U11" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.finance.security-budget-evidence.md" + }, + { + "repo": "rail-knative", + "id": "capability.railiance.knative-rail", + "name": "Knative workload lifecycle", + "availability": "A2", + "operational_estimate": 3, + "surface": "Derived rail for activation, revisions, traffic, scaling and rollback", + "limitation": "Inherits Kubernetes common contract; verified readiness is not production approval", + "use_cases": [ + "U09", + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md", + "declarations/rail.yaml" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.knative-rail.md" + }, + { + "repo": "rapp-sbom-nexus", + "id": "capability.railiance.sbom-runtime-package", + "name": "Private SBOM runtime and dynamic database delivery", + "availability": "A2", + "operational_estimate": 3, + "surface": "Immutable deployment, private network policy, dynamic database leases and migration/rollback", + "limitation": "Product owns schema and ingestion; database and backup authority remain with platform owners", + "use_cases": [ + "U07", + "U12", + "U13" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.sbom-runtime-package.md" + } + ], + "repositories": { + "access-engine": { + "head": "16ca97b2776789f730cc7049a2d6533612faaccd", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:f6c14f5f824fb86ac06368fb9c52e60d627ee42810817a45723d34a6a9a178a5", + "README.md": "sha256:7ed086b4d153ff067f4f8d3665891b65006a4a74cec8e6fb596e7e1dbd097b38", + "SCOPE.md": "sha256:dd1484a32a313135e69f16dbc833d768467491438bbb1d9127c2b098061edb60" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.authorization.policy-evaluate", + "name": "Authorization Policy Evaluation", + "summary": "Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "flex-auth", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "tags": [ + "authorization", + "policy", + "flex-auth" + ], + "consumption_modes": [ + "source module" + ] + } + ] + } + }, + "activity-core": { + "head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:8aec524060edb9309af679ef38bc5549aa3650752634d23977c7ae57c45bbefa", + "README.md": "sha256:549e7878b27bbf7edc9e958c7afbacd3eba773b082151d226b5f0a14af654f9b", + "SCOPE.md": "sha256:820aafbff2f7d1c314c0c270d745468172a0500d106ab276216e0eeb702ca7bd" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Organizational Event Coordination", + "summary": "Coordinate structured responses to cross-domain events through activity workflows and automation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "tags": [ + "activity", + "coordination", + "automation" + ], + "consumption_modes": [ + "informational" + ] + } + ] + } + }, + "agentic-resources": { + "head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:81dc51facb26c36ab6b7bc85a22802bbf89c88558c7cb3e749e0c205a0ba24d4", + "README.md": "sha256:4e890352ff6088a2e018a11738a1959971b07b584a4ca3b8fb2aed88b9ea26f1", + "SCOPE.md": "sha256:ba38e80cf2a374063eb6b6b60211a02e32bca5d3b260aea5f8a70978f67a5627" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "approval-engine": { + "head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:06dbab07ed14fa43d0fc6b54eaacc2b3f7b4a9196050e3f73c9c4e58086636c5", + "README.md": "sha256:4d095613decf7d64012e19d4e76823296bdbeedc82cae17c9b5cf752671b45c9", + "SCOPE.md": "sha256:1425d4ae5942cf09197719b1f66989c4d5e8d2d5627c7fa79dc6151908b03990", + "approval_engine/api.py": "sha256:4c686aa3b4d645c4ad2a84a5f299db9b013b59a5c747853837adbe3a3a05be63", + "docs/production-dependencies.md": "sha256:c2244e4a72dc174d0f5e9fc7da6b56fac2596d4b553a11c738976404cef05fa8" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "audit-core": { + "head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:cffd7a3730ea54dab4e745329005813011bb821d9922d9a6aff3977ec46162c7", + "README.md": "sha256:c7ab22ae28d07afc746d7cb10e168291dfbc3207be60cd32ec416ff0f27f51f1", + "SCOPE.md": "sha256:358ecab2cf8e32567f2220c5cd3d9b3f7ce9349faaa8d89bc464d5f82f09e80e", + "docs/stream-completeness.md": "sha256:e3c4b1e0ff5bdd648077ae0b6473a0094ccb4a65e8ce398df11aa43faf0d65cf" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-08-16", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.audit.event-retain", + "name": "Audit Event Retention", + "summary": "Collect, normalize, retain, and search audit events with integrity evidence across tenants.", + "joins": "operations.audit", + "provision": "data/capability/audit-core-operational.json", + "vector": "D4 provision / A4 / C3 / R2", + "domain": "infotech", + "status": "production", + "owner": "audit-core", + "path": "registry/capabilities/capability.audit.event-retain.md", + "tags": [ + "audit", + "retention", + "compliance" + ], + "consumption_modes": [ + "http ingest", + "source module" + ] + } + ] + } + }, + "coordination-engine": { + "head": "c401067842072b75717f76480dd6e7db1836059c", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:7236c8dc284fcbe81c47eedde25e197d5a911a73267bfd448f8930140d2f6fd9", + "README.md": "sha256:fa6812b74956387a85cf07ccf3ef05f79aa07ca937e6f5d073edd318238e768d", + "SCOPE.md": "sha256:e207efd8bf40ede4ad6c2705121cefc809467dab72746054850c62f2e2e3a12e", + "spec/cross-owner-wait-mode-v0.1.md": "sha256:42f51f8dd1523a1243797fc3fc21a0d6d756c4e9d9d77142296735c1ef6de915" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "emergent-security": { + "head": "4c6fda38298fa50665ead41526b893adf069d335", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:64daea4874c8d8822a52437b15ffc8f9d5e30491dd0b61d0958bd186d1dc7269", + "README.md": "sha256:40e23e0233f5b33949fc25047cea13b827af3d44bd73e00b3c4eb8b1feb338cc", + "SCOPE.md": "sha256:b90916cef962e5999c8fee886f5d0b68f55707a38f428a20d0390d2bf2c0d603", + "knowledge/cards/start.md": "sha256:698a18f4a8f97a43da75ed0767aa0425c970e17c04a9cbea75cfab719564cc5d" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "fin-hub": { + "head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:7697ddd29c8324197c925378c55eadcbf89899903af4321d0325f26e52ca3d19", + "README.md": "sha256:f35fb3d21f6264f8fab0ab204b79c81f82e6f9764ebc06aa0735d330ad854470", + "SCOPE.md": "sha256:2ef38e5d1a36dedfa7785f128a35b0058ae7e123bba834efa41dcc809d18a631" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "gate-house": { + "head": "bc890c4d050a2e726ce8988a8260ab9caea133e3", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:013692bbb52ce85dc1ad8dc95292c64d4e7c2c58714549a1e23331eae5d556e7", + "README.md": "sha256:e2c7b7c94884260f4e3e33d963544299a6076bd63729baa0e03e0bb34c423002", + "SCOPE.md": "sha256:5c7b9bc38fa7887f2188c34cb1110e37f47f2b9ebc4f33e85ef96ef80a1c9a79" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "glas-harness": { + "head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:d9c256243816e372757a256b0c2b87f5a0333fb1d65f0488b66600f985553cf2", + "README.md": "sha256:23179d6a1760e442fa025ac73aed050ee0141e985e87979c0a05781fdc2ca350", + "SCOPE.md": "sha256:5a2b96f8a3aa7218ad43dbd72abc89319a44c329298e973589f49c4ec354b0c6" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "info-tech-canon": { + "head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:aa739b333929bc5d36a0654ef5afea1b9dedabad38da0c335f3d8b0f17a38bad", + "README.md": "sha256:55f21ebac58356dabdd032d4396a6eb0e3af4c5d13c900667fb79827879b58b1", + "SCOPE.md": "sha256:342ee894c1d6d64da76ff521eeb3c21279c55c6e7b7f0892b34f54c2d89e91b3" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.infotech.canon-service", + "name": "InfoTechCanon Service Surface", + "summary": "Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon information-processing infospace, backed by infospace-bench.", + "vector": "D2 / A2 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "tags": [ + "canon", + "infospace", + "service" + ], + "consumption_modes": [ + "cli", + "library import", + "http api (read-only, local)" + ] + } + ] + } + }, + "informed-decision": { + "head": "ee6a65b80a0fea1a914dfa31434b903669656c09", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md" + ], + "source_sha256": { + "INTENT.md": "sha256:b543c2d80b97182393e2d080ae8fd3759f2e956a89306c2c568c0010e7425eeb", + "README.md": "sha256:7d2bcb581348c4cae55b59550eb7a9ef34abaa928375acae28ec41878c5abb7b", + "SCOPE.md": "sha256:ab352aa1a88ca53106517b14eafc62a3cb6504519638835227e6f852b3cdf68b" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "issue-core": { + "head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:fb6e1f77fed6b5ae110fdcfb92dd96263050c1907702a1f380895930a8ad0dd9", + "README.md": "sha256:00281e7af8fc9c8f9c41a46a71a959faea4c6db1c08c6c4b5b3fe3a5808b271a", + "SCOPE.md": "sha256:c43d8c15cf0b85dd8558bc0031a0662d668de9c0394eb2045a7735d044d7ed0e" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-07", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.infotech.issue-tracking", + "name": "Universal Issue Tracking Coordination", + "summary": "Unified Python/CLI interface for issue tracking across Forgejo, GitHub, and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "tags": [ + "issue-tracking", + "coordination", + "multi-platform" + ], + "consumption_modes": [ + "cli", + "library import" + ] + } + ] + } + }, + "key-cape": { + "head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md", + " M src/internal/server/oidc/authorize.go", + " M workplans/KEY-WP-0039-openbao-negative-probe-tokens.md" + ], + "source_sha256": { + "INTENT.md": "sha256:b22cb440691bb399b064ee10ab1a03e1e07838da1051bf6235fbfe2cf820eb10", + "README.md": "sha256:953586cca96d01e9240448186b922c9b8ea03827a7f314731e9a9ead4f19d0d3", + "SCOPE.md": "sha256:20fbadf3e33339bca4b541cdfa33a0de00095c968d51006dc4d0a46735cc834f" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.iam.key-cape", + "name": "KeyCape Lightweight IAM (NetKingdom Profile)", + "summary": "Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against implementation internals.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "path": "registry/capabilities/capability.iam.key-cape.md", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security" + ], + "consumption_modes": [ + "service (self-hosted deployment)" + ] + } + ] + } + }, + "kings-guard": { + "head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:923fd2ce1a22c29d486f562071a0a251c16b64fbb5d73490cac4d373daa0c83d", + "README.md": "sha256:57983baf2275d9afbd5109782cfe1f3559145f4ee906ea97345c6d517a5e4fc7", + "SCOPE.md": "sha256:8e77e587c67aa419df35d4f642468bb57bc30df65e1ea6a922fdca282ea9ed63", + "docs/SecretUseSnapshotAdmission.md": "sha256:7fd32df4c8203d83aa14334ccaed0700682730679539a5c657d93f5efbf5d31c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "maturity-engine": { + "head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:d17b9169ad82b60450244988dafa3ab4a515790ee08903a7fcee9df5fd8eae0c", + "README.md": "sha256:66333483d63f45c2dd744661610d062440569955bb150927ebd9d21d72b85daa", + "SCOPE.md": "sha256:653f47b0d370dfdb45c723b361f6fee53be7e384732c201443d7238c04d155bc", + "docs/claim-contract.md": "sha256:082490f3651db8f771dfd72c42f5c5df4c3317361c9dec1ec0f0dc9814f80a2a" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "net-kingdom": { + "head": "1a36e857cc5aae6fe738f794417126c46dd94627", + "branch": "main", + "dirty_paths": [ + "M WORK-RECORDS.md", + "?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md" + ], + "source_sha256": { + "INTENT.md": "sha256:fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54", + "README.md": "sha256:25172bafe09fd3a26467d44a74ca90e8f123bc81bfa2784a483837c0e9efe9fe", + "SCOPE.md": "sha256:0f896db98d03aa7460d88999b738ea00be87dd34fe0b250f11bf0b6f170b0172", + "SECURITY-COMPANION.md": "sha256:06374445ca888549f1bf79527d1345d94918d7a7ec363160d8427d0e7a31d643", + "canon/standards/security-case-types_v0.1.md": "sha256:a4fda906d5138d2594a1f8d047c7c28e1cdf96b1eae051f543b9a5e5852bcb5e", + "tools/custody-record/README.md": "sha256:ec653a17b4f35e56d37824c1db15f1ea6b1761c564863fca4ea168a3ed625000", + "tools/emission-cadence-profile/README.md": "sha256:a4adadb43b0d55f7d705d89166ef63ce01aceeff742b260039263dda92ce85b8", + "tools/posture-feedback/README.md": "sha256:83b8de1da01de77318e950c9266e5f2755091dbd0e5a318d75bc5cc8f556ef18", + "tools/posture-feedback/posture_feedback.py": "sha256:629779308e4965be3aabbb76f105fd9c8b532c64987915d2ccab5b543273bfe4", + "tools/security-bootstrap-console/README.md": "sha256:bc1af3598d667346370a476d0765bff1f0c3ebb57f751c4da6e61a4add29f30d", + "tools/security-case-types/README.md": "sha256:03e1c503bc60990214d5b1a7cec8878cf47fc892d82c82d682f3490e33dc71f5", + "tools/security-scenario-composer/README.md": "sha256:447554e04816c0bc815f57d9138430d354790c9f3813e48bbd38fee034f98015", + "tools/security-scenario-composer/security_scenario_composer.py": "sha256:9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-08-23", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom Security/IAM Tooling Suite", + "summary": "Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.", + "vector": "D3 / A2 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance" + ], + "consumption_modes": [ + "cli", + "local web ui" + ] + } + ] + } + }, + "ops-bridge": { + "head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:2134f693649803414d7ab2f9839416f1fe06169aa86732e64c9dd962c35f412b", + "SCOPE.md": "sha256:63cd52d1cdf38e72af0285c25aa2292f959080c6befe565a1d2690747a813975" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH Reverse Tunnel Lifecycle Manager (ops-bridge)", + "summary": "CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.", + "vector": "D3 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity" + ], + "consumption_modes": [ + "cli" + ] + } + ] + } + }, + "ops-mason": { + "head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:482269782f4fd337f83674b4e2c36a5cd9f8eb694918e55709e9a7e78a003c71", + "README.md": "sha256:9e0c9b5c76c3a2d4aeeaf032579e96d8da9056662ac4655b8885b16ed7f3bca5", + "SCOPE.md": "sha256:7da4c8c660b1c8d15675768a5f6040303fe3ca3b4f05b1bba4633be3cc6e0c77", + "docs/construction-plan-format.md": "sha256:468678089885193b8fefe3993cd6878bbdbeaaa64aa088b18b90047b696ce564" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "ops-warden": { + "head": "6d2f1be9691b19e826898a2166ae4451e4802ae2", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:3e9382fefa52ee0970dfac133cc799656e5034760b26dccc1bf9bab65fc538d9", + "README.md": "sha256:1f11071d7fd651806da180272cc4aa4e3ae19d7bad0e321aa97c7dcaea7f2857", + "SCOPE.md": "sha256:47b47468746617c84f8411ac671bb488ab740b4c3133401f5d7b55d3d024345f", + "wiki/CredentialRouting.md": "sha256:544530cc13052e33d2135fa3b0583e620010abb0af86079be6d8e09c36844646", + "workplans/WARDEN-WP-0044-security-case-follow-through.md": "sha256:c0029545bd2d8c015ae0cac87f6d53a2e5ee935b7bf5d5e1b81bf1ff5dbdc4f8" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-17", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.security.ssh-certificate-issuance", + "name": "SSH Certificate Issuance", + "summary": "Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward NetKingdom operational access routing.", + "vector": "D4 / A3 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security" + ], + "consumption_modes": [ + "CLI", + "cert_command subprocess" + ] + } + ] + } + }, + "policy-nexus": { + "head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:58b95e4e158da6b978b9bd3a2ecbaf7f279553098906a8e8ed404afd3d582494", + "README.md": "sha256:cc3a825974a8cea0c737a16cc8b06d3fec56e10f593c6ed7169bc54786df5a81", + "docs/publication-contract.md": "sha256:65a9a233201ba966db0f2c5465ff3b0684147af3075f43180b8eefb3e059abb4" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rail-kubernetes": { + "head": "35159e49c1340b7a0e30c49188975c8839d346f6", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:72a64030f25f0474e4f3837860d3eba60e3d5a1c2b31e8f6d062e15da8f209c4", + "README.md": "sha256:89c6c0155f3d9829c7d0ff33f27883ed2fdd8f6d857eae013656136467296cd2", + "SCOPE.md": "sha256:00fce3ee7cb4bbbd7eff210adb2a03c533f2b43870f7327cfc35f28354bb549a" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "railiance-apps": { + "head": "706461b845086ee2df8ce9acae3dae7feebfffda", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:31060dc1738aa4540f78735019359a276ece39dad8afbf1be740713bebbe65e5", + "SCOPE.md": "sha256:8243098d979d4258c9e7f9e39b5de24ce78b521cd82a7e199028df30bc130b14" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Railiance Application Workload Deployment Tooling", + "summary": "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack \u2014 application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.", + "vector": "D3 / A2 / C1 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment" + ], + "consumption_modes": [ + "cli (shell scripts)", + "helm/kubernetes deployment" + ] + } + ] + } + }, + "railiance-bootstrap": { + "head": "ae00b2652737aaf18358431e66f59eeb7c01e16b", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:c1840c7df1cb87d72a22a7b1bc95417687a0a9d9355b6ffb50392d8bf6ae241f", + "README.md": "sha256:3acd2adcf4bf3c3801be99c95d96da8ac7638f5a21c03d6f987505402a00afa6", + "SCOPE.md": "sha256:4efdd7f7817e39c01d6024e2f8bcbd70c2b10b90baf9f92855bb3967cd629831" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "railiance-cluster": { + "head": "12d1e881ff2086566712fbc591db293b38ea2bcf", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:a00fe12563c77734e19b538ca8307d44fcfae9f040bec284c705146f99bb3490", + "README.md": "sha256:5c82b7c31adb126e1f95ccd5057156888fff73a05828abd5e8ab3e013c7fe59f", + "SCOPE.md": "sha256:e4f6a8dd3d72a1f04f0d94721d57ca2a4c7e98790a8373876a5005b87ec5d8a6" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Railiance Cluster Runtime Bootstrap", + "summary": "Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap" + ], + "consumption_modes": [ + "cli", + "ansible playbook" + ] + } + ] + } + }, + "railiance-enablement": { + "head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:5a562d3f019156969948315e8072ce925c81e21d027a47096e21c8535473a588", + "SCOPE.md": "sha256:2a554aef6d6803f1a176ea3bdb3bcc0f077f03d131b0a897a5ec56bd6df85f88" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.ci-enablement", + "name": "Railiance Developer Enablement And CI/CD Templates", + "summary": "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime.", + "vector": "D3 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo" + ], + "consumption_modes": [ + "ci workflow template (copy/reference)", + "cli (promote-repo-to-forgejo.sh)" + ] + } + ] + } + }, + "railiance-fabric": { + "head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:1cdca96e57849709aef333c88ace903f9573eeb2894f52246e473928c7e3846c", + "README.md": "sha256:8705fec071bfe75d3bdfcc5677ac8801f5d66b5ee3a49043cc8d019443a1fb8c", + "SCOPE.md": "sha256:b80d4a8b39c2920818ba4069318f888e56736a0f0e8d40f3a72568b0472fb36d" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.fabric-graph", + "name": "Railiance Fabric Ecosystem Graph", + "summary": "Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery" + ], + "consumption_modes": [ + "library import", + "cli (validation)" + ] + } + ] + } + }, + "railiance-forge": { + "head": "a15fac8e938c11b041eb39386f05b63d46ae566a", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:310d6ad12a1f621c05396a3d6aab19ff8a6bacc4f67814e64d07f09da124ea54", + "README.md": "sha256:e10a07e1b8935a444699ee456f6d3f98e02109d7e453db41823a31261d181b2a", + "SCOPE.md": "sha256:dc4c179e33898e32fae7b2e8e30e88a66d9efc3ad2f488651ccedf600274c1b8", + "workplans/FORGE-WP-0006-independent-secret-detection.md": "sha256:fbcf3f75e884f6c90554c05525d787f61cfc2b915a206e6010bed447e7a720eb" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.forge-infrastructure", + "name": "Railiance Forge And Artifact Infrastructure", + "summary": "Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner" + ], + "consumption_modes": [ + "cli (operator tooling)", + "documentation/runbooks" + ] + } + ] + } + }, + "railiance-infra": { + "head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:00d05aeeedd6e11527fdacd35070a37c0b67ff16914ed6ce0f634baaded5f1ae", + "README.md": "sha256:dcea6117a34fa466e75c7943fb43dcfc42eb8f6f6c9c5207458eb7621e694ced", + "SCOPE.md": "sha256:18cdf933d658eeddcb68528bb9c222ceb0866d8c5f0ec4bb3ea955de762c3c33" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.infra-provisioning", + "name": "RailianceHosts Infrastructure Provisioning", + "summary": "Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth.", + "vector": "D4 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure" + ], + "consumption_modes": [ + "cli (terraform/ansible)", + "gitops" + ] + } + ] + } + }, + "railiance-master": { + "head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:dacbc59b7d42412e3e65d3d16ce058d0bde486e16435112c7abf83b696572eda", + "README.md": "sha256:4a706ec49c177ef13343ea3e56e61bf5a7bd6c601562b301a87189690ee800ff", + "SCOPE.md": "sha256:63ebaef0397795257650521e6f3be6b46cca1142f53b1865d9df9ed0c0530fc8", + "docs/netkingdom-security-consumption-contract.md": "sha256:be50d016b7cd14ac27127a2c641c4a9a0c8d1605495ba62ba5cf30ef0f65bab7" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "railiance-platform": { + "head": "d303c99e3be993ffa989bc9ba3d7b471903858ce", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c", + "SCOPE.md": "sha256:bb18dc91f3be50337d7ebc81d269f1234f65919f7014eef990b09c3df54a5347", + "docs/openbao.md": "sha256:9c92b0e30c81351b258da44df46720f4cdd2941488a7ca2f8687b8937da8099b" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.platform-services", + "name": "Railiance Platform Services", + "summary": "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres" + ], + "consumption_modes": [ + "cli (shell/python scripts)" + ] + } + ] + } + }, + "railiance-telemetry": { + "head": "81d905971c38de9aaf11088ba605e112152d8268", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:de793b403514f8c7984ba7c20608ecca9d1fea422d3fcc20ec186a0d7c2f2f47", + "README.md": "sha256:4fdb18006ab2e5a0c4d72127324a88c7abacb55a30b80de6a95e55ce46c56468", + "SCOPE.md": "sha256:206279dabc14fe1a44ba6df8ad2b664cc91d3460379b732951d3e29bb6a814da" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-openbao": { + "head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:28b74eec385f6cef4f8c846992f10b6067ce436cb9d52de19338dd57c111f90e", + "README.md": "sha256:9964de809b5b645c24871774621747f9d6ce2f069443d507b9ef9616ee255d85", + "SCOPE.md": "sha256:cdcf80122c8c55dfe697312d6cd67b76861f322cae9816b85123aefe2345c674", + "docs/retained-s3-handoff.md": "sha256:d1b2f27f740176ab16f6b4b589b0c25dab41c923d6f377d84059ec8369c0a3b6" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-playwright": { + "head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:b719684974f35812708e562cd8c0b4573662ae22fd12f4252bd4abaca627882b", + "README.md": "sha256:e64daa81de97b3d2c6afe4028f9a2d4aca6e9892ac36a798316a8d8e8fa80ce8", + "SCOPE.md": "sha256:c1489a7b75a87a3a8b00edb9b9497d256b0e5ec72d5fe5236cc038745215dc91" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-policy-nexus": { + "head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:a3ae592c56822697ad24bd64851578b5b17f1a9bd8622a247e3e425a5de594c7", + "README.md": "sha256:41c1bfeaa90d11f4778d22a3e58a97cb9653d153712657ff2e3aecc45dda240f", + "SCOPE.md": "sha256:dfb85b48d6ff68a9945178a5fc1b85f1d342f765d046a58285e7edc52f517438" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-postgres": { + "head": "03744030c9258e920f6403a9ce184a26d7b75268", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:2a9ce4f5eb8fbbffbaeb8532a677c855b97973a6028536520018ccd1796a4735", + "README.md": "sha256:298079470d931ab78d79a0a44274f207606d6a877740d79a8925d9c37f8ff15a", + "SCOPE.md": "sha256:5919caed210fc8c6977845b3469ebe419b0216f6aafa69e01a40b9d12d6050bc" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-telemetry": { + "head": "17053dbc47f7c22efd67fd90d06d108d154835fa", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:fc3ac98e40f67384f3ff94ecf223d89f0713c031ba5ca6093320278b269e4276", + "README.md": "sha256:fd797950ffaa67123773da7cdfa6e45984f367f820caba7c10e0fd300f96d630", + "SCOPE.md": "sha256:3776b5924bd90f8114e77f7bbbcacc7f3713cd56ca26440a3e4bce792ce8b142" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-tenant-engine": { + "head": "c160be23577ab4d99ee2cd008deb455b07f0597d", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:5eb0a651c1fd20a7d60a3a30060431925d2fb3ed64cf6ae22293dcc5546c7251", + "README.md": "sha256:05596b39a47fa22cc4e966714c4c755220894ca54c7759cdd3088e78b31c00e6", + "SCOPE.md": "sha256:fc0c5a80f37c410c10eb29a7541ca37088668e5f76d64ece4e889c7f0145a13d" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-user-engine": { + "head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:891150bf022c2456d62c234db10172a16cb2e1a9c9aa5284aafd5d89755a82fb", + "README.md": "sha256:f1d89f8f1c1cc67f2b79bd2bd3dd94b9a895fcaf308c44b5d8d23fc7b9f1bb7a", + "SCOPE.md": "sha256:732fd68b194d034e81faf170d5a69e1d61cfab5385457b93a5f5689a63a2f184" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "reef-railiance": { + "head": "ffb9e272ce1489cc37cc6388873558d8ba56c239", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:deb16216816dfcc1c42c2d826b6fcd496d9c0e6789169c0312e0bc9d0fa88781", + "README.md": "sha256:31480d89ba5a8f868c28c2b09f62a51d662aad6a0ec93a56340fed39a789c395", + "SCOPE.md": "sha256:a273078d5dc7ceb72bbdf5473b5146cd624411b08bdc6b1e7d78113c4e675cc8" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rein-aharness": { + "head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md" + ], + "source_sha256": { + "INTENT.md": "sha256:f9a35aa6f9c4803a1d978aeb487ba475830505670871c564a5fecacb77b11ec4", + "README.md": "sha256:da0f62f0eda7bac0018151b73ffa2bcf9cab9dbd796adb285c738c435853afc3", + "SCOPE.md": "sha256:d9979b35ec0909f76e6c34a0f40de2e5cbc700d1bb5c7b5f73c6e2b20e3cbc48" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rein-openweights": { + "head": "e1fccb39b738a5381a9de6e1d799f124797798ce", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:e1284da2b06a44d93e050638d34ab8abf15173bed77f82788ddcc32939359cd6", + "README.md": "sha256:0eb6e6225727770985c4b6442acdb17e8a0d5e707c25aaeb561e47b921f6aa74", + "SCOPE.md": "sha256:f7791a1f858cd7225e217b9b53213066e44ddd7ac4a1e748383a2c8756d3aa3c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "repo-manager": { + "head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:62afa83ecb1fd733abce07489d48d0d7c7e14ccf9def9f561c118cf8ec5409b2", + "README.md": "sha256:9330836f65bde7466f7a1414f4a6df28682acde710aca0ea3e45be429622c75c", + "SCOPE.md": "sha256:bca5806e11f04e4550ce5c147d4d98e6c0014fed1f17fa3f134e5b193adec43c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "resource-control": { + "head": "3604d468f86ede7d320f4d22dd4aea775306b53f", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:f81326a4f18e284d8f7ca73f71dbe9502b7a75b1d567074e9bec48ebdd968309", + "SCOPE.md": "sha256:2daf0899d730bb6da30bd471f364061b86428cb5e38573df9d5551aff9dd5e29" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "reuse-surface": { + "head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:511d1029a7aefc67b68a6363ed3ce8f803f2516c00062ff805263dffe26c771b", + "README.md": "sha256:6e4dc8d382612320cc2c8558ad583b0564ff594a7032b33137cb7a61887621cc", + "SCOPE.md": "sha256:2c30972ceb2a643147ce61c04c6919b16797b6754c2a407df998c81ce76c9c30", + "docs/RegistryFederation.md": "sha256:bfc80be5eac1250189ac2ba726a6188c03928ccf1e9992ec58cf59e58009f289", + "schemas/capability.schema.yaml": "sha256:3b0172baa4e6d54f400e911af6adb0d86b4576b86d7aea6d8f18c3fce3b8ae3f", + "specs/CapabilityMaturityStandard.md": "sha256:3eb3c7e1dd51b85e993c9936b2a176f6b3998e6198666695bdbb5b7ba7d8b17c" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-10-13", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ] + }, + { + "id": "capability.registry.register", + "name": "Capability Registration", + "summary": "Register a new capability so it becomes visible for planning and implementation reuse.", + "vector": "D3 / A4 / C2 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.register.md", + "tags": [ + "registry", + "governance", + "meta" + ], + "consumption_modes": [ + "informational", + "markdown authoring", + "cli", + "service API" + ] + }, + { + "id": "capability.registry.validate", + "name": "Registry Entry Validation", + "summary": "Validate capability registry entries against schema, index consistency, and relation integrity.", + "vector": "D4 / A3 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.validate.md", + "tags": [ + "registry", + "validation", + "cli" + ], + "consumption_modes": [ + "cli" + ] + } + ] + } + }, + "risk-nexus": { + "head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:38783193bce6e05a502463a0965341fe7940cc98d72c800c7d70a36e9defae83", + "README.md": "sha256:05dd751b2569801f5bc0971b3ebeeb263b3488a880cb334c3b4f076ed15d6ceb", + "SCOPE.md": "sha256:82e5f7476f5ebe327bc720691f858f3dbac3990da6860ac8114f83c3b287394c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "role-engine": { + "head": "d231241dbfeeb541b34243f4022883aa6417a1eb", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:06678fc42521c91514ef9684674479c70ae47ee829e7a1e5e6c5d7ae54c0d7a2", + "README.md": "sha256:a98b021f59566bce52d02b7f7e2c9f2d3f637f9357037c54d752c69a13cb15bf" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "runbook-tutorials": { + "head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:6a96bddd785357c6084d3137c66c188b9266f9e69cd1ad6e2c2562106a296b63", + "README.md": "sha256:747bd15db6182f5f473a4a774ade282d14341f63ee427c0cd862cbd3a6c0a6d0", + "SCOPE.md": "sha256:5da9ba54026809314e6c0d97894642ca705793cb752c8a9cb535551cef9aee5c", + "docs/pack-spec.md": "sha256:075a67476ba9226e79bc955caa039c9c1bad6ead96a7e61fb8e68b8ea56d2a0d" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-09-29", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.infotech.runbook-tutorials", + "name": "Runbook-tutorial engine", + "summary": "Engine, local UI and CLI for guided, parameterized operator runbooks; packs live in the repos that own the procedure.", + "domain": "infotech", + "status": "active", + "owner": "runbook-tutorials", + "path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "tags": [ + "runbook", + "tutorial", + "operator", + "guided" + ], + "consumption_modes": [ + "git clone", + "cli" + ] + } + ] + } + }, + "sand-boxer": { + "head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md" + ], + "source_sha256": { + "INTENT.md": "sha256:a87d81568311ae5bee941183f10eb23fbe60541dc41d2c5a7fbfbac52a89dd37", + "README.md": "sha256:d5038e80f041429f8f8f8e2fc9b2b45a223a5478731ab7c75592378a174e0d2a", + "SCOPE.md": "sha256:68f4623825cc54ebbbe777b0abd78a358cb3232bf2f6577980c6fc945a80ed7a" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-22", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.execution.sandbox-provision", + "name": "Sandbox Provisioning", + "summary": "Isolated execution environments for agentic development, e2e testing, and bounded automations \u2014 profile-based provision, TTL teardown, and State Hub lifecycle registration.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "sand-boxer", + "path": "registry/capabilities/execution.sandbox-provision.md", + "tags": [ + "sandbox", + "isolation", + "provision", + "e2e", + "agentic", + "execution", + "profile" + ], + "consumption_modes": [ + "CLI", + "core library" + ] + } + ] + } + }, + "sbom-nexus": { + "head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:0e3eed8bc510109f615d0739502cf15c2aa5a025e74db01a6cedfb316f2d9e58", + "README.md": "sha256:8cc888ebf6370cabb1cfe1539b11e372e3f432dda2aa303c8470a5fc32f70844", + "SCOPE.md": "sha256:32f6e853b366c5097b3ab1a3d05413a0091ec48585de4def7adcbacd57da02ba" + }, + "missing_review_artifacts": [], + "existing_index": { + "schema": "reuse-surface.capability-index.v1", + "repo": "sbom-nexus", + "capabilities": [ + { + "id": "capability.infotech.sbom-management", + "path": "registry/capabilities/capability.infotech.sbom-management.md", + "status": "emerging" + } + ] + } + }, + "secrets-engine": { + "head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:188dc6d99ca9a441e7389a3715ba48275ab6e8745deaff686bd27d2aac34d678", + "README.md": "sha256:6c85cc0e1f57fcc06ef00368d0b7ea1a02657a8a1358bebc38be446be20deeed", + "SCOPE.md": "sha256:d77af9b9bab0383928120b80ed4a70f471cf244e22718ee6feb6039a70aedf6f", + "src/secrets_engine/decision_check.py": "sha256:a8c9a45320b752871bf6b8238cc25074e8f08ed29fee131e99030606fc091e6e" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-24", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ] + } + ] + } + }, + "security-canon": { + "head": "1664a6def20be2759a1e575024563efd27c9f36f", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:d2e8ebdbc9500b613162c45145f50fd88471beeca3e96ebe6c2df5d85d07539c", + "README.md": "sha256:0ab66ab06438b14b86cc67ad0084ef88126618a283a37baed663176709ef1236", + "SCOPE.md": "sha256:74ebe3d738fa554be113866e82cd2b049c49b4c7a302c61f21ffadf31c297ce8", + "infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md": "sha256:f79a6dfe1067028810677426cb7e8c5be16735074121437f3cc97849d08fb72b" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "state-hub": { + "head": "8ca9201f6a1445c66fe1d1b0ba0c8d044c131647", + "branch": "main", + "dirty_paths": [ + "M api/main.py", + " M api/models/__init__.py", + " M api/models/agent_message.py", + " M api/routers/messages.py", + " M docs/inbox-change-feed-contract.md", + " M workplans/STATE-WP-0094-routed-gates-and-owner-returns.md", + "?? api/routers/message_feed.py", + "?? api/schemas/inbox_feed.py", + "?? docs/evidence/legacy-meter-weekly-review-20261014.json", + "?? migrations/versions/c4d5e6f7a8b9_inbox_feed_revision.py", + "?? tests/test_message_feed.py" + ], + "source_sha256": { + "INTENT.md": "sha256:4888ffa0a126a26bef3ba94658c76c3a23dbdc1399f4686c94e325b9d934e85f", + "README.md": "sha256:af3dde630cbc54664aab3681190e3095f04facd4e9b3fbc9cac7c279df05fc2d", + "SCOPE.md": "sha256:cfdd20b8718d92db1413c9bfcccdb1ae1e7fdee638aadcedf6508cee9f7c713f" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.statehub.progress-log", + "name": "Work Progress Logging", + "summary": "Record progress events, decisions, and session notes against workstreams and tasks in State Hub.", + "vector": "D4 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "tags": [ + "state-hub", + "progress", + "coordination" + ], + "consumption_modes": [ + "service API" + ] + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Workstream And Task Coordination", + "summary": "Track active workstreams, tasks, progress, and consistency across domain repositories.", + "vector": "D4 / A4 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "tags": [ + "state-hub", + "coordination", + "workplans" + ], + "consumption_modes": [ + "service API", + "HTTP REST" + ] + } + ] + } + }, + "tenant-engine": { + "head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:c2deaef01f7492ca1b39f52e36bf703f6a55b04158b2888b7befae73452ce285", + "README.md": "sha256:4beddb32ea5dae1f67e0b489b63f13f7ba9bbc4d3c7f27b80957a199bcf144e0", + "SCOPE.md": "sha256:63f86c1bc39110db862fe60e273703463415e6e0365e4c058ab6c65be399d62e" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-23", + "domain": "infotech", + "capabilities": [] + } + }, + "the-custodian": { + "head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e", + "branch": "main", + "dirty_paths": [ + "M WORK-RECORDS.md", + "?? docs/assessments/netkingdom-2026-10-14/", + "?? workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md" + ], + "source_sha256": { + "INTENT.md": "sha256:6ccb4f1f2c8a87f27d59dcfcafaa654d68ff90ba09b94c863d5d444b2a35052c", + "README.md": "sha256:238b643e0c94446cf04bc8ac5d69e4c57d0f681825b5c45b9d444e6198f83f1a", + "SCOPE.md": "sha256:6d64208332890f24f04ae8d6f9067bcd8ed3b541e245fb2649ea3435f401b459", + "runtime/README.md": "sha256:c9bcfe727705b1503447d863f6fed4a84e97eb18a84b335c9073dac6dbb756e4" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Custodian Runtime And Repo-Classification Tooling", + "summary": "Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos.", + "vector": "D2 / A1 / C1 / R0", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "tags": [ + "agents", + "runtime", + "classification" + ], + "consumption_modes": [ + "library import (runtime/)", + "cli (tools/ scripts)" + ] + } + ] + } + }, + "user-engine": { + "head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79", + "branch": "main", + "dirty_paths": [ + "M workplans/USER-WP-0035-onboarding-handoff-findings.md", + "?? .claude/settings.local.json.", + "?? docs/evidence/2026-10-11-setup-link-owner-handoff/" + ], + "source_sha256": { + "INTENT.md": "sha256:8aa0f276e0879d3545338727188a1fd5af973c43acbfa986a135b20979ec7ba4", + "README.md": "sha256:74f788850117b3a1d6a1e06f68a26cbf699f8da9a27ed58d68d552a6e40dec3d", + "SCOPE.md": "sha256:0e863e1cc93e2aac373f566db4a4445348a930029a1c0968cf8e30c456b003e8" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.identity.user-engine", + "name": "Headless Multi-Tenant User Engine", + "summary": "Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.", + "vector": "D4 / A1 / C2 / R0", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "path": "registry/capabilities/capability.identity.user-engine.md", + "tags": [ + "identity", + "user-management", + "multi-tenant" + ], + "consumption_modes": [ + "library import" + ] + } + ] + } + }, + "whitehat-security": { + "head": "5587a8f6ac4b129527db819bc72832051c7fcc3b", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:acef2293815fb9bded28a60ee1bc47c196bb38541a28265d895d69ae773731ba", + "README.md": "sha256:3ddf3898b71ffaffec497e4e821f2a048d3cec1ae4269872b203db3422e14aca", + "SCOPE.md": "sha256:394dc1d432d4dd3eec735289ef83a8beedeb3afce667f5a8c3a052902a1e26ba" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "zone-engine": { + "head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:7684ce5960c2623fe4a295e17f777326daad88d6d7c274002a71cf6046537c51", + "README.md": "sha256:194caa3a00b9ff041511a7e7a7c550f8e2b2906d1e71f2a9b05aef3220039806", + "SCOPE.md": "sha256:953dbf718481adae00fa53258ede0632df65bdc7f6a1cb3e1dd3344357dba80d" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rail-knative": { + "head": "cd38dba3653e7fc85d3b2d3a074811b9a7216f25", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:8df1e3a222f32462b682d7a2e655913051d289303e899e71eb2f43fa1ef1aa7c", + "README.md": "sha256:6e8384a5753332735e9947884e7a52721d4145bb91a1061ca8c4ac63fb7ac4ec", + "SCOPE.md": "sha256:d5c9f0433a25825ce2b77f6caef8bc20dba303b07596233904975226e33e3d87", + "declarations/rail.yaml": "sha256:4a33c43a098657acbd7d43f1790473e22363be744b19c2d3fb035da205d204db" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-sbom-nexus": { + "head": "1566bcf69fc0757db5efc67f78b14af10d944c1b", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:15cb4502390da82fab13acdfd75b393b0fceb76183811080f097c768e0c2a417", + "README.md": "sha256:1fd7e5f69efdba122b57508e17dc001f623fb80a3f5ac0de093fbbea8ad07a76", + "SCOPE.md": "sha256:a20b2c4492a6ff54986e79d40836e7633a4b6ae578330fb87c06eb41aaf81f4d" + }, + "missing_review_artifacts": [], + "existing_index": {} + } + }, + "inspected_nonproviders": { + "rapp-secrets-engine": { + "status": "retired compatibility stub", + "source": "/home/worsch/rapp-secrets-engine/README.md", + "capabilities": [] + }, + "rapp-forgejo": { + "status": "placeholder; missing declarations/rapp.yaml", + "source": "/home/worsch/rapp-forgejo/README.md", + "capabilities": [] + } + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-after-publication.json b/docs/assessments/netkingdom-2026-10-14/hosted-after-publication.json new file mode 100644 index 00000000..b2a23c7c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-after-publication.json @@ -0,0 +1,2154 @@ +{ + "version": 1, + "updated": "2026-10-14", + "domain": "helix_forge", + "collision_policy": "warn", + "sources": [ + { + "repo": "access-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/access-engine.yaml" + }, + { + "repo": "activity-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/activity-core.yaml" + }, + { + "repo": "agentic-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/agentic-resources.yaml" + }, + { + "repo": "artifact-store", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/artifact-store.yaml" + }, + { + "repo": "audit-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/audit-core.yaml" + }, + { + "repo": "can-you-assist", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/can-you-assist.yaml" + }, + { + "repo": "citation-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-engine.yaml" + }, + { + "repo": "citation-evidence", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-evidence.yaml" + }, + { + "repo": "citation-work", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-work.yaml" + }, + { + "repo": "commerce-canon", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/commerce-canon.yaml" + }, + { + "repo": "config-atlas", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/config-atlas.yaml" + }, + { + "repo": "coordination-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/coordination-engine.yaml" + }, + { + "repo": "core-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/core-hub.yaml" + }, + { + "repo": "domain-tree", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/domain-tree.yaml" + }, + { + "repo": "email-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/email-connect.yaml" + }, + { + "repo": "evidence-anchor", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-anchor.yaml" + }, + { + "repo": "evidence-binder", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-binder.yaml" + }, + { + "repo": "evidence-source", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-source.yaml" + }, + { + "repo": "feature-control", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/feature-control.yaml" + }, + { + "repo": "guide-board", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/guide-board.yaml" + }, + { + "repo": "helix-forge", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/helix-forge.yaml" + }, + { + "repo": "hub-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/hub-core.yaml" + }, + { + "repo": "human-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/human-resources.yaml" + }, + { + "repo": "ihp-railiance-probe", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ihp-railiance-probe.yaml" + }, + { + "repo": "info-tech-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/info-tech-canon.yaml" + }, + { + "repo": "infospace-bench", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/infospace-bench.yaml" + }, + { + "repo": "issue-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/issue-core.yaml" + }, + { + "repo": "kaizen-agentic", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kaizen-agentic.yaml" + }, + { + "repo": "key-cape", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/key-cape.yaml" + }, + { + "repo": "kontextual-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kontextual-engine.yaml" + }, + { + "repo": "llm-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/llm-connect.yaml" + }, + { + "repo": "markitect-filter", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-filter.yaml" + }, + { + "repo": "markitect-main", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-main.yaml" + }, + { + "repo": "markitect-quarkdown", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-quarkdown.yaml" + }, + { + "repo": "markitect-tool", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-tool.yaml" + }, + { + "repo": "net-kingdom", + "count": 6, + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/net-kingdom.yaml" + }, + { + "repo": "open-cmis-tck", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-cmis-tck.yaml" + }, + { + "repo": "open-reuse", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-reuse.yaml" + }, + { + "repo": "ops-bridge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-bridge.yaml" + }, + { + "repo": "ops-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-hub.yaml" + }, + { + "repo": "ops-warden", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-warden.yaml" + }, + { + "repo": "phase-memory", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/phase-memory.yaml" + }, + { + "repo": "railiance-apps", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-apps.yaml" + }, + { + "repo": "railiance-cluster", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-cluster.yaml" + }, + { + "repo": "railiance-enablement", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-enablement.yaml" + }, + { + "repo": "railiance-fabric", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-fabric.yaml" + }, + { + "repo": "railiance-forge", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-forge.yaml" + }, + { + "repo": "railiance-infra", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-infra.yaml" + }, + { + "repo": "railiance-platform", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-platform.yaml" + }, + { + "repo": "repo-scoping", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-scoping.yaml" + }, + { + "repo": "repo-seed", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-seed.yaml" + }, + { + "repo": "reuse-surface", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reuse-surface.yaml" + }, + { + "repo": "shard-wiki", + "count": 8, + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/shard-wiki.yaml" + }, + { + "repo": "state-hub", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/state-hub.yaml" + }, + { + "repo": "tegwick-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tegwick-control.yaml" + }, + { + "repo": "the-custodian", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/the-custodian.yaml" + }, + { + "repo": "user-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/user-engine.yaml" + }, + { + "repo": "vantage-point", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vantage-point.yaml" + }, + { + "repo": "vergabe-teilnahme", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "repo": "whynot-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-control.yaml" + }, + { + "repo": "whynot-design", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-design.yaml" + } + ], + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Durable automation and bounded operations", + "summary": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "tags": [ + "activity", + "coordination", + "automation", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "activity-core", + "source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/activity-core.yaml" + }, + { + "id": "capability.agents.cli-assistant", + "name": "Console-Native LLM Assistant (cya)", + "summary": "Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "can-you-assist", + "path": "registry/capabilities/capability.agents.cli-assistant.md", + "tags": [ + "cli", + "assistant", + "llm", + "safety" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "can-you-assist", + "source_url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/can-you-assist.yaml" + }, + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Generic agent runtime and repository tooling", + "summary": "Agent runtime modules and repository classification tooling.", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "tags": [ + "agents", + "runtime", + "classification", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "the-custodian", + "source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/the-custodian.yaml" + }, + { + "id": "capability.agents.kaizen-framework", + "name": "Kaizen Agentic Framework", + "summary": "AI agency framework providing 20 deployable agent instruction sets, project memory, metrics, role and engagement contracts, and scheduled preparation for governed execution.", + "vector": "D3 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "kaizen-agentic", + "path": "registry/capabilities/capability.agents.kaizen-framework.md", + "tags": [ + "agents", + "memory", + "coordination", + "metrics", + "scheduling", + "engagements" + ], + "consumption_modes": [ + "cli", + "library import", + "file contracts" + ], + "source_repo": "kaizen-agentic", + "source_url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kaizen-agentic.yaml" + }, + { + "id": "capability.agents.llm-connector", + "name": "Pluggable LLM Adapter Library (llm-connect)", + "summary": "Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers.", + "vector": "D3 / A2 / C2 / R1", + "domain": "agents", + "status": "draft", + "owner": "llm-connect", + "path": "registry/capabilities/capability.agents.llm-connector.md", + "tags": [ + "llm", + "adapter", + "provider-neutral" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "llm-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/llm-connect.yaml" + }, + { + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "summary": "Capture sessions, curate patterns, distribute lessons and measure outcomes.", + "domain": "infotech", + "status": "draft", + "owner": "agentic-resources", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.performance-learning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "agentic-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/agentic-resources.yaml" + }, + { + "id": "capability.agents.repo-scoping-service", + "name": "Repository Scoping Service", + "summary": "Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "repo-scoping", + "path": "registry/capabilities/capability.agents.repo-scoping-service.md", + "tags": [ + "classification", + "scoping", + "registry" + ], + "consumption_modes": [ + "http api", + "library import", + "ui" + ], + "source_repo": "repo-scoping", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-scoping.yaml" + }, + { + "id": "capability.audit.event-retain", + "name": "Independent audit custody", + "summary": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.", + "domain": "infotech", + "status": "draft", + "owner": "audit-core", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C3 / R2", + "path": "registry/capabilities/capability.audit.event-retain.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "audit-core", + "source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/audit-core.yaml" + }, + { + "id": "capability.authorization.policy-evaluate", + "name": "Policy evaluation and decision evidence", + "summary": "Check, batch, list-allowed, explain, binding, lifetime and decision records.", + "domain": "helix_forge", + "status": "draft", + "owner": "access-engine", + "tags": [ + "authorization", + "policy", + "flex-auth", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "access-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/access-engine.yaml" + }, + { + "id": "capability.cmis.tck", + "name": "OpenCMIS Conformance-Preparation Extension", + "summary": "CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "open-cmis-tck", + "path": "registry/capabilities/capability.cmis.tck.md", + "tags": [ + "cmis", + "compliance", + "guide-board-extension" + ], + "consumption_modes": [ + "library import (guide-board extension)" + ], + "source_repo": "open-cmis-tck", + "source_url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-cmis-tck.yaml" + }, + { + "id": "capability.communication.compliance-evidence-framework", + "name": "Certification And Compliance Evidence Framework", + "summary": "Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture.", + "vector": "D2 / A2 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "guide-board", + "path": "registry/capabilities/capability.communication.compliance-evidence-framework.md", + "tags": [ + "compliance", + "certification", + "evidence", + "extensions" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "guide-board", + "source_url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/guide-board.yaml" + }, + { + "id": "capability.communication.context-engine", + "name": "Kontextual Engine (Knowledge Operations Runtime)", + "summary": "Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge.", + "vector": "D4 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "kontextual-engine", + "path": "registry/capabilities/capability.communication.context-engine.md", + "tags": [ + "knowledge", + "context", + "runtime" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "kontextual-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kontextual-engine.yaml" + }, + { + "id": "capability.communication.infospace-workspace", + "name": "Infospace Workspace And Evaluation Bench", + "summary": "Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main.", + "vector": "D3 / A1 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "infospace-bench", + "path": "registry/capabilities/capability.communication.infospace-workspace.md", + "tags": [ + "infospace", + "knowledge", + "evaluation" + ], + "consumption_modes": [ + "cli", + "library import (consumed by info-tech-canon)" + ], + "source_repo": "infospace-bench", + "source_url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/infospace-bench.yaml" + }, + { + "id": "capability.communication.markitect-legacy-platform", + "name": "MarkiTect Legacy Platform", + "summary": "Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-main", + "path": "registry/capabilities/capability.communication.markitect-legacy-platform.md", + "tags": [ + "markitect", + "markdown", + "legacy" + ], + "consumption_modes": [ + "application (legacy, not recommended for new integration)" + ], + "source_repo": "markitect-main", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-main.yaml" + }, + { + "id": "capability.communication.markitect-quarkdown-adapter", + "name": "Markitect Quarkdown Render Adapter", + "summary": "Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-quarkdown", + "path": "registry/capabilities/capability.communication.markitect-quarkdown-adapter.md", + "tags": [ + "markitect", + "quarkdown", + "adapter" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-quarkdown", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-quarkdown.yaml" + }, + { + "id": "capability.communication.markitect-source-adapters", + "name": "Markitect Source-Format Adapters", + "summary": "Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-filter", + "path": "registry/capabilities/capability.communication.markitect-source-adapters.md", + "tags": [ + "markitect", + "adapter", + "document-conversion" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-filter", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-filter.yaml" + }, + { + "id": "capability.communication.markitect-toolkit", + "name": "Markitect Markdown Toolkit And CLI", + "summary": "Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main.", + "vector": "D4 / A2 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "markitect-tool", + "path": "registry/capabilities/capability.communication.markitect-toolkit.md", + "tags": [ + "markitect", + "markdown", + "cli", + "toolkit" + ], + "consumption_modes": [ + "cli", + "library import" + ], + "source_repo": "markitect-tool", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-tool.yaml" + }, + { + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "summary": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime.", + "domain": "infotech", + "status": "draft", + "owner": "coordination-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.coordination.cross-owner-work.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "coordination-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/coordination-engine.yaml" + }, + { + "id": "capability.design.whynot-system", + "name": "Whynot Design System", + "summary": "Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters.", + "vector": "D3 / A2 / C2 / R1", + "domain": "consumer", + "status": "draft", + "owner": "whynot-design", + "path": "registry/capabilities/capability.design.whynot-system.md", + "tags": [ + "design-system", + "web-components", + "frontend" + ], + "consumption_modes": [ + "library import (npm)", + "cli", + "django template adapter" + ], + "source_repo": "whynot-design", + "source_url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whynot-design.yaml" + }, + { + "id": "capability.evidence.binding", + "name": "Evidence-to-Target Binding", + "summary": "Links evidence items to structured targets with relation, status, and confidence metadata, bidirectional queries, active-state coordination, and canonical engine events.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.binding.md", + "tags": [ + "evidence", + "binding", + "evidence-link", + "form-field", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React provider" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.evidence.rect-registry", + "name": "Visual-Guide Rect Registry", + "summary": "Coordinates field, evidence-card, and highlight rectangles from independent renderers so an SVG overlay can draw the active visual guide without polling.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.rect-registry.md", + "tags": [ + "rect-registry", + "visual-guide", + "overlay", + "active-state", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React component" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.feature-control.evaluate", + "name": "Feature Availability Evaluation", + "summary": "Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context.", + "vector": "D5 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.evaluate.md", + "tags": [ + "feature-control", + "evaluation", + "sdk" + ], + "consumption_modes": [ + "SDK", + "service API" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.rollout", + "name": "Feature Rollout Control", + "summary": "Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.rollout.md", + "tags": [ + "feature-control", + "rollout", + "planning" + ], + "consumption_modes": [ + "source module", + "SDK" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.visibility", + "name": "Feature Visibility Control", + "summary": "Control whether features are visible or hidden for subjects without changing entitlement or authorization.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.visibility.md", + "tags": [ + "feature-control", + "visibility" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.graph.nbgm-spec", + "name": "Network-Based Graph Model (NBGM) Specification", + "summary": "Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains.", + "vector": "D2 / A0 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "vantage-point", + "path": "registry/capabilities/capability.graph.nbgm-spec.md", + "tags": [ + "graph", + "nbgm", + "specification" + ], + "consumption_modes": [ + "informational (specification only)" + ], + "source_repo": "vantage-point", + "source_url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vantage-point.yaml" + }, + { + "id": "capability.hr.workflow-catalog", + "name": "HR Workflow Catalog", + "summary": "Markdown-first registry of HR planning workflows with an iterative assessment loop tied to INTENT phases.", + "vector": "D3 / A1 / C1 / R0", + "domain": "consumer", + "status": "draft", + "owner": "human-resources", + "path": "registry/capabilities/capability.hr.workflow-catalog.md", + "tags": [ + "hr", + "workflows", + "assessment", + "planning" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "human-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/human-resources.yaml" + }, + { + "id": "capability.iam.key-cape", + "name": "OIDC identity and assurance", + "summary": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.iam.key-cape.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "key-cape", + "source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/key-cape.yaml" + }, + { + "id": "capability.identity.subject-resolution", + "name": "Identity Subject Resolution", + "summary": "Resolve who or what is acting by mapping principals, accounts, actors, and identifiers to a stable subject model.", + "vector": "D3 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.subject-resolution.md", + "tags": [ + "identity", + "subject", + "architecture" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.identity.user-engine", + "name": "User lifecycle and account journeys", + "summary": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog.", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "tags": [ + "identity", + "user-management", + "multi-tenant", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R0", + "path": "registry/capabilities/capability.identity.user-engine.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "user-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/user-engine.yaml" + }, + { + "id": "capability.identity.vocabulary-canonicalize", + "name": "Identity Vocabulary Canonicalization", + "summary": "Define an implementation-neutral vocabulary for identity-related concepts across overlapping domains.", + "vector": "D4 / A0 / C2 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.vocabulary-canonicalize.md", + "tags": [ + "identity", + "terminology", + "research" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.infotech.artifact-store", + "name": "Artifact Registry And Storage Gateway", + "summary": "Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "artifact-store", + "path": "registry/capabilities/capability.infotech.artifact-store.md", + "tags": [ + "artifact", + "storage", + "provenance", + "registry" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "artifact-store", + "source_url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/artifact-store.yaml" + }, + { + "id": "capability.infotech.canon-service", + "name": "Shared semantic contracts and validation", + "summary": "Markdown canon with library, CLI and read-only API.", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "tags": [ + "canon", + "infospace", + "service", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "info-tech-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/info-tech-canon.yaml" + }, + { + "id": "capability.infotech.citation-engine", + "name": "Citation Evidence Domain Engine", + "summary": "Core domain model and engine services for the citation-evidence ecosystem \u2014 shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-engine", + "path": "registry/capabilities/capability.infotech.citation-engine.md", + "tags": [ + "citation", + "evidence", + "domain-model" + ], + "consumption_modes": [ + "library import (workspace link)" + ], + "source_repo": "citation-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-engine.yaml" + }, + { + "id": "capability.infotech.citation-evidence-workspace", + "name": "Citation Evidence Workspace", + "summary": "Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations \u2014 the umbrella application over the citation-evidence six-package design.", + "vector": "D4 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-evidence", + "path": "registry/capabilities/capability.infotech.citation-evidence-workspace.md", + "tags": [ + "citation", + "evidence", + "workspace" + ], + "consumption_modes": [ + "application (local dev server)" + ], + "source_repo": "citation-evidence", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-evidence.yaml" + }, + { + "id": "capability.infotech.config-surface-atlas", + "name": "Configuration Surface Atlas", + "summary": "Read-first, cross-kind map and evidence layer for configuration surfaces \u2014 what configures a system, who owns it, its scope, and where the source of truth lives.", + "vector": "D5 / A0 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "config-atlas", + "path": "registry/capabilities/capability.infotech.config-surface-atlas.md", + "tags": [ + "configuration", + "registry", + "control-plane", + "effective-config", + "evidence" + ], + "consumption_modes": [ + "informational", + "source module" + ], + "source_repo": "config-atlas", + "source_url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/config-atlas.yaml" + }, + { + "id": "capability.infotech.core-hub", + "name": "Core Hub Production Interaction Framework", + "summary": "Contract-first framework for cross-domain state, agent coordination, evidence, registries, workplans, and operator interaction surfaces.", + "vector": "D3 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "core-hub", + "path": "registry/capabilities/capability.infotech.core-hub.md", + "tags": [ + "interaction-framework", + "state-hub", + "inter-hub-successor", + "agent-coordination", + "registry", + "api" + ], + "consumption_modes": [ + "informational", + "planning", + "cli" + ], + "source_repo": "core-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/core-hub.yaml" + }, + { + "id": "capability.infotech.email-connector", + "name": "Mailbox Evidence Scanner (email-connect)", + "summary": "Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "email-connect", + "path": "registry/capabilities/capability.infotech.email-connector.md", + "tags": [ + "email", + "evidence", + "coordination" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "email-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/email-connect.yaml" + }, + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.infotech.hub-core-library", + "name": "Reusable FOS Hub Core Primitives", + "summary": "Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "hub-core", + "path": "registry/capabilities/capability.infotech.hub-core-library.md", + "tags": [ + "hub", + "fastapi", + "sqlalchemy", + "mcp" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "hub-core", + "source_url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/hub-core.yaml" + }, + { + "id": "capability.infotech.issue-tracking", + "name": "External issue tracker connector", + "summary": "CLI and Python adapters for external issue systems.", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "tags": [ + "issue-tracking", + "connector", + "work-record", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "issue-core", + "source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/issue-core.yaml" + }, + { + "id": "capability.infotech.oss-integration-continuity", + "name": "Managed Continuity For OSS Integrations", + "summary": "Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "open-reuse", + "path": "registry/capabilities/capability.infotech.oss-integration-continuity.md", + "tags": [ + "oss", + "integration", + "maintenance" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "open-reuse", + "source_url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-reuse.yaml" + }, + { + "id": "capability.infotech.pdf-evidence-ingest", + "name": "Headless PDF Evidence Ingest", + "summary": "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "evidence-source", + "path": "registry/capabilities/capability.infotech.pdf-evidence-ingest.md", + "tags": [ + "pdf", + "ingest", + "fingerprint", + "canonical-text", + "evidence" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "evidence-source", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-source.yaml" + }, + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ], + "source_repo": "repo-seed", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-seed.yaml" + }, + { + "id": "capability.memory.phase-planning", + "name": "Profile-Driven Memory Phase Planning (phase-memory)", + "summary": "Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "phase-memory", + "path": "registry/capabilities/capability.memory.phase-planning.md", + "tags": [ + "memory", + "agentic", + "planning" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "phase-memory", + "source_url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/phase-memory.yaml" + }, + { + "id": "capability.operations.ops-hub", + "name": "Operations Hub Extension Contract", + "summary": "Versioned hub-extension package and bootstrap client for operational truth, service-catalog records, readiness evidence, and migration gates.", + "vector": "D3 / A1 / C1 / R1", + "domain": "operations", + "status": "reviewed", + "owner": "ops-hub", + "path": "registry/capabilities/capability.operations.ops-hub.md", + "tags": [ + "operations", + "service-catalog", + "readiness", + "hub-extension" + ], + "consumption_modes": [ + "contract package", + "command-line bootstrap" + ], + "source_repo": "ops-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-hub.yaml" + }, + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH tunnel lifecycle", + "summary": "Named tunnels, reconnect, health and TTL-aware cert_command.", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-bridge", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-bridge.yaml" + }, + { + "id": "capability.procurement.vergabe-teilnahme", + "name": "Vergabe Teilnahme (Public Procurement Participation) Application", + "summary": "Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation \u2014 Ausschreibungs- und Teilnahme-Management-System.", + "vector": "D3 / A1 / C1 / R1", + "domain": "communication", + "status": "draft", + "owner": "vergabe-teilnahme", + "path": "registry/capabilities/capability.procurement.vergabe-teilnahme.md", + "tags": [ + "procurement", + "django", + "vergabe" + ], + "consumption_modes": [ + "application (Django + Vite, local dev via docker-compose)" + ], + "source_repo": "vergabe-teilnahme", + "source_url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "id": "capability.railiance.ci-enablement", + "name": "Developer delivery and CI templates", + "summary": "Reusable CI workflows, build and deployment patterns.", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-enablement", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-enablement.yaml" + }, + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Kubernetes runtime and cluster controls", + "summary": "k3s, ingress, CNI, operators and kubeconfig/runtime checks.", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-cluster", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-cluster.yaml" + }, + { + "id": "capability.railiance.fabric-graph", + "name": "Infrastructure ownership and dependency graph", + "summary": "Schemas, validation, graph queries and State Hub exports.", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-fabric", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-fabric.yaml" + }, + { + "id": "capability.railiance.forge-infrastructure", + "name": "Source forge, registries and runner substrate", + "summary": "Forgejo operation, package registries and runner lifecycle.", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.railiance.infra-provisioning", + "name": "Host convergence and security baseline", + "summary": "Ansible inventory, firewall, SSH bootstrap and baseline verification.", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-infra", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-infra.yaml" + }, + { + "id": "capability.railiance.platform-services", + "name": "Secret custody and platform data services", + "summary": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-platform", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-platform.yaml" + }, + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Workload release configuration and guards", + "summary": "Helm/manifests, exact image pins, application runbooks and rollout/rollback.", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-apps", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-apps.yaml" + }, + { + "id": "capability.registry.register", + "name": "Capability registry and federation", + "summary": "Owner Markdown entries, indexes, federation hub and planning queries.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "governance", + "meta", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C2 / R3", + "path": "registry/capabilities/capability.registry.register.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.registry.validate", + "name": "Capability registry validation", + "summary": "Schema, index consistency and relation checks.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "validation", + "cli", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R3", + "path": "registry/capabilities/capability.registry.validate.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.security.access-routing", + "name": "Credential routing and contained access", + "summary": "warden route and access catalog; exact lane conduit and secret-exec routing.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.security.access-routing.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.bootstrap-recovery", + "name": "Guarded bootstrap and recovery preparation", + "summary": "Local identity, bootstrap console, encrypted custody handoff and caller tools.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.bootstrap-recovery.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-contracts", + "name": "Security case types and instance validation", + "summary": "Versioned types, cases and schema validation.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-contracts.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-follow-through", + "name": "Security case operational follow-through", + "summary": "KnownSecurityCase route, plan and operational receipts.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-follow-through.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.emission-profile", + "name": "Security emission cadence validation", + "summary": "Security profile over generic emission contracts and validator.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.emission-profile.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.forge-secret-prevention", + "name": "Independent introduced-history secret prevention", + "summary": "Pinned receive adapter, lifecycle template and fail-closed scan.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.forge-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom security architecture and conformance tooling", + "summary": "Versioned IAM, layer, tenancy and credential contracts plus validators.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.posture-feedback", + "name": "Deterministic posture feedback", + "summary": "CLI evaluates evidence age and posture into owner-routed findings.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-feedback.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.scenario-compose", + "name": "Deterministic security scenario composition", + "summary": "CLI selects pinned providers and orders trust transitions.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.scenario-compose.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.ssh-certificate-issuance", + "name": "Decision-bound SSH certificates", + "summary": "warden sign with local and OpenBao backends and adm/agt/atm actors.", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R2", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.statehub.progress-log", + "name": "Progress and work evidence indexing", + "summary": "REST progress and task evidence references.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "progress", + "coordination", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R3", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Cross-repository work tracking", + "summary": "File-derived workplans, tasks, dependencies, decisions and coordination views.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "coordination", + "workplans", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R2", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.wiki.adapter-contract", + "name": "Capability-Aware Shard Adapter Contract", + "summary": "A versioned backend interface where each binding declares a verified capability profile, so federation ops degrade by capability.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.adapter-contract.md", + "tags": [ + "wiki", + "adapter", + "capability", + "contract", + "conformance", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.coordination-journal", + "name": "Event-Sourced Coordination Journal", + "summary": "An append-only, totally-ordered-per-space decision log whose current state is a derived fold; git-addressable history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.coordination-journal.md", + "tags": [ + "wiki", + "event-sourcing", + "coordination", + "git", + "journal", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.derived-views", + "name": "Wiki Derived Views", + "summary": "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges, AllPages, SiteMap, and (delegate-or-derive) Search \u2014 carrying provenance.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.derived-views.md", + "tags": [ + "wiki", + "derived-views", + "backlinks", + "recentchanges", + "search", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.engine-typed-extensions", + "name": "Wiki Engine with Typed Extensions", + "summary": "A small-core wiki engine realizing a typed-extension framework that addresses all wiki use cases and lets each shard activate only the features it needs.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.engine-typed-extensions.md", + "tags": [ + "wiki", + "engine", + "typed-extensions", + "feature-activation", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.federation-models", + "name": "Selectable Federation-Model Taxonomy", + "summary": "Federation as a plural, composable coordination axis (fork+journal, VCS-replication, query-join, feed, activity-streams, engine-mirror) selected per space.", + "vector": "D4 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.federation-models.md", + "tags": [ + "wiki", + "federation", + "taxonomy", + "composable", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.overlay", + "name": "Overlay-Before-Mutation Write Path", + "summary": "Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only or limited backends be edited safely without silent remote mutation.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.overlay.md", + "tags": [ + "wiki", + "overlay", + "patch", + "write-path", + "conflict", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.page-model", + "name": "Backend-Neutral Wiki Page Model", + "summary": "A Markdown-first but stretchable page model with stable identity separate from placement and layered provenance.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.page-model.md", + "tags": [ + "wiki", + "page-model", + "identity", + "provenance", + "markdown", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.shard-orchestration", + "name": "Wiki Shard Orchestration", + "summary": "Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.shard-orchestration.md", + "tags": [ + "wiki", + "federation", + "orchestration", + "union", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + } + ], + "composed_at": "2026-10-14T04:48:46+00:00", + "stale": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json b/docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json new file mode 100644 index 00000000..bbe29695 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json @@ -0,0 +1,1872 @@ +{ + "version": 1, + "updated": "2026-10-14", + "domain": "helix_forge", + "collision_policy": "warn", + "sources": [ + { + "repo": "access-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/access-engine.yaml" + }, + { + "repo": "activity-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/activity-core.yaml" + }, + { + "repo": "agentic-resources", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/agentic-resources.yaml" + }, + { + "repo": "artifact-store", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/artifact-store.yaml" + }, + { + "repo": "audit-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/audit-core.yaml" + }, + { + "repo": "can-you-assist", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/can-you-assist.yaml" + }, + { + "repo": "citation-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-engine.yaml" + }, + { + "repo": "citation-evidence", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-evidence.yaml" + }, + { + "repo": "citation-work", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-work.yaml" + }, + { + "repo": "commerce-canon", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/commerce-canon.yaml" + }, + { + "repo": "config-atlas", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/config-atlas.yaml" + }, + { + "repo": "coordination-engine", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/coordination-engine.yaml" + }, + { + "repo": "core-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/core-hub.yaml" + }, + { + "repo": "domain-tree", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/domain-tree.yaml" + }, + { + "repo": "email-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/email-connect.yaml" + }, + { + "repo": "evidence-anchor", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-anchor.yaml" + }, + { + "repo": "evidence-binder", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-binder.yaml" + }, + { + "repo": "evidence-source", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-source.yaml" + }, + { + "repo": "feature-control", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/feature-control.yaml" + }, + { + "repo": "guide-board", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/guide-board.yaml" + }, + { + "repo": "helix-forge", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/helix-forge.yaml" + }, + { + "repo": "hub-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/hub-core.yaml" + }, + { + "repo": "human-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/human-resources.yaml" + }, + { + "repo": "ihp-railiance-probe", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ihp-railiance-probe.yaml" + }, + { + "repo": "info-tech-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/info-tech-canon.yaml" + }, + { + "repo": "infospace-bench", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/infospace-bench.yaml" + }, + { + "repo": "issue-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/issue-core.yaml" + }, + { + "repo": "kaizen-agentic", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kaizen-agentic.yaml" + }, + { + "repo": "key-cape", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/key-cape.yaml" + }, + { + "repo": "kontextual-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kontextual-engine.yaml" + }, + { + "repo": "llm-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/llm-connect.yaml" + }, + { + "repo": "markitect-filter", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-filter.yaml" + }, + { + "repo": "markitect-main", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-main.yaml" + }, + { + "repo": "markitect-quarkdown", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-quarkdown.yaml" + }, + { + "repo": "markitect-tool", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-tool.yaml" + }, + { + "repo": "net-kingdom", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/net-kingdom.yaml" + }, + { + "repo": "open-cmis-tck", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-cmis-tck.yaml" + }, + { + "repo": "open-reuse", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-reuse.yaml" + }, + { + "repo": "ops-bridge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-bridge.yaml" + }, + { + "repo": "ops-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-hub.yaml" + }, + { + "repo": "ops-warden", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-warden.yaml" + }, + { + "repo": "phase-memory", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/phase-memory.yaml" + }, + { + "repo": "railiance-apps", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-apps.yaml" + }, + { + "repo": "railiance-cluster", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-cluster.yaml" + }, + { + "repo": "railiance-enablement", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-enablement.yaml" + }, + { + "repo": "railiance-fabric", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-fabric.yaml" + }, + { + "repo": "railiance-forge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-forge.yaml" + }, + { + "repo": "railiance-infra", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-infra.yaml" + }, + { + "repo": "railiance-platform", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-platform.yaml" + }, + { + "repo": "repo-scoping", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-scoping.yaml" + }, + { + "repo": "repo-seed", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-seed.yaml" + }, + { + "repo": "reuse-surface", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reuse-surface.yaml" + }, + { + "repo": "shard-wiki", + "count": 8, + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/shard-wiki.yaml" + }, + { + "repo": "state-hub", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/state-hub.yaml" + }, + { + "repo": "tegwick-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tegwick-control.yaml" + }, + { + "repo": "the-custodian", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/the-custodian.yaml" + }, + { + "repo": "user-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/user-engine.yaml" + }, + { + "repo": "vantage-point", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vantage-point.yaml" + }, + { + "repo": "vergabe-teilnahme", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "repo": "whynot-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-control.yaml" + }, + { + "repo": "whynot-design", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-design.yaml" + } + ], + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Organizational Event Coordination", + "summary": "Coordinate structured responses to cross-domain events through activity workflows and automation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "tags": [ + "activity", + "coordination", + "automation" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "activity-core", + "source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/activity-core.yaml" + }, + { + "id": "capability.agents.cli-assistant", + "name": "Console-Native LLM Assistant (cya)", + "summary": "Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "can-you-assist", + "path": "registry/capabilities/capability.agents.cli-assistant.md", + "tags": [ + "cli", + "assistant", + "llm", + "safety" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "can-you-assist", + "source_url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/can-you-assist.yaml" + }, + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Custodian Runtime And Repo-Classification Tooling", + "summary": "Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos.", + "vector": "D2 / A1 / C1 / R0", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "tags": [ + "agents", + "runtime", + "classification" + ], + "consumption_modes": [ + "library import (runtime/)", + "cli (tools/ scripts)" + ], + "source_repo": "the-custodian", + "source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/the-custodian.yaml" + }, + { + "id": "capability.agents.kaizen-framework", + "name": "Kaizen Agentic Framework", + "summary": "AI agency framework providing 20 deployable agent instruction sets, project memory, metrics, role and engagement contracts, and scheduled preparation for governed execution.", + "vector": "D3 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "kaizen-agentic", + "path": "registry/capabilities/capability.agents.kaizen-framework.md", + "tags": [ + "agents", + "memory", + "coordination", + "metrics", + "scheduling", + "engagements" + ], + "consumption_modes": [ + "cli", + "library import", + "file contracts" + ], + "source_repo": "kaizen-agentic", + "source_url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kaizen-agentic.yaml" + }, + { + "id": "capability.agents.llm-connector", + "name": "Pluggable LLM Adapter Library (llm-connect)", + "summary": "Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers.", + "vector": "D3 / A2 / C2 / R1", + "domain": "agents", + "status": "draft", + "owner": "llm-connect", + "path": "registry/capabilities/capability.agents.llm-connector.md", + "tags": [ + "llm", + "adapter", + "provider-neutral" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "llm-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/llm-connect.yaml" + }, + { + "id": "capability.agents.repo-scoping-service", + "name": "Repository Scoping Service", + "summary": "Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "repo-scoping", + "path": "registry/capabilities/capability.agents.repo-scoping-service.md", + "tags": [ + "classification", + "scoping", + "registry" + ], + "consumption_modes": [ + "http api", + "library import", + "ui" + ], + "source_repo": "repo-scoping", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-scoping.yaml" + }, + { + "id": "capability.audit.event-retain", + "name": "Audit Event Retention", + "summary": "Collect, normalize, retain, and search audit events with integrity evidence across tenants.", + "joins": "operations.audit", + "provision": "data/capability/audit-core-operational.json", + "vector": "D4 provision / A4 / C3 / R2", + "domain": "infotech", + "status": "production", + "owner": "audit-core", + "path": "registry/capabilities/capability.audit.event-retain.md", + "tags": [ + "audit", + "retention", + "compliance" + ], + "consumption_modes": [ + "http ingest", + "source module" + ], + "source_repo": "audit-core", + "source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/audit-core.yaml" + }, + { + "id": "capability.authorization.policy-evaluate", + "name": "Authorization Policy Evaluation", + "summary": "Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "flex-auth", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "tags": [ + "authorization", + "policy", + "flex-auth" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "access-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/access-engine.yaml" + }, + { + "id": "capability.cmis.tck", + "name": "OpenCMIS Conformance-Preparation Extension", + "summary": "CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "open-cmis-tck", + "path": "registry/capabilities/capability.cmis.tck.md", + "tags": [ + "cmis", + "compliance", + "guide-board-extension" + ], + "consumption_modes": [ + "library import (guide-board extension)" + ], + "source_repo": "open-cmis-tck", + "source_url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-cmis-tck.yaml" + }, + { + "id": "capability.communication.compliance-evidence-framework", + "name": "Certification And Compliance Evidence Framework", + "summary": "Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture.", + "vector": "D2 / A2 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "guide-board", + "path": "registry/capabilities/capability.communication.compliance-evidence-framework.md", + "tags": [ + "compliance", + "certification", + "evidence", + "extensions" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "guide-board", + "source_url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/guide-board.yaml" + }, + { + "id": "capability.communication.context-engine", + "name": "Kontextual Engine (Knowledge Operations Runtime)", + "summary": "Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge.", + "vector": "D4 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "kontextual-engine", + "path": "registry/capabilities/capability.communication.context-engine.md", + "tags": [ + "knowledge", + "context", + "runtime" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "kontextual-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kontextual-engine.yaml" + }, + { + "id": "capability.communication.infospace-workspace", + "name": "Infospace Workspace And Evaluation Bench", + "summary": "Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main.", + "vector": "D3 / A1 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "infospace-bench", + "path": "registry/capabilities/capability.communication.infospace-workspace.md", + "tags": [ + "infospace", + "knowledge", + "evaluation" + ], + "consumption_modes": [ + "cli", + "library import (consumed by info-tech-canon)" + ], + "source_repo": "infospace-bench", + "source_url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/infospace-bench.yaml" + }, + { + "id": "capability.communication.markitect-legacy-platform", + "name": "MarkiTect Legacy Platform", + "summary": "Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-main", + "path": "registry/capabilities/capability.communication.markitect-legacy-platform.md", + "tags": [ + "markitect", + "markdown", + "legacy" + ], + "consumption_modes": [ + "application (legacy, not recommended for new integration)" + ], + "source_repo": "markitect-main", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-main.yaml" + }, + { + "id": "capability.communication.markitect-quarkdown-adapter", + "name": "Markitect Quarkdown Render Adapter", + "summary": "Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-quarkdown", + "path": "registry/capabilities/capability.communication.markitect-quarkdown-adapter.md", + "tags": [ + "markitect", + "quarkdown", + "adapter" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-quarkdown", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-quarkdown.yaml" + }, + { + "id": "capability.communication.markitect-source-adapters", + "name": "Markitect Source-Format Adapters", + "summary": "Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-filter", + "path": "registry/capabilities/capability.communication.markitect-source-adapters.md", + "tags": [ + "markitect", + "adapter", + "document-conversion" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-filter", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-filter.yaml" + }, + { + "id": "capability.communication.markitect-toolkit", + "name": "Markitect Markdown Toolkit And CLI", + "summary": "Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main.", + "vector": "D4 / A2 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "markitect-tool", + "path": "registry/capabilities/capability.communication.markitect-toolkit.md", + "tags": [ + "markitect", + "markdown", + "cli", + "toolkit" + ], + "consumption_modes": [ + "cli", + "library import" + ], + "source_repo": "markitect-tool", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-tool.yaml" + }, + { + "id": "capability.design.whynot-system", + "name": "Whynot Design System", + "summary": "Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters.", + "vector": "D3 / A2 / C2 / R1", + "domain": "consumer", + "status": "draft", + "owner": "whynot-design", + "path": "registry/capabilities/capability.design.whynot-system.md", + "tags": [ + "design-system", + "web-components", + "frontend" + ], + "consumption_modes": [ + "library import (npm)", + "cli", + "django template adapter" + ], + "source_repo": "whynot-design", + "source_url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whynot-design.yaml" + }, + { + "id": "capability.evidence.binding", + "name": "Evidence-to-Target Binding", + "summary": "Links evidence items to structured targets with relation, status, and confidence metadata, bidirectional queries, active-state coordination, and canonical engine events.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.binding.md", + "tags": [ + "evidence", + "binding", + "evidence-link", + "form-field", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React provider" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.evidence.rect-registry", + "name": "Visual-Guide Rect Registry", + "summary": "Coordinates field, evidence-card, and highlight rectangles from independent renderers so an SVG overlay can draw the active visual guide without polling.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.rect-registry.md", + "tags": [ + "rect-registry", + "visual-guide", + "overlay", + "active-state", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React component" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.feature-control.evaluate", + "name": "Feature Availability Evaluation", + "summary": "Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context.", + "vector": "D5 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.evaluate.md", + "tags": [ + "feature-control", + "evaluation", + "sdk" + ], + "consumption_modes": [ + "SDK", + "service API" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.rollout", + "name": "Feature Rollout Control", + "summary": "Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.rollout.md", + "tags": [ + "feature-control", + "rollout", + "planning" + ], + "consumption_modes": [ + "source module", + "SDK" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.visibility", + "name": "Feature Visibility Control", + "summary": "Control whether features are visible or hidden for subjects without changing entitlement or authorization.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.visibility.md", + "tags": [ + "feature-control", + "visibility" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.graph.nbgm-spec", + "name": "Network-Based Graph Model (NBGM) Specification", + "summary": "Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains.", + "vector": "D2 / A0 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "vantage-point", + "path": "registry/capabilities/capability.graph.nbgm-spec.md", + "tags": [ + "graph", + "nbgm", + "specification" + ], + "consumption_modes": [ + "informational (specification only)" + ], + "source_repo": "vantage-point", + "source_url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vantage-point.yaml" + }, + { + "id": "capability.hr.workflow-catalog", + "name": "HR Workflow Catalog", + "summary": "Markdown-first registry of HR planning workflows with an iterative assessment loop tied to INTENT phases.", + "vector": "D3 / A1 / C1 / R0", + "domain": "consumer", + "status": "draft", + "owner": "human-resources", + "path": "registry/capabilities/capability.hr.workflow-catalog.md", + "tags": [ + "hr", + "workflows", + "assessment", + "planning" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "human-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/human-resources.yaml" + }, + { + "id": "capability.iam.key-cape", + "name": "KeyCape Lightweight IAM (NetKingdom Profile)", + "summary": "Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against implementation internals.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "path": "registry/capabilities/capability.iam.key-cape.md", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security" + ], + "consumption_modes": [ + "service (self-hosted deployment)" + ], + "source_repo": "key-cape", + "source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/key-cape.yaml" + }, + { + "id": "capability.identity.subject-resolution", + "name": "Identity Subject Resolution", + "summary": "Resolve who or what is acting by mapping principals, accounts, actors, and identifiers to a stable subject model.", + "vector": "D3 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.subject-resolution.md", + "tags": [ + "identity", + "subject", + "architecture" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.identity.user-engine", + "name": "Headless Multi-Tenant User Engine", + "summary": "Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.", + "vector": "D4 / A1 / C2 / R0", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "path": "registry/capabilities/capability.identity.user-engine.md", + "tags": [ + "identity", + "user-management", + "multi-tenant" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "user-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/user-engine.yaml" + }, + { + "id": "capability.identity.vocabulary-canonicalize", + "name": "Identity Vocabulary Canonicalization", + "summary": "Define an implementation-neutral vocabulary for identity-related concepts across overlapping domains.", + "vector": "D4 / A0 / C2 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.vocabulary-canonicalize.md", + "tags": [ + "identity", + "terminology", + "research" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.infotech.artifact-store", + "name": "Artifact Registry And Storage Gateway", + "summary": "Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "artifact-store", + "path": "registry/capabilities/capability.infotech.artifact-store.md", + "tags": [ + "artifact", + "storage", + "provenance", + "registry" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "artifact-store", + "source_url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/artifact-store.yaml" + }, + { + "id": "capability.infotech.canon-service", + "name": "InfoTechCanon Service Surface", + "summary": "Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon information-processing infospace, backed by infospace-bench.", + "vector": "D2 / A2 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "tags": [ + "canon", + "infospace", + "service" + ], + "consumption_modes": [ + "cli", + "library import", + "http api (read-only, local)" + ], + "source_repo": "info-tech-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/info-tech-canon.yaml" + }, + { + "id": "capability.infotech.citation-engine", + "name": "Citation Evidence Domain Engine", + "summary": "Core domain model and engine services for the citation-evidence ecosystem \u2014 shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-engine", + "path": "registry/capabilities/capability.infotech.citation-engine.md", + "tags": [ + "citation", + "evidence", + "domain-model" + ], + "consumption_modes": [ + "library import (workspace link)" + ], + "source_repo": "citation-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-engine.yaml" + }, + { + "id": "capability.infotech.citation-evidence-workspace", + "name": "Citation Evidence Workspace", + "summary": "Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations \u2014 the umbrella application over the citation-evidence six-package design.", + "vector": "D4 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-evidence", + "path": "registry/capabilities/capability.infotech.citation-evidence-workspace.md", + "tags": [ + "citation", + "evidence", + "workspace" + ], + "consumption_modes": [ + "application (local dev server)" + ], + "source_repo": "citation-evidence", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-evidence.yaml" + }, + { + "id": "capability.infotech.config-surface-atlas", + "name": "Configuration Surface Atlas", + "summary": "Read-first, cross-kind map and evidence layer for configuration surfaces \u2014 what configures a system, who owns it, its scope, and where the source of truth lives.", + "vector": "D5 / A0 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "config-atlas", + "path": "registry/capabilities/capability.infotech.config-surface-atlas.md", + "tags": [ + "configuration", + "registry", + "control-plane", + "effective-config", + "evidence" + ], + "consumption_modes": [ + "informational", + "source module" + ], + "source_repo": "config-atlas", + "source_url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/config-atlas.yaml" + }, + { + "id": "capability.infotech.core-hub", + "name": "Core Hub Production Interaction Framework", + "summary": "Contract-first framework for cross-domain state, agent coordination, evidence, registries, workplans, and operator interaction surfaces.", + "vector": "D3 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "core-hub", + "path": "registry/capabilities/capability.infotech.core-hub.md", + "tags": [ + "interaction-framework", + "state-hub", + "inter-hub-successor", + "agent-coordination", + "registry", + "api" + ], + "consumption_modes": [ + "informational", + "planning", + "cli" + ], + "source_repo": "core-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/core-hub.yaml" + }, + { + "id": "capability.infotech.email-connector", + "name": "Mailbox Evidence Scanner (email-connect)", + "summary": "Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "email-connect", + "path": "registry/capabilities/capability.infotech.email-connector.md", + "tags": [ + "email", + "evidence", + "coordination" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "email-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/email-connect.yaml" + }, + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.infotech.hub-core-library", + "name": "Reusable FOS Hub Core Primitives", + "summary": "Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "hub-core", + "path": "registry/capabilities/capability.infotech.hub-core-library.md", + "tags": [ + "hub", + "fastapi", + "sqlalchemy", + "mcp" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "hub-core", + "source_url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/hub-core.yaml" + }, + { + "id": "capability.infotech.issue-tracking", + "name": "Universal Issue Tracking Coordination", + "summary": "Unified Python/CLI interface for issue tracking across Forgejo, GitHub, and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "tags": [ + "issue-tracking", + "coordination", + "multi-platform" + ], + "consumption_modes": [ + "cli", + "library import" + ], + "source_repo": "issue-core", + "source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/issue-core.yaml" + }, + { + "id": "capability.infotech.oss-integration-continuity", + "name": "Managed Continuity For OSS Integrations", + "summary": "Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "open-reuse", + "path": "registry/capabilities/capability.infotech.oss-integration-continuity.md", + "tags": [ + "oss", + "integration", + "maintenance" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "open-reuse", + "source_url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-reuse.yaml" + }, + { + "id": "capability.infotech.pdf-evidence-ingest", + "name": "Headless PDF Evidence Ingest", + "summary": "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "evidence-source", + "path": "registry/capabilities/capability.infotech.pdf-evidence-ingest.md", + "tags": [ + "pdf", + "ingest", + "fingerprint", + "canonical-text", + "evidence" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "evidence-source", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-source.yaml" + }, + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ], + "source_repo": "repo-seed", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-seed.yaml" + }, + { + "id": "capability.memory.phase-planning", + "name": "Profile-Driven Memory Phase Planning (phase-memory)", + "summary": "Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "phase-memory", + "path": "registry/capabilities/capability.memory.phase-planning.md", + "tags": [ + "memory", + "agentic", + "planning" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "phase-memory", + "source_url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/phase-memory.yaml" + }, + { + "id": "capability.operations.ops-hub", + "name": "Operations Hub Extension Contract", + "summary": "Versioned hub-extension package and bootstrap client for operational truth, service-catalog records, readiness evidence, and migration gates.", + "vector": "D3 / A1 / C1 / R1", + "domain": "operations", + "status": "reviewed", + "owner": "ops-hub", + "path": "registry/capabilities/capability.operations.ops-hub.md", + "tags": [ + "operations", + "service-catalog", + "readiness", + "hub-extension" + ], + "consumption_modes": [ + "contract package", + "command-line bootstrap" + ], + "source_repo": "ops-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-hub.yaml" + }, + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH Reverse Tunnel Lifecycle Manager (ops-bridge)", + "summary": "CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.", + "vector": "D3 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "ops-bridge", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-bridge.yaml" + }, + { + "id": "capability.procurement.vergabe-teilnahme", + "name": "Vergabe Teilnahme (Public Procurement Participation) Application", + "summary": "Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation \u2014 Ausschreibungs- und Teilnahme-Management-System.", + "vector": "D3 / A1 / C1 / R1", + "domain": "communication", + "status": "draft", + "owner": "vergabe-teilnahme", + "path": "registry/capabilities/capability.procurement.vergabe-teilnahme.md", + "tags": [ + "procurement", + "django", + "vergabe" + ], + "consumption_modes": [ + "application (Django + Vite, local dev via docker-compose)" + ], + "source_repo": "vergabe-teilnahme", + "source_url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "id": "capability.railiance.ci-enablement", + "name": "Railiance Developer Enablement And CI/CD Templates", + "summary": "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime.", + "vector": "D3 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo" + ], + "consumption_modes": [ + "ci workflow template (copy/reference)", + "cli (promote-repo-to-forgejo.sh)" + ], + "source_repo": "railiance-enablement", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-enablement.yaml" + }, + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Railiance Cluster Runtime Bootstrap", + "summary": "Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap" + ], + "consumption_modes": [ + "cli", + "ansible playbook" + ], + "source_repo": "railiance-cluster", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-cluster.yaml" + }, + { + "id": "capability.railiance.fabric-graph", + "name": "Railiance Fabric Ecosystem Graph", + "summary": "Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery" + ], + "consumption_modes": [ + "library import", + "cli (validation)" + ], + "source_repo": "railiance-fabric", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-fabric.yaml" + }, + { + "id": "capability.railiance.forge-infrastructure", + "name": "Railiance Forge And Artifact Infrastructure", + "summary": "Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner" + ], + "consumption_modes": [ + "cli (operator tooling)", + "documentation/runbooks" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.railiance.infra-provisioning", + "name": "RailianceHosts Infrastructure Provisioning", + "summary": "Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth.", + "vector": "D4 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure" + ], + "consumption_modes": [ + "cli (terraform/ansible)", + "gitops" + ], + "source_repo": "railiance-infra", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-infra.yaml" + }, + { + "id": "capability.railiance.platform-services", + "name": "Railiance Platform Services", + "summary": "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres" + ], + "consumption_modes": [ + "cli (shell/python scripts)" + ], + "source_repo": "railiance-platform", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-platform.yaml" + }, + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Railiance Application Workload Deployment Tooling", + "summary": "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack \u2014 application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.", + "vector": "D3 / A2 / C1 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment" + ], + "consumption_modes": [ + "cli (shell scripts)", + "helm/kubernetes deployment" + ], + "source_repo": "railiance-apps", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-apps.yaml" + }, + { + "id": "capability.registry.register", + "name": "Capability Registration", + "summary": "Register a new capability so it becomes visible for planning and implementation reuse.", + "vector": "D3 / A4 / C2 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.register.md", + "tags": [ + "registry", + "governance", + "meta" + ], + "consumption_modes": [ + "informational", + "markdown authoring", + "cli", + "service API" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.registry.validate", + "name": "Registry Entry Validation", + "summary": "Validate capability registry entries against schema, index consistency, and relation integrity.", + "vector": "D4 / A3 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.validate.md", + "tags": [ + "registry", + "validation", + "cli" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom Security/IAM Tooling Suite", + "summary": "Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.", + "vector": "D3 / A2 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance" + ], + "consumption_modes": [ + "cli", + "local web ui" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.ssh-certificate-issuance", + "name": "SSH Certificate Issuance", + "summary": "Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward NetKingdom operational access routing.", + "vector": "D4 / A3 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security" + ], + "consumption_modes": [ + "CLI", + "cert_command subprocess" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.statehub.progress-log", + "name": "Work Progress Logging", + "summary": "Record progress events, decisions, and session notes against workstreams and tasks in State Hub.", + "vector": "D4 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "tags": [ + "state-hub", + "progress", + "coordination" + ], + "consumption_modes": [ + "service API" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Workstream And Task Coordination", + "summary": "Track active workstreams, tasks, progress, and consistency across domain repositories.", + "vector": "D4 / A4 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "tags": [ + "state-hub", + "coordination", + "workplans" + ], + "consumption_modes": [ + "service API", + "HTTP REST" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.wiki.adapter-contract", + "name": "Capability-Aware Shard Adapter Contract", + "summary": "A versioned backend interface where each binding declares a verified capability profile, so federation ops degrade by capability.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.adapter-contract.md", + "tags": [ + "wiki", + "adapter", + "capability", + "contract", + "conformance", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.coordination-journal", + "name": "Event-Sourced Coordination Journal", + "summary": "An append-only, totally-ordered-per-space decision log whose current state is a derived fold; git-addressable history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.coordination-journal.md", + "tags": [ + "wiki", + "event-sourcing", + "coordination", + "git", + "journal", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.derived-views", + "name": "Wiki Derived Views", + "summary": "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges, AllPages, SiteMap, and (delegate-or-derive) Search \u2014 carrying provenance.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.derived-views.md", + "tags": [ + "wiki", + "derived-views", + "backlinks", + "recentchanges", + "search", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.engine-typed-extensions", + "name": "Wiki Engine with Typed Extensions", + "summary": "A small-core wiki engine realizing a typed-extension framework that addresses all wiki use cases and lets each shard activate only the features it needs.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.engine-typed-extensions.md", + "tags": [ + "wiki", + "engine", + "typed-extensions", + "feature-activation", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.federation-models", + "name": "Selectable Federation-Model Taxonomy", + "summary": "Federation as a plural, composable coordination axis (fork+journal, VCS-replication, query-join, feed, activity-streams, engine-mirror) selected per space.", + "vector": "D4 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.federation-models.md", + "tags": [ + "wiki", + "federation", + "taxonomy", + "composable", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.overlay", + "name": "Overlay-Before-Mutation Write Path", + "summary": "Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only or limited backends be edited safely without silent remote mutation.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.overlay.md", + "tags": [ + "wiki", + "overlay", + "patch", + "write-path", + "conflict", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.page-model", + "name": "Backend-Neutral Wiki Page Model", + "summary": "A Markdown-first but stretchable page model with stable identity separate from placement and layered provenance.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.page-model.md", + "tags": [ + "wiki", + "page-model", + "identity", + "provenance", + "markdown", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.shard-orchestration", + "name": "Wiki Shard Orchestration", + "summary": "Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.shard-orchestration.md", + "tags": [ + "wiki", + "federation", + "orchestration", + "union", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + } + ], + "composed_at": "2026-10-14T00:17:44+00:00", + "stale": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-before-repos.json b/docs/assessments/netkingdom-2026-10-14/hosted-before-repos.json new file mode 100644 index 00000000..a4d97f31 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-before-repos.json @@ -0,0 +1,714 @@ +{ + "count": 64, + "repos": [ + { + "repo": "access-engine", + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-09-30T18:31:15+00:00", + "updated_at": "2026-09-30T18:31:15+00:00" + }, + { + "repo": "activity-core", + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:46:54+00:00", + "updated_at": "2026-08-21T14:26:03+00:00", + "description": "" + }, + { + "repo": "agentic-resources", + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:10+00:00", + "updated_at": "2026-08-20T21:44:26+00:00" + }, + { + "repo": "artifact-store", + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:15+00:00", + "updated_at": "2026-08-20T21:44:27+00:00" + }, + { + "repo": "audit-core", + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:46:57+00:00", + "updated_at": "2026-08-20T21:44:27+00:00" + }, + { + "repo": "can-you-assist", + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:20+00:00", + "updated_at": "2026-08-20T21:44:27+00:00" + }, + { + "repo": "citation-engine", + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:25+00:00", + "updated_at": "2026-08-20T21:44:28+00:00" + }, + { + "repo": "citation-evidence", + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:30+00:00", + "updated_at": "2026-08-20T21:44:28+00:00" + }, + { + "repo": "citation-work", + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:33+00:00", + "updated_at": "2026-08-20T21:44:29+00:00" + }, + { + "repo": "commerce-canon", + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "description": "Canonical source after CFED-WP-0001-T03/T09; stable capability.identity identifiers retained.", + "registered_at": "2026-09-05T23:22:01+00:00", + "updated_at": "2026-09-05T23:22:01+00:00" + }, + { + "repo": "config-atlas", + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "infotech", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-07-06T22:41:01+00:00", + "updated_at": "2026-08-20T21:44:29+00:00" + }, + { + "repo": "coordination-engine", + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:37+00:00", + "updated_at": "2026-08-20T21:44:30+00:00" + }, + { + "repo": "core-hub", + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-07-07T10:23:58+00:00", + "updated_at": "2026-07-07T10:23:58+00:00" + }, + { + "repo": "domain-tree", + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:41+00:00", + "updated_at": "2026-08-20T21:44:30+00:00" + }, + { + "repo": "email-connect", + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:20+00:00", + "updated_at": "2026-08-20T21:44:30+00:00" + }, + { + "repo": "evidence-anchor", + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:25+00:00", + "updated_at": "2026-08-20T21:44:31+00:00" + }, + { + "repo": "evidence-binder", + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:29+00:00", + "updated_at": "2026-08-21T08:31:50+00:00" + }, + { + "repo": "evidence-source", + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:34+00:00", + "updated_at": "2026-08-20T21:44:32+00:00" + }, + { + "repo": "feature-control", + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:01+00:00", + "updated_at": "2026-08-20T21:44:32+00:00" + }, + { + "repo": "flex-auth", + "url": "https://forgejo.coulomb.social/coulomb/flex-auth/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": false, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:47:00+00:00", + "updated_at": "2026-09-30T18:31:16+00:00", + "description": "Superseded by access-engine (repo rename, FLEX-WP-0020). Kept disabled for audit." + }, + { + "repo": "guide-board", + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:39+00:00", + "updated_at": "2026-08-20T21:44:33+00:00" + }, + { + "repo": "helix-forge", + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:43+00:00", + "updated_at": "2026-08-20T21:44:33+00:00" + }, + { + "repo": "hub-core", + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:04:51+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "human-resources", + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:48+00:00", + "updated_at": "2026-08-20T21:44:34+00:00" + }, + { + "repo": "identity-canon", + "url": "https://forgejo.coulomb.social/coulomb/identity-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": false, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:02+00:00", + "updated_at": "2026-09-05T23:22:01+00:00", + "description": "Retired source registration after repository rename; replaced by commerce-canon under CFED-WP-0001-T09. Kept for history." + }, + { + "repo": "ihp-railiance-probe", + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:42+00:00", + "updated_at": "2026-08-20T21:44:34+00:00" + }, + { + "repo": "info-tech-canon", + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:45+00:00", + "updated_at": "2026-08-20T21:44:35+00:00" + }, + { + "repo": "infospace-bench", + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:49+00:00", + "updated_at": "2026-08-20T21:44:35+00:00" + }, + { + "repo": "inter-hub", + "url": "https://gitea.coulomb.social/coulomb/inter-hub/raw/main/registry/indexes/capabilities.yaml", + "enabled": false, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:18+00:00", + "updated_at": "2026-07-07T10:26:41+00:00" + }, + { + "repo": "issue-core", + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:54+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "kaizen-agentic", + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:57+00:00", + "updated_at": "2026-08-20T21:44:36+00:00" + }, + { + "repo": "key-cape", + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:00+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "kontextual-engine", + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:04+00:00", + "updated_at": "2026-08-20T21:44:36+00:00" + }, + { + "repo": "llm-connect", + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:07+00:00", + "updated_at": "2026-08-20T21:44:37+00:00" + }, + { + "repo": "markitect-filter", + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:09+00:00", + "updated_at": "2026-08-20T21:44:37+00:00" + }, + { + "repo": "markitect-main", + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:13+00:00", + "updated_at": "2026-08-20T21:44:37+00:00" + }, + { + "repo": "markitect-quarkdown", + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:36+00:00", + "updated_at": "2026-08-20T21:44:38+00:00" + }, + { + "repo": "markitect-tool", + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:42+00:00", + "updated_at": "2026-08-20T21:44:38+00:00" + }, + { + "repo": "net-kingdom", + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:46+00:00", + "updated_at": "2026-08-20T21:44:39+00:00" + }, + { + "repo": "open-cmis-tck", + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:51+00:00", + "updated_at": "2026-08-20T21:44:39+00:00" + }, + { + "repo": "open-reuse", + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:56+00:00", + "updated_at": "2026-08-20T21:44:39+00:00" + }, + { + "repo": "ops-bridge", + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:59+00:00", + "updated_at": "2026-08-20T21:44:40+00:00" + }, + { + "repo": "ops-hub", + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:04+00:00", + "updated_at": "2026-08-20T21:44:40+00:00" + }, + { + "repo": "ops-warden", + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:09+00:00", + "updated_at": "2026-08-20T21:44:41+00:00" + }, + { + "repo": "phase-memory", + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:13+00:00", + "updated_at": "2026-08-20T21:44:41+00:00" + }, + { + "repo": "railiance-apps", + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:16+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-cluster", + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:57:59+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-enablement", + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:03+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-fabric", + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:30+00:00", + "updated_at": "2026-08-20T21:44:42+00:00" + }, + { + "repo": "railiance-forge", + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:06+00:00", + "updated_at": "2026-08-20T21:44:42+00:00" + }, + { + "repo": "railiance-infra", + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:09+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-platform", + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:46+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "repo-scoping", + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:52+00:00", + "updated_at": "2026-08-20T21:44:42+00:00" + }, + { + "repo": "repo-seed", + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:57+00:00", + "updated_at": "2026-08-20T21:44:43+00:00" + }, + { + "repo": "reuse-surface", + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "description": "Capability registry for helix_forge", + "registered_at": "2026-06-15T08:24:18+00:00", + "updated_at": "2026-08-20T21:44:43+00:00" + }, + { + "repo": "shard-wiki", + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:03+00:00", + "updated_at": "2026-08-20T21:44:44+00:00" + }, + { + "repo": "state-hub", + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:00+00:00", + "updated_at": "2026-07-07T16:09:42+00:00" + }, + { + "repo": "tegwick-control", + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:00+00:00", + "updated_at": "2026-08-20T21:44:44+00:00" + }, + { + "repo": "the-custodian", + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:04+00:00", + "updated_at": "2026-08-20T21:44:45+00:00" + }, + { + "repo": "user-engine", + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:02:46+00:00", + "updated_at": "2026-08-20T21:44:45+00:00" + }, + { + "repo": "vantage-point", + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:02:51+00:00", + "updated_at": "2026-08-20T21:44:46+00:00" + }, + { + "repo": "vergabe-teilnahme", + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:02:56+00:00", + "updated_at": "2026-08-20T21:44:46+00:00" + }, + { + "repo": "whynot-control", + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:03:00+00:00", + "updated_at": "2026-08-20T21:44:46+00:00" + }, + { + "repo": "whynot-design", + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:03:03+00:00", + "updated_at": "2026-08-20T21:44:47+00:00" + } + ] +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-verification.json b/docs/assessments/netkingdom-2026-10-14/hosted-verification.json new file mode 100644 index 00000000..8b4ef920 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-verification.json @@ -0,0 +1,61 @@ +{ + "matched": 32, + "expected": 70, + "missing": [ + "capability.execution.openweight-rein", + "capability.execution.profile-harness", + "capability.execution.sandbox-provision", + "capability.execution.scheduled-agent-rein", + "capability.finance.security-budget-evidence", + "capability.identity.tenant-facts", + "capability.infotech.runbook-tutorials", + "capability.infotech.sbom-management", + "capability.observability.security-signals", + "capability.organization.role-catalog", + "capability.railiance.bootstrap-sequencing", + "capability.railiance.browser-verification", + "capability.railiance.knative-rail", + "capability.railiance.kubernetes-rail", + "capability.railiance.openbao-package", + "capability.railiance.policy-publication-package", + "capability.railiance.postgres-isolation-recovery", + "capability.railiance.sbom-runtime-package", + "capability.railiance.security-consumption-contracts", + "capability.railiance.substrate-bindings", + "capability.railiance.telemetry-package", + "capability.railiance.tenant-engine-package", + "capability.railiance.user-engine-package", + "capability.resources.security-capacity", + "capability.security.adversarial-evidence", + "capability.security.agent-knowledge", + "capability.security.approval-lifecycle", + "capability.security.credential-lifecycle", + "capability.security.doctrine-review", + "capability.security.human-decision-workspace", + "capability.security.maturity-claims", + "capability.security.policy-publication", + "capability.security.posture-assessment", + "capability.security.practice-canon", + "capability.security.repository-secret-prevention", + "capability.security.risk-register", + "capability.security.structure-construction", + "capability.security.zone-reference" + ], + "stale": false, + "composed_at": "2026-10-14T04:48:46+00:00", + "warnings": null, + "private_sources": [ + "rapp-openbao", + "rapp-policy-nexus", + "rapp-postgres", + "rapp-telemetry", + "rapp-tenant-engine", + "rapp-user-engine", + "rapp-sbom-nexus" + ], + "write_attempt": { + "route": "reuse-surface-hub-write-token", + "pdp_decision": "decision:f730e3da14beebdd", + "result": "OpenBao 403 permission denied; helper not executed; no hub writes" + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json b/docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json new file mode 100644 index 00000000..af6b3430 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json @@ -0,0 +1,104 @@ +{ + "reason": "Anonymous source fetch returns 404; hub-side read credential or separately approved metadata publication is needed. Do not change repository visibility.", + "repos": [ + "rapp-openbao", + "rapp-policy-nexus", + "rapp-postgres", + "rapp-sbom-nexus", + "rapp-telemetry", + "rapp-tenant-engine", + "rapp-user-engine" + ], + "draft_registrations_not_ready": [ + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-openbao", + "url": "https://forgejo.coulomb.social/coulomb/rapp-openbao/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-policy-nexus", + "url": "https://forgejo.coulomb.social/coulomb/rapp-policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-postgres", + "url": "https://forgejo.coulomb.social/coulomb/rapp-postgres/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-telemetry", + "url": "https://forgejo.coulomb.social/coulomb/rapp-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-tenant-engine", + "url": "https://forgejo.coulomb.social/coulomb/rapp-tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-user-engine", + "url": "https://forgejo.coulomb.social/coulomb/rapp-user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-sbom-nexus", + "url": "https://forgejo.coulomb.social/coulomb/rapp-sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + } + ], + "needed_fields": [ + "auth_env name for an already admitted hub-side source-read credential", + "proof that the credential is limited to the intended repository read scope", + "successful hub-side index fetch without value disclosure", + "owner consent to metadata appearing in public federation" + ] +} diff --git a/docs/assessments/netkingdom-2026-10-14/hub-public-registration-plan.json b/docs/assessments/netkingdom-2026-10-14/hub-public-registration-plan.json new file mode 100644 index 00000000..160efdff --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hub-public-registration-plan.json @@ -0,0 +1,374 @@ +[ + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "approval-engine", + "url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "emergent-security", + "url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "fin-hub", + "url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "gate-house", + "url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "glas-harness", + "url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "informed-decision", + "url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "kings-guard", + "url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "maturity-engine", + "url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "ops-mason", + "url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "policy-nexus", + "url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rail-kubernetes", + "url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "railiance-bootstrap", + "url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "railiance-master", + "url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "railiance-telemetry", + "url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-playwright", + "url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "reef-railiance", + "url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rein-aharness", + "url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rein-openweights", + "url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "repo-manager", + "url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "resource-control", + "url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "risk-nexus", + "url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "role-engine", + "url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "runbook-tutorials", + "url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "sand-boxer", + "url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "sbom-nexus", + "url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "secrets-engine", + "url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "security-canon", + "url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "tenant-engine", + "url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "whitehat-security", + "url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "zone-engine", + "url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rail-knative", + "url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + } +] diff --git a/docs/assessments/netkingdom-2026-10-14/hub-registration-plan.json b/docs/assessments/netkingdom-2026-10-14/hub-registration-plan.json new file mode 100644 index 00000000..680a8d68 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hub-registration-plan.json @@ -0,0 +1,458 @@ +[ + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "approval-engine", + "url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "emergent-security", + "url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "fin-hub", + "url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "gate-house", + "url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "glas-harness", + "url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "informed-decision", + "url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "kings-guard", + "url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "maturity-engine", + "url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "ops-mason", + "url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "policy-nexus", + "url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rail-kubernetes", + "url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "railiance-bootstrap", + "url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "railiance-master", + "url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "railiance-telemetry", + "url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-openbao", + "url": "https://forgejo.coulomb.social/coulomb/rapp-openbao/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-playwright", + "url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-policy-nexus", + "url": "https://forgejo.coulomb.social/coulomb/rapp-policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-postgres", + "url": "https://forgejo.coulomb.social/coulomb/rapp-postgres/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-telemetry", + "url": "https://forgejo.coulomb.social/coulomb/rapp-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-tenant-engine", + "url": "https://forgejo.coulomb.social/coulomb/rapp-tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-user-engine", + "url": "https://forgejo.coulomb.social/coulomb/rapp-user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "reef-railiance", + "url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rein-aharness", + "url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rein-openweights", + "url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "repo-manager", + "url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "resource-control", + "url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "risk-nexus", + "url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "role-engine", + "url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "runbook-tutorials", + "url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "sand-boxer", + "url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "sbom-nexus", + "url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "secrets-engine", + "url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "security-canon", + "url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "tenant-engine", + "url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "whitehat-security", + "url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "zone-engine", + "url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rail-knative", + "url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-sbom-nexus", + "url": "https://forgejo.coulomb.social/coulomb/rapp-sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "domain": "infotech", + "enabled": true, + "required": false, + "registered_by": "codex-CUST-WP-0081" + } + } +] diff --git a/docs/assessments/netkingdom-2026-10-14/hub-registration-proposal.json b/docs/assessments/netkingdom-2026-10-14/hub-registration-proposal.json new file mode 100644 index 00000000..b847dce6 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hub-registration-proposal.json @@ -0,0 +1,14 @@ +{ + "id": "CUST81-REUSE-REGISTRATION-001", + "authority": "User explicitly requested establishment of reviewed capabilities with reuse-surface. Source publication and cross-repository writes approved through sandbox escalation. No grant beyond registry metadata.", + "target": "https://reuse.coulomb.social/v1/repos", + "helper_sha256": "55465aa4f6a41960055d1b7fcf578c812c917af3110e58676f343472977202fd", + "plan_sha256": "ec0edd0301c43cfb98b5beea7fd454975bca8f6900359df851e70dcc6e6d08df", + "actions": 38, + "credential_lane": "reuse-surface-hub-write-token through warden access --exec; no credential export or persistence", + "expected": "All 60 reviewed owner indexes registered, all 70 reviewed IDs discoverable exactly once with source parity", + "verification": "Public HTTPS raw index and entry hashes, registration readback and fresh hosted federation payload", + "rollback": "Disable only newly created registrations from the exact plan if discovery is incorrect; preserve existing registrations. Source metadata can be reverted by the registry-only commits.", + "cost": "No service deployment or new recurring resource commitment; 38 bounded metadata writes and public readback on existing services.", + "risk": "Incorrect catalog discovery or temporary compose errors; no identity, policy, credential grant, workload or audit authority change. Stop on conflicting registration or transport failure." +} diff --git a/docs/assessments/netkingdom-2026-10-14/hub-registration-receipt.json b/docs/assessments/netkingdom-2026-10-14/hub-registration-receipt.json new file mode 100644 index 00000000..8cc40171 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hub-registration-receipt.json @@ -0,0 +1,9 @@ +{ + "complete": false, + "actions": [], + "helper_executed": false, + "credential_lane_result": "OpenBao HTTP 403", + "pdp_decision": "decision:f730e3da14beebdd", + "public_registrations_ready": 31, + "private_registrations_pending": 7 +} diff --git a/docs/assessments/netkingdom-2026-10-14/inventory.json b/docs/assessments/netkingdom-2026-10-14/inventory.json new file mode 100644 index 00000000..a36f4f1c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/inventory.json @@ -0,0 +1,2905 @@ +{ + "as_of": "2026-10-14", + "capabilities": [ + { + "repo": "security-canon", + "id": "capability.security.practice-canon", + "name": "Security practice and authority vocabulary", + "availability": "A0", + "operational_estimate": 2, + "surface": "Versioned SEC-DSM and Mode of Authority documents", + "limitation": "Normative practice; no runtime control or certification", + "use_cases": [ + "U01", + "U07", + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.practice-canon.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom security architecture and conformance tooling", + "availability": "A2", + "operational_estimate": 2, + "surface": "Versioned IAM, layer, tenancy and credential contracts plus validators", + "limitation": "Mixed accepted and proposed standards; framework integration remains incomplete", + "use_cases": [ + "U01", + "U02", + "U03", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "SECURITY-COMPANION.md" + ], + "existing_entry_path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "prior_vector": "D3 / A2 / C1 / R1", + "vector": "D3 / A2 / C1 / R1", + "entry_path": "registry/capabilities/capability.security.iam-tooling-suite.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.scenario-compose", + "name": "Deterministic security scenario composition", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI selects pinned providers and orders trust transitions", + "limitation": "Plan only; execution.permitted is always false", + "use_cases": [ + "U01", + "U14" + ], + "artifacts": [ + "tools/security-scenario-composer/README.md", + "tools/security-scenario-composer/security_scenario_composer.py" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.scenario-compose.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.posture-feedback", + "name": "Deterministic posture feedback", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI evaluates evidence age and posture into owner-routed findings", + "limitation": "Proposal only; no policy changes or remediation execution", + "use_cases": [ + "U09", + "U14" + ], + "artifacts": [ + "tools/posture-feedback/README.md", + "tools/posture-feedback/posture_feedback.py" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.posture-feedback.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.case-contracts", + "name": "Security case types and instance validation", + "availability": "A2", + "operational_estimate": 2, + "surface": "Versioned types, cases and schema validation", + "limitation": "Type acknowledgment, case acceptance, structural materialization and native execution are distinct", + "use_cases": [ + "U01", + "U05", + "U06" + ], + "artifacts": [ + "tools/security-case-types/README.md", + "canon/standards/security-case-types_v0.1.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.case-contracts.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.bootstrap-recovery", + "name": "Guarded bootstrap and recovery preparation", + "availability": "A2", + "operational_estimate": 2, + "surface": "Local identity, bootstrap console, encrypted custody handoff and caller tools", + "limitation": "Source repairs and disposable native fixtures do not prove estate root isolation or recovery", + "use_cases": [ + "U10" + ], + "artifacts": [ + "tools/security-bootstrap-console/README.md", + "tools/custody-record/README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.bootstrap-recovery.md" + }, + { + "repo": "net-kingdom", + "id": "capability.security.emission-profile", + "name": "Security emission cadence validation", + "availability": "A2", + "operational_estimate": 2, + "surface": "Security profile over generic emission contracts and validator", + "limitation": "Profile adoption and source completeness require owner-native evidence", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "tools/emission-cadence-profile/README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.emission-profile.md" + }, + { + "repo": "key-cape", + "id": "capability.iam.key-cape", + "name": "OIDC identity and assurance", + "availability": "A4", + "operational_estimate": 3, + "surface": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI", + "limitation": "Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates", + "use_cases": [ + "U02", + "U03", + "U04", + "U10" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.iam.key-cape.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A4 / C2 / R1", + "entry_path": "registry/capabilities/capability.iam.key-cape.md" + }, + { + "repo": "user-engine", + "id": "capability.identity.user-engine", + "name": "User lifecycle and account journeys", + "availability": "A4", + "operational_estimate": 3, + "surface": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog", + "limitation": "Application readback is advisory; applications must enforce their own authorization", + "use_cases": [ + "U02", + "U03", + "U10" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.identity.user-engine.md", + "prior_vector": "D4 / A1 / C2 / R0", + "vector": "D4 / A4 / C2 / R0", + "entry_path": "registry/capabilities/capability.identity.user-engine.md" + }, + { + "repo": "tenant-engine", + "id": "capability.identity.tenant-facts", + "name": "Tenant lifecycle and guardrail facts", + "availability": "A4", + "operational_estimate": 3, + "surface": "Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store", + "limitation": "Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate", + "use_cases": [ + "U03", + "U04" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.identity.tenant-facts.md" + }, + { + "repo": "zone-engine", + "id": "capability.security.zone-reference", + "name": "Zone membership reference conformance", + "availability": "A2", + "operational_estimate": 2, + "surface": "Offline resolution, exception and lineage checks", + "limitation": "No live zone engine, PDP or protected side effects", + "use_cases": [ + "U01", + "U03", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.zone-reference.md" + }, + { + "repo": "access-engine", + "id": "capability.authorization.policy-evaluate", + "name": "Policy evaluation and decision evidence", + "availability": "A4", + "operational_estimate": 3, + "surface": "Check, batch, list-allowed, explain, binding, lifetime and decision records", + "limitation": "One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct", + "use_cases": [ + "U03", + "U04", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A4 / C2 / R1", + "entry_path": "registry/capabilities/capability.authorization.policy-evaluate.md" + }, + { + "repo": "approval-engine", + "id": "capability.security.approval-lifecycle", + "name": "Bound approval lifecycle", + "availability": "A4", + "operational_estimate": 2, + "surface": "Authenticated issue, claim, revoke, supersede and atomic consume API with outbox", + "limitation": "Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open", + "use_cases": [ + "U04", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "approval_engine/api.py", + "docs/production-dependencies.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.approval-lifecycle.md" + }, + { + "repo": "secrets-engine", + "id": "capability.security.credential-lifecycle", + "name": "Cataloged credential lifecycle", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke", + "limitation": "Production protected execution and independently anchored PDP authentication remain incomplete", + "use_cases": [ + "U04", + "U05", + "U07" + ], + "artifacts": [ + "SCOPE.md", + "src/secrets_engine/decision_check.py" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.credential-lifecycle.md" + }, + { + "repo": "ops-warden", + "id": "capability.security.ssh-certificate-issuance", + "name": "Decision-bound SSH certificates", + "availability": "A3", + "operational_estimate": 3, + "surface": "warden sign with local and OpenBao backends and adm/agt/atm actors", + "limitation": "Direct Tooling contact is a declared gap; certificate reachability is not target authorization", + "use_cases": [ + "U06" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "prior_vector": "D4 / A3 / C3 / R2", + "vector": "D4 / A3 / C3 / R2", + "entry_path": "registry/capabilities/capability.security.ssh-certificate-issuance.md" + }, + { + "repo": "ops-warden", + "id": "capability.security.access-routing", + "name": "Credential routing and contained access", + "availability": "A3", + "operational_estimate": 3, + "surface": "warden route and access catalog; exact lane conduit and secret-exec routing", + "limitation": "Routing grants no authority; interim delegates and attended high-risk lanes persist", + "use_cases": [ + "U04", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "wiki/CredentialRouting.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A3 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.access-routing.md" + }, + { + "repo": "ops-warden", + "id": "capability.security.case-follow-through", + "name": "Security case operational follow-through", + "availability": "A2", + "operational_estimate": 2, + "surface": "KnownSecurityCase route, plan and operational receipts", + "limitation": "Execution requires accepted structure and exact owner contracts; case closure is not automatic", + "use_cases": [ + "U01", + "U05", + "U06" + ], + "artifacts": [ + "workplans/WARDEN-WP-0044-security-case-follow-through.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.case-follow-through.md" + }, + { + "repo": "ops-mason", + "id": "capability.security.structure-construction", + "name": "Reviewed security structure construction", + "availability": "A2", + "operational_estimate": 2, + "surface": "Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply", + "limitation": "Founder plan gate is an explicit exception; not full PDP conformance", + "use_cases": [ + "U01", + "U05", + "U06" + ], + "artifacts": [ + "SCOPE.md", + "docs/construction-plan-format.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.structure-construction.md" + }, + { + "repo": "ops-bridge", + "id": "capability.ops.tunnel-bridge", + "name": "SSH tunnel lifecycle", + "availability": "A2", + "operational_estimate": 3, + "surface": "Named tunnels, reconnect, health and TTL-aware cert_command", + "limitation": "Private transport does not authenticate applications or decide access", + "use_cases": [ + "U06" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "prior_vector": "D3 / A2 / C2 / R1", + "vector": "D3 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.ops.tunnel-bridge.md" + }, + { + "repo": "audit-core", + "id": "capability.audit.event-retain", + "name": "Independent audit custody", + "availability": "A4", + "operational_estimate": 3, + "surface": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation", + "limitation": "Custody after arrival does not prove source completeness; freshness bounds integrity assertions", + "use_cases": [ + "U08", + "U09", + "U10" + ], + "artifacts": [ + "SCOPE.md", + "docs/stream-completeness.md" + ], + "existing_entry_path": "registry/capabilities/capability.audit.event-retain.md", + "prior_vector": "D4 provision / A4 / C3 / R2", + "vector": "D3 / A4 / C3 / R2", + "entry_path": "registry/capabilities/capability.audit.event-retain.md" + }, + { + "repo": "maturity-engine", + "id": "capability.security.maturity-claims", + "name": "Evidence-based maturity claims and gap register", + "availability": "A2", + "operational_estimate": 2, + "surface": "SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory", + "limitation": "No production deployment claimed; levels supply facts and cannot authorize actions", + "use_cases": [ + "U09", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "docs/claim-contract.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.maturity-claims.md" + }, + { + "repo": "kings-guard", + "id": "capability.security.posture-assessment", + "name": "Security posture assessment and response proposals", + "availability": "A2", + "operational_estimate": 2, + "surface": "Normalized observation evaluator, cadence checks and secret-use snapshot adapter", + "limitation": "Bounded reference pilot; containment proposals only; deployed-stream admission remains open", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "SCOPE.md", + "docs/SecretUseSnapshotAdmission.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.posture-assessment.md" + }, + { + "repo": "whitehat-security", + "id": "capability.security.adversarial-evidence", + "name": "Authorized adversarial evidence harness", + "availability": "A2", + "operational_estimate": 2, + "surface": "Offline ASM and tenancy calibrations and engagement admission", + "limitation": "Live probes require a complete engagement; no blanket target authorization", + "use_cases": [ + "U03", + "U08", + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.adversarial-evidence.md" + }, + { + "repo": "gate-house", + "id": "capability.security.doctrine-review", + "name": "Security doctrine and architecture review", + "availability": "A0", + "operational_estimate": 3, + "surface": "Layer rules, authority context, ASM criteria and interpretations", + "limitation": "Staff judgment; no runtime PDP, credential issuer or automatic enforcement", + "use_cases": [ + "U01", + "U09", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "INTENT.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.doctrine-review.md" + }, + { + "repo": "emergent-security", + "id": "capability.security.agent-knowledge", + "name": "Verified security orientation for agents", + "availability": "A2", + "operational_estimate": 2, + "surface": "Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports", + "limitation": "Current start card withheld for source drift; orientation never grants authority", + "use_cases": [ + "U01", + "U11", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "knowledge/cards/start.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.agent-knowledge.md" + }, + { + "repo": "informed-decision", + "id": "capability.security.human-decision-workspace", + "name": "Human security decision presentation and disposition", + "availability": "A4", + "operational_estimate": 3, + "surface": "Headless lifecycle and browser workspace with exact native approval references", + "limitation": "Initial audience is bounded; Approval Engine owns approval state, Access Engine decides", + "use_cases": [ + "U04", + "U05", + "U09" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.human-decision-workspace.md" + }, + { + "repo": "policy-nexus", + "id": "capability.security.policy-publication", + "name": "Policy publication with source provenance", + "availability": "A2", + "operational_estimate": 3, + "surface": "Generated immutable publication, source currency and stable policy URLs", + "limitation": "Publication does not ratify policy or enforce it", + "use_cases": [ + "U01", + "U09", + "U14" + ], + "artifacts": [ + "README.md", + "docs/publication-contract.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.policy-publication.md" + }, + { + "repo": "risk-nexus", + "id": "capability.security.risk-register", + "name": "Security risk and exception review register", + "availability": "A2", + "operational_estimate": 2, + "surface": "Markdown findings and Python review, verification and due-work reports", + "limitation": "Judgment remains human or agent; no live EUR risk gate or autonomous response", + "use_cases": [ + "U09", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.risk-register.md" + }, + { + "repo": "role-engine", + "id": "capability.organization.role-catalog", + "name": "Organizational role definitions", + "availability": "A0", + "operational_estimate": 1, + "surface": "Versioned documentation catalog", + "limitation": "Not IAM roles, assignments or runtime authorization", + "use_cases": [ + "U01", + "U11" + ], + "artifacts": [ + "README.md", + "INTENT.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.organization.role-catalog.md" + }, + { + "repo": "glas-harness", + "id": "capability.execution.profile-harness", + "name": "Profile-bound agent execution lifecycle", + "availability": "A3", + "operational_estimate": 2, + "surface": "Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration", + "limitation": "No ready profile asserted by SCOPE; Custodian native isolation remains open", + "use_cases": [ + "U11" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A3 / C1 / R0", + "entry_path": "registry/capabilities/capability.execution.profile-harness.md" + }, + { + "repo": "sand-boxer", + "id": "capability.execution.sandbox-provision", + "name": "Sandbox establishment and lifecycle", + "availability": "A5", + "operational_estimate": 2, + "surface": "Profiles, extensions, provision, checkpoints, TTL teardown and telemetry", + "limitation": "Backend-specific guarantees; a created sandbox alone proves no credential isolation", + "use_cases": [ + "U11", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/execution.sandbox-provision.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D5 / A5 / C5 / R0", + "entry_path": "registry/capabilities/execution.sandbox-provision.md" + }, + { + "repo": "rein-aharness", + "id": "capability.execution.scheduled-agent-rein", + "name": "Scheduled agent intake and harness routing", + "availability": "A2", + "operational_estimate": 3, + "surface": "Activity Core lease claim/heartbeat and Glas profile execution", + "limitation": "Legacy paths are time-gated; task success is not privileged authority", + "use_cases": [ + "U09", + "U11" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.execution.scheduled-agent-rein.md" + }, + { + "repo": "rein-openweights", + "id": "capability.execution.openweight-rein", + "name": "Bounded open-weight agent execution", + "availability": "A2", + "operational_estimate": 2, + "surface": "Tool loop, path guards, turn/budget limits and verified-commit result", + "limitation": "Provider credential acquisition and runtime authority need separate custody controls", + "use_cases": [ + "U11" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.execution.openweight-rein.md" + }, + { + "repo": "agentic-resources", + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "availability": "A2", + "operational_estimate": 2, + "surface": "Capture sessions, curate patterns, distribute lessons and measure outcomes", + "limitation": "Workforce assignments and broader authority contracts remain proposed", + "use_cases": [ + "U09", + "U11" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.agents.performance-learning.md" + }, + { + "repo": "runbook-tutorials", + "id": "capability.infotech.runbook-tutorials", + "name": "Guided administrative runbooks", + "availability": "A2", + "operational_estimate": 2, + "surface": "Pack schema, loader, local UI/CLI, gates, verification and rollback evidence", + "limitation": "Owner supplies procedures; UI progress is not runtime approval", + "use_cases": [ + "U05", + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "docs/pack-spec.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.infotech.runbook-tutorials.md" + }, + { + "repo": "repo-manager", + "id": "capability.security.repository-secret-prevention", + "name": "Repository metadata and staged-secret prevention", + "availability": "A2", + "operational_estimate": 3, + "surface": "Repository observation plus pinned staged-blob scanner and hook integration", + "limitation": "Local hooks are bypassable; coverage is exact-checkout scoped", + "use_cases": [ + "U07", + "U12" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.repository-secret-prevention.md" + }, + { + "repo": "sbom-nexus", + "id": "capability.infotech.sbom-management", + "name": "Dependency provenance and SBOM evidence", + "availability": "A4", + "operational_estimate": 3, + "surface": "Controlled archive ingest, immutable snapshots, freshness and license review", + "limitation": "SBOM and license evidence do not prove vulnerability exploitability or artifact trust", + "use_cases": [ + "U12", + "U09" + ], + "artifacts": [ + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.sbom-management.md", + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.infotech.sbom-management.md" + }, + { + "repo": "activity-core", + "id": "capability.activity.event-coordinate", + "name": "Durable automation and bounded operations", + "availability": "A4", + "operational_estimate": 3, + "surface": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks", + "limitation": "Not a general shell executor; first unassisted security-flow cadence acceptance remains open", + "use_cases": [ + "U09", + "U12" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.activity.event-coordinate.md", + "prior_vector": "D3 / A1 / C1 / R0", + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.activity.event-coordinate.md" + }, + { + "repo": "issue-core", + "id": "capability.infotech.issue-tracking", + "name": "External issue tracker connector", + "availability": "A2", + "operational_estimate": 2, + "surface": "CLI and Python adapters for external issue systems", + "limitation": "Internal work originates in owner files; external projection is optional", + "use_cases": [ + "U09" + ], + "artifacts": [ + "README.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.issue-tracking.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.infotech.issue-tracking.md" + }, + { + "repo": "state-hub", + "id": "capability.statehub.workstream-coordinate", + "name": "Cross-repository work tracking", + "availability": "A4", + "operational_estimate": 3, + "surface": "File-derived workplans, tasks, dependencies, decisions and coordination views", + "limitation": "Read/cache/index of owner work; not runtime approval authority", + "use_cases": [ + "U09" + ], + "artifacts": [ + "README.md", + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "prior_vector": "D4 / A4 / C3 / R2", + "vector": "D4 / A4 / C3 / R2", + "entry_path": "registry/capabilities/capability.statehub.workstream-coordinate.md" + }, + { + "repo": "state-hub", + "id": "capability.statehub.progress-log", + "name": "Progress and work evidence indexing", + "availability": "A4", + "operational_estimate": 3, + "surface": "REST progress and task evidence references", + "limitation": "Not independent security event custody", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "README.md", + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.statehub.progress-log.md", + "prior_vector": "D4 / A4 / C3 / R3", + "vector": "D4 / A4 / C3 / R3", + "entry_path": "registry/capabilities/capability.statehub.progress-log.md" + }, + { + "repo": "the-custodian", + "id": "capability.agents.custodian-runtime-tooling", + "name": "Generic agent runtime and repository tooling", + "availability": "A2", + "operational_estimate": 2, + "surface": "Agent runtime modules and repository classification tooling", + "limitation": "Only generic tooling is reusable; confidential canon and session memory are excluded", + "use_cases": [ + "U09", + "U11", + "U14" + ], + "artifacts": [ + "runtime/README.md" + ], + "existing_entry_path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "prior_vector": "D2 / A1 / C1 / R0", + "vector": "D2 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md" + }, + { + "repo": "coordination-engine", + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "availability": "A2", + "operational_estimate": 2, + "surface": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime", + "limitation": "Coordinates owners without replacing their execution or security authority", + "use_cases": [ + "U09" + ], + "artifacts": [ + "SCOPE.md", + "spec/cross-owner-wait-mode-v0.1.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.coordination.cross-owner-work.md" + }, + { + "repo": "reuse-surface", + "id": "capability.registry.register", + "name": "Capability registry and federation", + "availability": "A3", + "operational_estimate": 3, + "surface": "Owner Markdown entries, indexes, federation hub and planning queries", + "limitation": "Discovery is not readiness; empty and stale entries need evidence-led maintenance", + "use_cases": [ + "U01", + "U09", + "U14" + ], + "artifacts": [ + "docs/RegistryFederation.md", + "specs/CapabilityMaturityStandard.md" + ], + "existing_entry_path": "registry/capabilities/capability.registry.register.md", + "prior_vector": "D3 / A4 / C2 / R3", + "vector": "D3 / A3 / C2 / R3", + "entry_path": "registry/capabilities/capability.registry.register.md" + }, + { + "repo": "reuse-surface", + "id": "capability.registry.validate", + "name": "Capability registry validation", + "availability": "A3", + "operational_estimate": 3, + "surface": "Schema, index consistency and relation checks", + "limitation": "Schema validity alone proves neither capability behavior nor hosted freshness", + "use_cases": [ + "U01", + "U14" + ], + "artifacts": [ + "docs/RegistryFederation.md", + "schemas/capability.schema.yaml" + ], + "existing_entry_path": "registry/capabilities/capability.registry.validate.md", + "prior_vector": "D4 / A3 / C3 / R3", + "vector": "D4 / A3 / C3 / R3", + "entry_path": "registry/capabilities/capability.registry.validate.md" + }, + { + "repo": "info-tech-canon", + "id": "capability.infotech.canon-service", + "name": "Shared semantic contracts and validation", + "availability": "A4", + "operational_estimate": 2, + "surface": "Markdown canon with library, CLI and read-only API", + "limitation": "Mixed seed/candidate maturity; validation is not owner runtime conformance", + "use_cases": [ + "U01", + "U08", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.infotech.canon-service.md", + "prior_vector": "D2 / A2 / C1 / R0", + "vector": "D2 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.infotech.canon-service.md" + }, + { + "repo": "railiance-master", + "id": "capability.railiance.security-consumption-contracts", + "name": "Platform security consumption architecture", + "availability": "A0", + "operational_estimate": 2, + "surface": "Rail/rapp/reef boundaries, exposure and security consumption contracts", + "limitation": "Architecture declarations do not prove implementation or production admission", + "use_cases": [ + "U01", + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "docs/netkingdom-security-consumption-contract.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.security-consumption-contracts.md" + }, + { + "repo": "railiance-platform", + "id": "capability.railiance.platform-services", + "name": "Secret custody and platform data services", + "availability": "A2", + "operational_estimate": 3, + "surface": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts", + "limitation": "Package ownership is split to rapp repos; caches and object services are demand-led", + "use_cases": [ + "U04", + "U05", + "U07", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md", + "docs/openbao.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.platform-services.md", + "prior_vector": "D3 / A2 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.platform-services.md" + }, + { + "repo": "railiance-infra", + "id": "capability.railiance.infra-provisioning", + "name": "Host convergence and security baseline", + "availability": "A2", + "operational_estimate": 3, + "surface": "Ansible inventory, firewall, SSH bootstrap and baseline verification", + "limitation": "Current hosts differ from the retained Hetzner provisioning path", + "use_cases": [ + "U06", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "prior_vector": "D4 / A2 / C2 / R1", + "vector": "D4 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.railiance.infra-provisioning.md" + }, + { + "repo": "railiance-cluster", + "id": "capability.railiance.cluster-bootstrap", + "name": "Kubernetes runtime and cluster controls", + "availability": "A2", + "operational_estimate": 3, + "surface": "k3s, ingress, CNI, operators and kubeconfig/runtime checks", + "limitation": "Single-node runtime and workload recovery are distinct from bootstrap success", + "use_cases": [ + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "prior_vector": "D3 / A2 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.cluster-bootstrap.md" + }, + { + "repo": "railiance-enablement", + "id": "capability.railiance.ci-enablement", + "name": "Developer delivery and CI templates", + "availability": "A2", + "operational_estimate": 2, + "surface": "Reusable CI workflows, build and deployment patterns", + "limitation": "Templates do not prove mandatory checks or runner isolation", + "use_cases": [ + "U12", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.ci-enablement.md", + "prior_vector": "D3 / A2 / C2 / R1", + "vector": "D3 / A2 / C2 / R1", + "entry_path": "registry/capabilities/capability.railiance.ci-enablement.md" + }, + { + "repo": "railiance-forge", + "id": "capability.railiance.forge-infrastructure", + "name": "Source forge, registries and runner substrate", + "availability": "A2", + "operational_estimate": 3, + "surface": "Forgejo operation, package registries and runner lifecycle", + "limitation": "Runner workload authority and independent verification coverage remain open", + "use_cases": [ + "U12" + ], + "artifacts": [ + "SCOPE.md", + "workplans/FORGE-WP-0006-independent-secret-detection.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "prior_vector": "D3 / A1 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.forge-infrastructure.md" + }, + { + "repo": "railiance-forge", + "id": "capability.security.forge-secret-prevention", + "name": "Independent introduced-history secret prevention", + "availability": "A2", + "operational_estimate": 3, + "surface": "Pinned receive adapter, lifecycle template and fail-closed scan", + "limitation": "Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate", + "use_cases": [ + "U07", + "U12" + ], + "artifacts": [ + "workplans/FORGE-WP-0006-independent-secret-detection.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.security.forge-secret-prevention.md" + }, + { + "repo": "railiance-apps", + "id": "capability.railiance.workload-deployment-tooling", + "name": "Workload release configuration and guards", + "availability": "A2", + "operational_estimate": 3, + "surface": "Helm/manifests, exact image pins, application runbooks and rollout/rollback", + "limitation": "Release settings depend on underlying platform and workload owners", + "use_cases": [ + "U12", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "prior_vector": "D3 / A2 / C1 / R1", + "vector": "D3 / A2 / C1 / R1", + "entry_path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md" + }, + { + "repo": "railiance-bootstrap", + "id": "capability.railiance.bootstrap-sequencing", + "name": "Bootstrap sequencing contracts", + "availability": "A0", + "operational_estimate": 1, + "surface": "Bare-VM to estate sequence and handoff contract", + "limitation": "End-to-end unattended rebuild is not established", + "use_cases": [ + "U10", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.bootstrap-sequencing.md" + }, + { + "repo": "rail-kubernetes", + "id": "capability.railiance.kubernetes-rail", + "name": "Generic Kubernetes workload lifecycle", + "availability": "A2", + "operational_estimate": 2, + "surface": "Workload declaration, rollout, observe, promote and rollback surfaces", + "limitation": "Compatibility extraction remains; not cluster or application-domain ownership", + "use_cases": [ + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.kubernetes-rail.md" + }, + { + "repo": "reef-railiance", + "id": "capability.railiance.substrate-bindings", + "name": "Substrate topology and bindings", + "availability": "A0", + "operational_estimate": 2, + "surface": "Grouped home-reef identity, topology and placement declarations", + "limitation": "Declarations are not automatic placement or authorization", + "use_cases": [ + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A0 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.substrate-bindings.md" + }, + { + "repo": "railiance-fabric", + "id": "capability.railiance.fabric-graph", + "name": "Infrastructure ownership and dependency graph", + "availability": "A2", + "operational_estimate": 2, + "surface": "Schemas, validation, graph queries and State Hub exports", + "limitation": "Graph assertions need current owner evidence; not an enforcement registry", + "use_cases": [ + "U09", + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": "registry/capabilities/capability.railiance.fabric-graph.md", + "prior_vector": "D3 / A1 / C1 / R0", + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.fabric-graph.md" + }, + { + "repo": "rapp-openbao", + "id": "capability.railiance.openbao-package", + "name": "Managed OpenBao deployment package", + "availability": "A2", + "operational_estimate": 3, + "surface": "Helm values, package deploy/status/smoke/rollback and custody boundary", + "limitation": "Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit", + "use_cases": [ + "U04", + "U10", + "U13" + ], + "artifacts": [ + "README.md", + "docs/retained-s3-handoff.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.openbao-package.md" + }, + { + "repo": "rapp-postgres", + "id": "capability.railiance.postgres-isolation-recovery", + "name": "Database isolation and recovery package", + "availability": "A2", + "operational_estimate": 3, + "surface": "CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures", + "limitation": "Host-loss proof and consumer schemas stay with their owners", + "use_cases": [ + "U03", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.postgres-isolation-recovery.md" + }, + { + "repo": "rapp-user-engine", + "id": "capability.railiance.user-engine-package", + "name": "User Engine runtime package", + "availability": "A2", + "operational_estimate": 3, + "surface": "Pinned deployment, dedicated CNPG, ExternalSecret references and rollback", + "limitation": "Domain, identity, PDP and custody authority are separate", + "use_cases": [ + "U02", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.user-engine-package.md" + }, + { + "repo": "rapp-tenant-engine", + "id": "capability.railiance.tenant-engine-package", + "name": "Tenant Engine runtime package", + "availability": "A2", + "operational_estimate": 2, + "surface": "Package declaration, smoke and rollback", + "limitation": "No tenant-domain ownership or credential values", + "use_cases": [ + "U03", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.tenant-engine-package.md" + }, + { + "repo": "rapp-policy-nexus", + "id": "capability.railiance.policy-publication-package", + "name": "Policy publication runtime package", + "availability": "A2", + "operational_estimate": 3, + "surface": "Immutable image, non-root/read-only runtime and approved TLS exposure", + "limitation": "No policy authoring or DNS/issuer administration", + "use_cases": [ + "U01", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.policy-publication-package.md" + }, + { + "repo": "rapp-playwright", + "id": "capability.railiance.browser-verification", + "name": "Managed browser verification pilot", + "availability": "A4", + "operational_estimate": 2, + "surface": "Bounded jobs, cancellation, artifacts, origin checks and restart receipts", + "limitation": "Pilot deployed; human/agent authentication and per-caller self-service connectivity pending", + "use_cases": [ + "U02", + "U14" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.browser-verification.md" + }, + { + "repo": "railiance-telemetry", + "id": "capability.observability.security-signals", + "name": "Security-relevant telemetry contracts and adapters", + "availability": "A2", + "operational_estimate": 2, + "surface": "Signal contract, platform adapters, report exporter and absence/alert rules", + "limitation": "Reference receiver is not a second production plane; end-to-end delivery acceptance pending", + "use_cases": [ + "U08", + "U09" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.observability.security-signals.md" + }, + { + "repo": "rapp-telemetry", + "id": "capability.railiance.telemetry-package", + "name": "Private monitoring package", + "availability": "A2", + "operational_estimate": 2, + "surface": "Prometheus, Alertmanager and Grafana package with isolated restore evidence", + "limitation": "Private installation only; recurring recovery capture and audited confirmation pending", + "use_cases": [ + "U08", + "U09", + "U10" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.telemetry-package.md" + }, + { + "repo": "resource-control", + "id": "capability.resources.security-capacity", + "name": "Capacity and recovery resource planning", + "availability": "A2", + "operational_estimate": 2, + "surface": "Provider-neutral inventory, procurement evidence and optimization reports", + "limitation": "No payment authority or irreversible procurement; metrics do not prove usable runtime capacity", + "use_cases": [ + "U09", + "U10", + "U13" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.resources.security-capacity.md" + }, + { + "repo": "fin-hub", + "id": "capability.finance.security-budget-evidence", + "name": "Budget and cost evidence for security operations", + "availability": "A4", + "operational_estimate": 2, + "surface": "Budget, commitment, spend attribution and planning-evidence consumption", + "limitation": "No verified concurrent runtime EUR risk/cost enforcement for agents", + "use_cases": [ + "U09", + "U11" + ], + "artifacts": [ + "SCOPE.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A4 / C1 / R0", + "entry_path": "registry/capabilities/capability.finance.security-budget-evidence.md" + } + ], + "repositories": { + "access-engine": { + "head": "16ca97b2776789f730cc7049a2d6533612faaccd", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:f6c14f5f824fb86ac06368fb9c52e60d627ee42810817a45723d34a6a9a178a5", + "README.md": "sha256:7ed086b4d153ff067f4f8d3665891b65006a4a74cec8e6fb596e7e1dbd097b38", + "SCOPE.md": "sha256:dd1484a32a313135e69f16dbc833d768467491438bbb1d9127c2b098061edb60" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.authorization.policy-evaluate", + "name": "Authorization Policy Evaluation", + "summary": "Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "flex-auth", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "tags": [ + "authorization", + "policy", + "flex-auth" + ], + "consumption_modes": [ + "source module" + ] + } + ] + } + }, + "activity-core": { + "head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:8aec524060edb9309af679ef38bc5549aa3650752634d23977c7ae57c45bbefa", + "README.md": "sha256:549e7878b27bbf7edc9e958c7afbacd3eba773b082151d226b5f0a14af654f9b", + "SCOPE.md": "sha256:820aafbff2f7d1c314c0c270d745468172a0500d106ab276216e0eeb702ca7bd" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Organizational Event Coordination", + "summary": "Coordinate structured responses to cross-domain events through activity workflows and automation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "tags": [ + "activity", + "coordination", + "automation" + ], + "consumption_modes": [ + "informational" + ] + } + ] + } + }, + "agentic-resources": { + "head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:81dc51facb26c36ab6b7bc85a22802bbf89c88558c7cb3e749e0c205a0ba24d4", + "README.md": "sha256:4e890352ff6088a2e018a11738a1959971b07b584a4ca3b8fb2aed88b9ea26f1", + "SCOPE.md": "sha256:ba38e80cf2a374063eb6b6b60211a02e32bca5d3b260aea5f8a70978f67a5627" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "approval-engine": { + "head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:06dbab07ed14fa43d0fc6b54eaacc2b3f7b4a9196050e3f73c9c4e58086636c5", + "README.md": "sha256:4d095613decf7d64012e19d4e76823296bdbeedc82cae17c9b5cf752671b45c9", + "SCOPE.md": "sha256:1425d4ae5942cf09197719b1f66989c4d5e8d2d5627c7fa79dc6151908b03990", + "approval_engine/api.py": "sha256:4c686aa3b4d645c4ad2a84a5f299db9b013b59a5c747853837adbe3a3a05be63", + "docs/production-dependencies.md": "sha256:c2244e4a72dc174d0f5e9fc7da6b56fac2596d4b553a11c738976404cef05fa8" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "audit-core": { + "head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:cffd7a3730ea54dab4e745329005813011bb821d9922d9a6aff3977ec46162c7", + "README.md": "sha256:c7ab22ae28d07afc746d7cb10e168291dfbc3207be60cd32ec416ff0f27f51f1", + "SCOPE.md": "sha256:358ecab2cf8e32567f2220c5cd3d9b3f7ce9349faaa8d89bc464d5f82f09e80e", + "docs/stream-completeness.md": "sha256:e3c4b1e0ff5bdd648077ae0b6473a0094ccb4a65e8ce398df11aa43faf0d65cf" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-08-16", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.audit.event-retain", + "name": "Audit Event Retention", + "summary": "Collect, normalize, retain, and search audit events with integrity evidence across tenants.", + "joins": "operations.audit", + "provision": "data/capability/audit-core-operational.json", + "vector": "D4 provision / A4 / C3 / R2", + "domain": "infotech", + "status": "production", + "owner": "audit-core", + "path": "registry/capabilities/capability.audit.event-retain.md", + "tags": [ + "audit", + "retention", + "compliance" + ], + "consumption_modes": [ + "http ingest", + "source module" + ] + } + ] + } + }, + "coordination-engine": { + "head": "c401067842072b75717f76480dd6e7db1836059c", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:7236c8dc284fcbe81c47eedde25e197d5a911a73267bfd448f8930140d2f6fd9", + "README.md": "sha256:fa6812b74956387a85cf07ccf3ef05f79aa07ca937e6f5d073edd318238e768d", + "SCOPE.md": "sha256:e207efd8bf40ede4ad6c2705121cefc809467dab72746054850c62f2e2e3a12e", + "spec/cross-owner-wait-mode-v0.1.md": "sha256:42f51f8dd1523a1243797fc3fc21a0d6d756c4e9d9d77142296735c1ef6de915" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "emergent-security": { + "head": "4c6fda38298fa50665ead41526b893adf069d335", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:64daea4874c8d8822a52437b15ffc8f9d5e30491dd0b61d0958bd186d1dc7269", + "README.md": "sha256:40e23e0233f5b33949fc25047cea13b827af3d44bd73e00b3c4eb8b1feb338cc", + "SCOPE.md": "sha256:b90916cef962e5999c8fee886f5d0b68f55707a38f428a20d0390d2bf2c0d603", + "knowledge/cards/start.md": "sha256:698a18f4a8f97a43da75ed0767aa0425c970e17c04a9cbea75cfab719564cc5d" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "fin-hub": { + "head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:7697ddd29c8324197c925378c55eadcbf89899903af4321d0325f26e52ca3d19", + "README.md": "sha256:f35fb3d21f6264f8fab0ab204b79c81f82e6f9764ebc06aa0735d330ad854470", + "SCOPE.md": "sha256:2ef38e5d1a36dedfa7785f128a35b0058ae7e123bba834efa41dcc809d18a631" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "gate-house": { + "head": "bc890c4d050a2e726ce8988a8260ab9caea133e3", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:013692bbb52ce85dc1ad8dc95292c64d4e7c2c58714549a1e23331eae5d556e7", + "README.md": "sha256:e2c7b7c94884260f4e3e33d963544299a6076bd63729baa0e03e0bb34c423002", + "SCOPE.md": "sha256:5c7b9bc38fa7887f2188c34cb1110e37f47f2b9ebc4f33e85ef96ef80a1c9a79" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "glas-harness": { + "head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:d9c256243816e372757a256b0c2b87f5a0333fb1d65f0488b66600f985553cf2", + "README.md": "sha256:23179d6a1760e442fa025ac73aed050ee0141e985e87979c0a05781fdc2ca350", + "SCOPE.md": "sha256:5a2b96f8a3aa7218ad43dbd72abc89319a44c329298e973589f49c4ec354b0c6" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "info-tech-canon": { + "head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:aa739b333929bc5d36a0654ef5afea1b9dedabad38da0c335f3d8b0f17a38bad", + "README.md": "sha256:55f21ebac58356dabdd032d4396a6eb0e3af4c5d13c900667fb79827879b58b1", + "SCOPE.md": "sha256:342ee894c1d6d64da76ff521eeb3c21279c55c6e7b7f0892b34f54c2d89e91b3" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.infotech.canon-service", + "name": "InfoTechCanon Service Surface", + "summary": "Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon information-processing infospace, backed by infospace-bench.", + "vector": "D2 / A2 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "tags": [ + "canon", + "infospace", + "service" + ], + "consumption_modes": [ + "cli", + "library import", + "http api (read-only, local)" + ] + } + ] + } + }, + "informed-decision": { + "head": "ee6a65b80a0fea1a914dfa31434b903669656c09", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md" + ], + "source_sha256": { + "INTENT.md": "sha256:b543c2d80b97182393e2d080ae8fd3759f2e956a89306c2c568c0010e7425eeb", + "README.md": "sha256:7d2bcb581348c4cae55b59550eb7a9ef34abaa928375acae28ec41878c5abb7b", + "SCOPE.md": "sha256:ab352aa1a88ca53106517b14eafc62a3cb6504519638835227e6f852b3cdf68b" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "issue-core": { + "head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:fb6e1f77fed6b5ae110fdcfb92dd96263050c1907702a1f380895930a8ad0dd9", + "README.md": "sha256:00281e7af8fc9c8f9c41a46a71a959faea4c6db1c08c6c4b5b3fe3a5808b271a", + "SCOPE.md": "sha256:c43d8c15cf0b85dd8558bc0031a0662d668de9c0394eb2045a7735d044d7ed0e" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-07", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.infotech.issue-tracking", + "name": "Universal Issue Tracking Coordination", + "summary": "Unified Python/CLI interface for issue tracking across Forgejo, GitHub, and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "tags": [ + "issue-tracking", + "coordination", + "multi-platform" + ], + "consumption_modes": [ + "cli", + "library import" + ] + } + ] + } + }, + "key-cape": { + "head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md", + " M src/internal/server/oidc/authorize.go", + " M workplans/KEY-WP-0039-openbao-negative-probe-tokens.md" + ], + "source_sha256": { + "INTENT.md": "sha256:b22cb440691bb399b064ee10ab1a03e1e07838da1051bf6235fbfe2cf820eb10", + "README.md": "sha256:953586cca96d01e9240448186b922c9b8ea03827a7f314731e9a9ead4f19d0d3", + "SCOPE.md": "sha256:20fbadf3e33339bca4b541cdfa33a0de00095c968d51006dc4d0a46735cc834f" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.iam.key-cape", + "name": "KeyCape Lightweight IAM (NetKingdom Profile)", + "summary": "Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against implementation internals.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "path": "registry/capabilities/capability.iam.key-cape.md", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security" + ], + "consumption_modes": [ + "service (self-hosted deployment)" + ] + } + ] + } + }, + "kings-guard": { + "head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:923fd2ce1a22c29d486f562071a0a251c16b64fbb5d73490cac4d373daa0c83d", + "README.md": "sha256:57983baf2275d9afbd5109782cfe1f3559145f4ee906ea97345c6d517a5e4fc7", + "SCOPE.md": "sha256:8e77e587c67aa419df35d4f642468bb57bc30df65e1ea6a922fdca282ea9ed63", + "docs/SecretUseSnapshotAdmission.md": "sha256:7fd32df4c8203d83aa14334ccaed0700682730679539a5c657d93f5efbf5d31c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "maturity-engine": { + "head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:d17b9169ad82b60450244988dafa3ab4a515790ee08903a7fcee9df5fd8eae0c", + "README.md": "sha256:66333483d63f45c2dd744661610d062440569955bb150927ebd9d21d72b85daa", + "SCOPE.md": "sha256:653f47b0d370dfdb45c723b361f6fee53be7e384732c201443d7238c04d155bc", + "docs/claim-contract.md": "sha256:082490f3651db8f771dfd72c42f5c5df4c3317361c9dec1ec0f0dc9814f80a2a" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "net-kingdom": { + "head": "1a36e857cc5aae6fe738f794417126c46dd94627", + "branch": "main", + "dirty_paths": [ + "M WORK-RECORDS.md", + "?? intakes/NET-IN-0005-single-use-setup-link-mail-handoff.md" + ], + "source_sha256": { + "INTENT.md": "sha256:fd2ba8dff9dfd5583ec6d8b0348f273bfe00c59923b5d5d47cd22b1fb4658c54", + "README.md": "sha256:25172bafe09fd3a26467d44a74ca90e8f123bc81bfa2784a483837c0e9efe9fe", + "SCOPE.md": "sha256:0f896db98d03aa7460d88999b738ea00be87dd34fe0b250f11bf0b6f170b0172", + "SECURITY-COMPANION.md": "sha256:06374445ca888549f1bf79527d1345d94918d7a7ec363160d8427d0e7a31d643", + "canon/standards/security-case-types_v0.1.md": "sha256:a4fda906d5138d2594a1f8d047c7c28e1cdf96b1eae051f543b9a5e5852bcb5e", + "tools/custody-record/README.md": "sha256:ec653a17b4f35e56d37824c1db15f1ea6b1761c564863fca4ea168a3ed625000", + "tools/emission-cadence-profile/README.md": "sha256:a4adadb43b0d55f7d705d89166ef63ce01aceeff742b260039263dda92ce85b8", + "tools/posture-feedback/README.md": "sha256:83b8de1da01de77318e950c9266e5f2755091dbd0e5a318d75bc5cc8f556ef18", + "tools/posture-feedback/posture_feedback.py": "sha256:629779308e4965be3aabbb76f105fd9c8b532c64987915d2ccab5b543273bfe4", + "tools/security-bootstrap-console/README.md": "sha256:bc1af3598d667346370a476d0765bff1f0c3ebb57f751c4da6e61a4add29f30d", + "tools/security-case-types/README.md": "sha256:03e1c503bc60990214d5b1a7cec8878cf47fc892d82c82d682f3490e33dc71f5", + "tools/security-scenario-composer/README.md": "sha256:447554e04816c0bc815f57d9138430d354790c9f3813e48bbd38fee034f98015", + "tools/security-scenario-composer/security_scenario_composer.py": "sha256:9f0cc69930aa8ee2cc3fb92236e6a99728df17b8c0fe36e1250241c38fc01c4f" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-08-23", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom Security/IAM Tooling Suite", + "summary": "Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.", + "vector": "D3 / A2 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance" + ], + "consumption_modes": [ + "cli", + "local web ui" + ] + } + ] + } + }, + "ops-bridge": { + "head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:2134f693649803414d7ab2f9839416f1fe06169aa86732e64c9dd962c35f412b", + "SCOPE.md": "sha256:63cd52d1cdf38e72af0285c25aa2292f959080c6befe565a1d2690747a813975" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH Reverse Tunnel Lifecycle Manager (ops-bridge)", + "summary": "CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.", + "vector": "D3 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity" + ], + "consumption_modes": [ + "cli" + ] + } + ] + } + }, + "ops-mason": { + "head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:482269782f4fd337f83674b4e2c36a5cd9f8eb694918e55709e9a7e78a003c71", + "README.md": "sha256:9e0c9b5c76c3a2d4aeeaf032579e96d8da9056662ac4655b8885b16ed7f3bca5", + "SCOPE.md": "sha256:7da4c8c660b1c8d15675768a5f6040303fe3ca3b4f05b1bba4633be3cc6e0c77", + "docs/construction-plan-format.md": "sha256:468678089885193b8fefe3993cd6878bbdbeaaa64aa088b18b90047b696ce564" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "ops-warden": { + "head": "6d2f1be9691b19e826898a2166ae4451e4802ae2", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:3e9382fefa52ee0970dfac133cc799656e5034760b26dccc1bf9bab65fc538d9", + "README.md": "sha256:1f11071d7fd651806da180272cc4aa4e3ae19d7bad0e321aa97c7dcaea7f2857", + "SCOPE.md": "sha256:47b47468746617c84f8411ac671bb488ab740b4c3133401f5d7b55d3d024345f", + "wiki/CredentialRouting.md": "sha256:544530cc13052e33d2135fa3b0583e620010abb0af86079be6d8e09c36844646", + "workplans/WARDEN-WP-0044-security-case-follow-through.md": "sha256:c0029545bd2d8c015ae0cac87f6d53a2e5ee935b7bf5d5e1b81bf1ff5dbdc4f8" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-17", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.security.ssh-certificate-issuance", + "name": "SSH Certificate Issuance", + "summary": "Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward NetKingdom operational access routing.", + "vector": "D4 / A3 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security" + ], + "consumption_modes": [ + "CLI", + "cert_command subprocess" + ] + } + ] + } + }, + "policy-nexus": { + "head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:58b95e4e158da6b978b9bd3a2ecbaf7f279553098906a8e8ed404afd3d582494", + "README.md": "sha256:cc3a825974a8cea0c737a16cc8b06d3fec56e10f593c6ed7169bc54786df5a81", + "docs/publication-contract.md": "sha256:65a9a233201ba966db0f2c5465ff3b0684147af3075f43180b8eefb3e059abb4" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rail-kubernetes": { + "head": "35159e49c1340b7a0e30c49188975c8839d346f6", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:72a64030f25f0474e4f3837860d3eba60e3d5a1c2b31e8f6d062e15da8f209c4", + "README.md": "sha256:89c6c0155f3d9829c7d0ff33f27883ed2fdd8f6d857eae013656136467296cd2", + "SCOPE.md": "sha256:00fce3ee7cb4bbbd7eff210adb2a03c533f2b43870f7327cfc35f28354bb549a" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "railiance-apps": { + "head": "706461b845086ee2df8ce9acae3dae7feebfffda", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:31060dc1738aa4540f78735019359a276ece39dad8afbf1be740713bebbe65e5", + "SCOPE.md": "sha256:8243098d979d4258c9e7f9e39b5de24ce78b521cd82a7e199028df30bc130b14" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Railiance Application Workload Deployment Tooling", + "summary": "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack \u2014 application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.", + "vector": "D3 / A2 / C1 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment" + ], + "consumption_modes": [ + "cli (shell scripts)", + "helm/kubernetes deployment" + ] + } + ] + } + }, + "railiance-bootstrap": { + "head": "ae00b2652737aaf18358431e66f59eeb7c01e16b", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:c1840c7df1cb87d72a22a7b1bc95417687a0a9d9355b6ffb50392d8bf6ae241f", + "README.md": "sha256:3acd2adcf4bf3c3801be99c95d96da8ac7638f5a21c03d6f987505402a00afa6", + "SCOPE.md": "sha256:4efdd7f7817e39c01d6024e2f8bcbd70c2b10b90baf9f92855bb3967cd629831" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [] + } + }, + "railiance-cluster": { + "head": "12d1e881ff2086566712fbc591db293b38ea2bcf", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:a00fe12563c77734e19b538ca8307d44fcfae9f040bec284c705146f99bb3490", + "README.md": "sha256:5c82b7c31adb126e1f95ccd5057156888fff73a05828abd5e8ab3e013c7fe59f", + "SCOPE.md": "sha256:e4f6a8dd3d72a1f04f0d94721d57ca2a4c7e98790a8373876a5005b87ec5d8a6" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Railiance Cluster Runtime Bootstrap", + "summary": "Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap" + ], + "consumption_modes": [ + "cli", + "ansible playbook" + ] + } + ] + } + }, + "railiance-enablement": { + "head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:5a562d3f019156969948315e8072ce925c81e21d027a47096e21c8535473a588", + "SCOPE.md": "sha256:2a554aef6d6803f1a176ea3bdb3bcc0f077f03d131b0a897a5ec56bd6df85f88" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.ci-enablement", + "name": "Railiance Developer Enablement And CI/CD Templates", + "summary": "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime.", + "vector": "D3 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo" + ], + "consumption_modes": [ + "ci workflow template (copy/reference)", + "cli (promote-repo-to-forgejo.sh)" + ] + } + ] + } + }, + "railiance-fabric": { + "head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:1cdca96e57849709aef333c88ace903f9573eeb2894f52246e473928c7e3846c", + "README.md": "sha256:8705fec071bfe75d3bdfcc5677ac8801f5d66b5ee3a49043cc8d019443a1fb8c", + "SCOPE.md": "sha256:b80d4a8b39c2920818ba4069318f888e56736a0f0e8d40f3a72568b0472fb36d" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.fabric-graph", + "name": "Railiance Fabric Ecosystem Graph", + "summary": "Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery" + ], + "consumption_modes": [ + "library import", + "cli (validation)" + ] + } + ] + } + }, + "railiance-forge": { + "head": "a15fac8e938c11b041eb39386f05b63d46ae566a", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:310d6ad12a1f621c05396a3d6aab19ff8a6bacc4f67814e64d07f09da124ea54", + "README.md": "sha256:e10a07e1b8935a444699ee456f6d3f98e02109d7e453db41823a31261d181b2a", + "SCOPE.md": "sha256:dc4c179e33898e32fae7b2e8e30e88a66d9efc3ad2f488651ccedf600274c1b8", + "workplans/FORGE-WP-0006-independent-secret-detection.md": "sha256:fbcf3f75e884f6c90554c05525d787f61cfc2b915a206e6010bed447e7a720eb" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.forge-infrastructure", + "name": "Railiance Forge And Artifact Infrastructure", + "summary": "Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner" + ], + "consumption_modes": [ + "cli (operator tooling)", + "documentation/runbooks" + ] + } + ] + } + }, + "railiance-infra": { + "head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:00d05aeeedd6e11527fdacd35070a37c0b67ff16914ed6ce0f634baaded5f1ae", + "README.md": "sha256:dcea6117a34fa466e75c7943fb43dcfc42eb8f6f6c9c5207458eb7621e694ced", + "SCOPE.md": "sha256:18cdf933d658eeddcb68528bb9c222ceb0866d8c5f0ec4bb3ea955de762c3c33" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.infra-provisioning", + "name": "RailianceHosts Infrastructure Provisioning", + "summary": "Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth.", + "vector": "D4 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure" + ], + "consumption_modes": [ + "cli (terraform/ansible)", + "gitops" + ] + } + ] + } + }, + "railiance-master": { + "head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:dacbc59b7d42412e3e65d3d16ce058d0bde486e16435112c7abf83b696572eda", + "README.md": "sha256:4a706ec49c177ef13343ea3e56e61bf5a7bd6c601562b301a87189690ee800ff", + "SCOPE.md": "sha256:63ebaef0397795257650521e6f3be6b46cca1142f53b1865d9df9ed0c0530fc8", + "docs/netkingdom-security-consumption-contract.md": "sha256:be50d016b7cd14ac27127a2c641c4a9a0c8d1605495ba62ba5cf30ef0f65bab7" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "railiance-platform": { + "head": "d303c99e3be993ffa989bc9ba3d7b471903858ce", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:12c6540735af591f7a4a9fe85ff10d3cd00eec55b5b6b1ddf148abf2d3ac9a9c", + "SCOPE.md": "sha256:bb18dc91f3be50337d7ebc81d269f1234f65919f7014eef990b09c3df54a5347", + "docs/openbao.md": "sha256:9c92b0e30c81351b258da44df46720f4cdd2941488a7ca2f8687b8937da8099b" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.railiance.platform-services", + "name": "Railiance Platform Services", + "summary": "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres" + ], + "consumption_modes": [ + "cli (shell/python scripts)" + ] + } + ] + } + }, + "railiance-telemetry": { + "head": "81d905971c38de9aaf11088ba605e112152d8268", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:de793b403514f8c7984ba7c20608ecca9d1fea422d3fcc20ec186a0d7c2f2f47", + "README.md": "sha256:4fdb18006ab2e5a0c4d72127324a88c7abacb55a30b80de6a95e55ce46c56468", + "SCOPE.md": "sha256:206279dabc14fe1a44ba6df8ad2b664cc91d3460379b732951d3e29bb6a814da" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-openbao": { + "head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:28b74eec385f6cef4f8c846992f10b6067ce436cb9d52de19338dd57c111f90e", + "README.md": "sha256:9964de809b5b645c24871774621747f9d6ce2f069443d507b9ef9616ee255d85", + "SCOPE.md": "sha256:cdcf80122c8c55dfe697312d6cd67b76861f322cae9816b85123aefe2345c674", + "docs/retained-s3-handoff.md": "sha256:d1b2f27f740176ab16f6b4b589b0c25dab41c923d6f377d84059ec8369c0a3b6" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-playwright": { + "head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:b719684974f35812708e562cd8c0b4573662ae22fd12f4252bd4abaca627882b", + "README.md": "sha256:e64daa81de97b3d2c6afe4028f9a2d4aca6e9892ac36a798316a8d8e8fa80ce8", + "SCOPE.md": "sha256:c1489a7b75a87a3a8b00edb9b9497d256b0e5ec72d5fe5236cc038745215dc91" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-policy-nexus": { + "head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:a3ae592c56822697ad24bd64851578b5b17f1a9bd8622a247e3e425a5de594c7", + "README.md": "sha256:41c1bfeaa90d11f4778d22a3e58a97cb9653d153712657ff2e3aecc45dda240f", + "SCOPE.md": "sha256:dfb85b48d6ff68a9945178a5fc1b85f1d342f765d046a58285e7edc52f517438" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-postgres": { + "head": "03744030c9258e920f6403a9ce184a26d7b75268", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:2a9ce4f5eb8fbbffbaeb8532a677c855b97973a6028536520018ccd1796a4735", + "README.md": "sha256:298079470d931ab78d79a0a44274f207606d6a877740d79a8925d9c37f8ff15a", + "SCOPE.md": "sha256:5919caed210fc8c6977845b3469ebe419b0216f6aafa69e01a40b9d12d6050bc" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-telemetry": { + "head": "17053dbc47f7c22efd67fd90d06d108d154835fa", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:fc3ac98e40f67384f3ff94ecf223d89f0713c031ba5ca6093320278b269e4276", + "README.md": "sha256:fd797950ffaa67123773da7cdfa6e45984f367f820caba7c10e0fd300f96d630", + "SCOPE.md": "sha256:3776b5924bd90f8114e77f7bbbcacc7f3713cd56ca26440a3e4bce792ce8b142" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-tenant-engine": { + "head": "c160be23577ab4d99ee2cd008deb455b07f0597d", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:5eb0a651c1fd20a7d60a3a30060431925d2fb3ed64cf6ae22293dcc5546c7251", + "README.md": "sha256:05596b39a47fa22cc4e966714c4c755220894ca54c7759cdd3088e78b31c00e6", + "SCOPE.md": "sha256:fc0c5a80f37c410c10eb29a7541ca37088668e5f76d64ece4e889c7f0145a13d" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-user-engine": { + "head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:891150bf022c2456d62c234db10172a16cb2e1a9c9aa5284aafd5d89755a82fb", + "README.md": "sha256:f1d89f8f1c1cc67f2b79bd2bd3dd94b9a895fcaf308c44b5d8d23fc7b9f1bb7a", + "SCOPE.md": "sha256:732fd68b194d034e81faf170d5a69e1d61cfab5385457b93a5f5689a63a2f184" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "reef-railiance": { + "head": "ffb9e272ce1489cc37cc6388873558d8ba56c239", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:deb16216816dfcc1c42c2d826b6fcd496d9c0e6789169c0312e0bc9d0fa88781", + "README.md": "sha256:31480d89ba5a8f868c28c2b09f62a51d662aad6a0ec93a56340fed39a789c395", + "SCOPE.md": "sha256:a273078d5dc7ceb72bbdf5473b5146cd624411b08bdc6b1e7d78113c4e675cc8" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rein-aharness": { + "head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md" + ], + "source_sha256": { + "INTENT.md": "sha256:f9a35aa6f9c4803a1d978aeb487ba475830505670871c564a5fecacb77b11ec4", + "README.md": "sha256:da0f62f0eda7bac0018151b73ffa2bcf9cab9dbd796adb285c738c435853afc3", + "SCOPE.md": "sha256:d9979b35ec0909f76e6c34a0f40de2e5cbc700d1bb5c7b5f73c6e2b20e3cbc48" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rein-openweights": { + "head": "e1fccb39b738a5381a9de6e1d799f124797798ce", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:e1284da2b06a44d93e050638d34ab8abf15173bed77f82788ddcc32939359cd6", + "README.md": "sha256:0eb6e6225727770985c4b6442acdb17e8a0d5e707c25aaeb561e47b921f6aa74", + "SCOPE.md": "sha256:f7791a1f858cd7225e217b9b53213066e44ddd7ac4a1e748383a2c8756d3aa3c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "repo-manager": { + "head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:62afa83ecb1fd733abce07489d48d0d7c7e14ccf9def9f561c118cf8ec5409b2", + "README.md": "sha256:9330836f65bde7466f7a1414f4a6df28682acde710aca0ea3e45be429622c75c", + "SCOPE.md": "sha256:bca5806e11f04e4550ce5c147d4d98e6c0014fed1f17fa3f134e5b193adec43c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "resource-control": { + "head": "3604d468f86ede7d320f4d22dd4aea775306b53f", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:f81326a4f18e284d8f7ca73f71dbe9502b7a75b1d567074e9bec48ebdd968309", + "SCOPE.md": "sha256:2daf0899d730bb6da30bd471f364061b86428cb5e38573df9d5551aff9dd5e29" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "reuse-surface": { + "head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:511d1029a7aefc67b68a6363ed3ce8f803f2516c00062ff805263dffe26c771b", + "README.md": "sha256:6e4dc8d382612320cc2c8558ad583b0564ff594a7032b33137cb7a61887621cc", + "SCOPE.md": "sha256:2c30972ceb2a643147ce61c04c6919b16797b6754c2a407df998c81ce76c9c30", + "docs/RegistryFederation.md": "sha256:bfc80be5eac1250189ac2ba726a6188c03928ccf1e9992ec58cf59e58009f289", + "schemas/capability.schema.yaml": "sha256:3b0172baa4e6d54f400e911af6adb0d86b4576b86d7aea6d8f18c3fce3b8ae3f", + "specs/CapabilityMaturityStandard.md": "sha256:3eb3c7e1dd51b85e993c9936b2a176f6b3998e6198666695bdbb5b7ba7d8b17c" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-10-13", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ] + }, + { + "id": "capability.registry.register", + "name": "Capability Registration", + "summary": "Register a new capability so it becomes visible for planning and implementation reuse.", + "vector": "D3 / A4 / C2 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.register.md", + "tags": [ + "registry", + "governance", + "meta" + ], + "consumption_modes": [ + "informational", + "markdown authoring", + "cli", + "service API" + ] + }, + { + "id": "capability.registry.validate", + "name": "Registry Entry Validation", + "summary": "Validate capability registry entries against schema, index consistency, and relation integrity.", + "vector": "D4 / A3 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.validate.md", + "tags": [ + "registry", + "validation", + "cli" + ], + "consumption_modes": [ + "cli" + ] + } + ] + } + }, + "risk-nexus": { + "head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:38783193bce6e05a502463a0965341fe7940cc98d72c800c7d70a36e9defae83", + "README.md": "sha256:05dd751b2569801f5bc0971b3ebeeb263b3488a880cb334c3b4f076ed15d6ceb", + "SCOPE.md": "sha256:82e5f7476f5ebe327bc720691f858f3dbac3990da6860ac8114f83c3b287394c" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "role-engine": { + "head": "d231241dbfeeb541b34243f4022883aa6417a1eb", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:06678fc42521c91514ef9684674479c70ae47ee829e7a1e5e6c5d7ae54c0d7a2", + "README.md": "sha256:a98b021f59566bce52d02b7f7e2c9f2d3f637f9357037c54d752c69a13cb15bf" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "runbook-tutorials": { + "head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:6a96bddd785357c6084d3137c66c188b9266f9e69cd1ad6e2c2562106a296b63", + "README.md": "sha256:747bd15db6182f5f473a4a774ade282d14341f63ee427c0cd862cbd3a6c0a6d0", + "SCOPE.md": "sha256:5da9ba54026809314e6c0d97894642ca705793cb752c8a9cb535551cef9aee5c", + "docs/pack-spec.md": "sha256:075a67476ba9226e79bc955caa039c9c1bad6ead96a7e61fb8e68b8ea56d2a0d" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-09-29", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.infotech.runbook-tutorials", + "name": "Runbook-tutorial engine", + "summary": "Engine, local UI and CLI for guided, parameterized operator runbooks; packs live in the repos that own the procedure.", + "domain": "infotech", + "status": "active", + "owner": "runbook-tutorials", + "path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "tags": [ + "runbook", + "tutorial", + "operator", + "guided" + ], + "consumption_modes": [ + "git clone", + "cli" + ] + } + ] + } + }, + "sand-boxer": { + "head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md" + ], + "source_sha256": { + "INTENT.md": "sha256:a87d81568311ae5bee941183f10eb23fbe60541dc41d2c5a7fbfbac52a89dd37", + "README.md": "sha256:d5038e80f041429f8f8f8e2fc9b2b45a223a5478731ab7c75592378a174e0d2a", + "SCOPE.md": "sha256:68f4623825cc54ebbbe777b0abd78a358cb3232bf2f6577980c6fc945a80ed7a" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-22", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.execution.sandbox-provision", + "name": "Sandbox Provisioning", + "summary": "Isolated execution environments for agentic development, e2e testing, and bounded automations \u2014 profile-based provision, TTL teardown, and State Hub lifecycle registration.", + "vector": "D4 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "sand-boxer", + "path": "registry/capabilities/execution.sandbox-provision.md", + "tags": [ + "sandbox", + "isolation", + "provision", + "e2e", + "agentic", + "execution", + "profile" + ], + "consumption_modes": [ + "CLI", + "core library" + ] + } + ] + } + }, + "sbom-nexus": { + "head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:0e3eed8bc510109f615d0739502cf15c2aa5a025e74db01a6cedfb316f2d9e58", + "README.md": "sha256:8cc888ebf6370cabb1cfe1539b11e372e3f432dda2aa303c8470a5fc32f70844", + "SCOPE.md": "sha256:32f6e853b366c5097b3ab1a3d05413a0091ec48585de4def7adcbacd57da02ba" + }, + "missing_review_artifacts": [], + "existing_index": { + "schema": "reuse-surface.capability-index.v1", + "repo": "sbom-nexus", + "capabilities": [ + { + "id": "capability.infotech.sbom-management", + "path": "registry/capabilities/capability.infotech.sbom-management.md", + "status": "emerging" + } + ] + } + }, + "secrets-engine": { + "head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d", + "branch": "main", + "dirty_paths": [ + "M .custodian-brief.md", + " M WORK-RECORDS.md" + ], + "source_sha256": { + "INTENT.md": "sha256:188dc6d99ca9a441e7389a3715ba48275ab6e8745deaff686bd27d2aac34d678", + "README.md": "sha256:6c85cc0e1f57fcc06ef00368d0b7ea1a02657a8a1358bebc38be446be20deeed", + "SCOPE.md": "sha256:d77af9b9bab0383928120b80ed4a70f471cf244e22718ee6feb6039a70aedf6f", + "src/secrets_engine/decision_check.py": "sha256:a8c9a45320b752871bf6b8238cc25074e8f08ed29fee131e99030606fc091e6e" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-24", + "domain": "infotech", + "capabilities": [ + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ] + } + ] + } + }, + "security-canon": { + "head": "1664a6def20be2759a1e575024563efd27c9f36f", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:d2e8ebdbc9500b613162c45145f50fd88471beeca3e96ebe6c2df5d85d07539c", + "README.md": "sha256:0ab66ab06438b14b86cc67ad0084ef88126618a283a37baed663176709ef1236", + "SCOPE.md": "sha256:74ebe3d738fa554be113866e82cd2b049c49b4c7a302c61f21ffadf31c297ce8", + "infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md": "sha256:f79a6dfe1067028810677426cb7e8c5be16735074121437f3cc97849d08fb72b" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "state-hub": { + "head": "8ca9201f6a1445c66fe1d1b0ba0c8d044c131647", + "branch": "main", + "dirty_paths": [ + "M api/main.py", + " M api/models/__init__.py", + " M api/models/agent_message.py", + " M api/routers/messages.py", + " M docs/inbox-change-feed-contract.md", + " M workplans/STATE-WP-0094-routed-gates-and-owner-returns.md", + "?? api/routers/message_feed.py", + "?? api/schemas/inbox_feed.py", + "?? docs/evidence/legacy-meter-weekly-review-20261014.json", + "?? migrations/versions/c4d5e6f7a8b9_inbox_feed_revision.py", + "?? tests/test_message_feed.py" + ], + "source_sha256": { + "INTENT.md": "sha256:4888ffa0a126a26bef3ba94658c76c3a23dbdc1399f4686c94e325b9d934e85f", + "README.md": "sha256:af3dde630cbc54664aab3681190e3095f04facd4e9b3fbc9cac7c279df05fc2d", + "SCOPE.md": "sha256:cfdd20b8718d92db1413c9bfcccdb1ae1e7fdee638aadcedf6508cee9f7c713f" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-06-16", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.statehub.progress-log", + "name": "Work Progress Logging", + "summary": "Record progress events, decisions, and session notes against workstreams and tasks in State Hub.", + "vector": "D4 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "tags": [ + "state-hub", + "progress", + "coordination" + ], + "consumption_modes": [ + "service API" + ] + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Workstream And Task Coordination", + "summary": "Track active workstreams, tasks, progress, and consistency across domain repositories.", + "vector": "D4 / A4 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "tags": [ + "state-hub", + "coordination", + "workplans" + ], + "consumption_modes": [ + "service API", + "HTTP REST" + ] + } + ] + } + }, + "tenant-engine": { + "head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:c2deaef01f7492ca1b39f52e36bf703f6a55b04158b2888b7befae73452ce285", + "README.md": "sha256:4beddb32ea5dae1f67e0b489b63f13f7ba9bbc4d3c7f27b80957a199bcf144e0", + "SCOPE.md": "sha256:63f86c1bc39110db862fe60e273703463415e6e0365e4c058ab6c65be399d62e" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-23", + "domain": "infotech", + "capabilities": [] + } + }, + "the-custodian": { + "head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e", + "branch": "main", + "dirty_paths": [ + "M WORK-RECORDS.md", + "?? docs/assessments/netkingdom-2026-10-14/", + "?? workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md" + ], + "source_sha256": { + "INTENT.md": "sha256:6ccb4f1f2c8a87f27d59dcfcafaa654d68ff90ba09b94c863d5d444b2a35052c", + "README.md": "sha256:238b643e0c94446cf04bc8ac5d69e4c57d0f681825b5c45b9d444e6198f83f1a", + "SCOPE.md": "sha256:6d64208332890f24f04ae8d6f9067bcd8ed3b541e245fb2649ea3435f401b459", + "runtime/README.md": "sha256:c9bcfe727705b1503447d863f6fed4a84e97eb18a84b335c9073dac6dbb756e4" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Custodian Runtime And Repo-Classification Tooling", + "summary": "Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos.", + "vector": "D2 / A1 / C1 / R0", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "tags": [ + "agents", + "runtime", + "classification" + ], + "consumption_modes": [ + "library import (runtime/)", + "cli (tools/ scripts)" + ] + } + ] + } + }, + "user-engine": { + "head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79", + "branch": "main", + "dirty_paths": [ + "M workplans/USER-WP-0035-onboarding-handoff-findings.md", + "?? .claude/settings.local.json.", + "?? docs/evidence/2026-10-11-setup-link-owner-handoff/" + ], + "source_sha256": { + "INTENT.md": "sha256:8aa0f276e0879d3545338727188a1fd5af973c43acbfa986a135b20979ec7ba4", + "README.md": "sha256:74f788850117b3a1d6a1e06f68a26cbf699f8da9a27ed58d68d552a6e40dec3d", + "SCOPE.md": "sha256:0e863e1cc93e2aac373f566db4a4445348a930029a1c0968cf8e30c456b003e8" + }, + "missing_review_artifacts": [], + "existing_index": { + "version": 1, + "updated": "2026-07-06", + "domain": "helix_forge", + "capabilities": [ + { + "id": "capability.identity.user-engine", + "name": "Headless Multi-Tenant User Engine", + "summary": "Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.", + "vector": "D4 / A1 / C2 / R0", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "path": "registry/capabilities/capability.identity.user-engine.md", + "tags": [ + "identity", + "user-management", + "multi-tenant" + ], + "consumption_modes": [ + "library import" + ] + } + ] + } + }, + "whitehat-security": { + "head": "5587a8f6ac4b129527db819bc72832051c7fcc3b", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:acef2293815fb9bded28a60ee1bc47c196bb38541a28265d895d69ae773731ba", + "README.md": "sha256:3ddf3898b71ffaffec497e4e821f2a048d3cec1ae4269872b203db3422e14aca", + "SCOPE.md": "sha256:394dc1d432d4dd3eec735289ef83a8beedeb3afce667f5a8c3a052902a1e26ba" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "zone-engine": { + "head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:7684ce5960c2623fe4a295e17f777326daad88d6d7c274002a71cf6046537c51", + "README.md": "sha256:194caa3a00b9ff041511a7e7a7c550f8e2b2906d1e71f2a9b05aef3220039806", + "SCOPE.md": "sha256:953dbf718481adae00fa53258ede0632df65bdc7f6a1cb3e1dd3344357dba80d" + }, + "missing_review_artifacts": [], + "existing_index": {} + } + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/local-default-federated.yaml b/docs/assessments/netkingdom-2026-10-14/local-default-federated.yaml new file mode 100644 index 00000000..520c63ab --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/local-default-federated.yaml @@ -0,0 +1,2516 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +collision_policy: warn +sources: +- repo: access-engine + count: 1 + index: ../access-engine/registry/indexes/capabilities.yaml +- repo: activity-core + count: 1 + index: ../activity-core/registry/indexes/capabilities.yaml +- repo: agentic-resources + count: 1 + index: ../agentic-resources/registry/indexes/capabilities.yaml +- repo: approval-engine + count: 1 + index: ../approval-engine/registry/indexes/capabilities.yaml +- repo: artifact-store + count: 1 + url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/artifact-store.yaml +- repo: audit-core + count: 1 + index: ../audit-core/registry/indexes/capabilities.yaml +- repo: can-you-assist + count: 1 + url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/can-you-assist.yaml +- repo: citation-engine + count: 1 + url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/citation-engine.yaml +- repo: citation-evidence + count: 1 + url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/citation-evidence.yaml +- repo: citation-work + count: 0 + url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/citation-work.yaml +- repo: commerce-canon + count: 2 + url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml +- repo: config-atlas + count: 1 + url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/config-atlas.yaml +- repo: coordination-engine + count: 1 + index: ../coordination-engine/registry/indexes/capabilities.yaml +- repo: core-hub + count: 1 + url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/core-hub.yaml +- repo: domain-tree + count: 0 + url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/domain-tree.yaml +- repo: email-connect + count: 1 + url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/email-connect.yaml +- repo: emergent-security + count: 1 + index: ../emergent-security/registry/indexes/capabilities.yaml +- repo: evidence-anchor + count: 0 + url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/evidence-anchor.yaml +- repo: evidence-binder + count: 2 + url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml +- repo: evidence-source + count: 1 + url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/evidence-source.yaml +- repo: feature-control + count: 3 + url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml +- repo: fin-hub + count: 1 + index: ../fin-hub/registry/indexes/capabilities.yaml +- repo: gate-house + count: 1 + index: ../gate-house/registry/indexes/capabilities.yaml +- repo: glas-harness + count: 1 + index: ../glas-harness/registry/indexes/capabilities.yaml +- repo: guide-board + count: 1 + url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/guide-board.yaml +- repo: helix-forge + count: 0 + url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/helix-forge.yaml +- repo: hub-core + count: 1 + url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/hub-core.yaml +- repo: human-resources + count: 1 + url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/human-resources.yaml +- repo: ihp-railiance-probe + count: 0 + url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/ihp-railiance-probe.yaml +- repo: info-tech-canon + count: 1 + index: ../info-tech-canon/registry/indexes/capabilities.yaml +- repo: informed-decision + count: 1 + index: ../informed-decision/registry/indexes/capabilities.yaml +- repo: infospace-bench + count: 1 + url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/infospace-bench.yaml +- repo: issue-core + count: 1 + index: ../issue-core/registry/indexes/capabilities.yaml +- repo: kaizen-agentic + count: 1 + url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/kaizen-agentic.yaml +- repo: key-cape + count: 1 + index: ../key-cape/registry/indexes/capabilities.yaml +- repo: kings-guard + count: 1 + index: ../kings-guard/registry/indexes/capabilities.yaml +- repo: kontextual-engine + count: 1 + url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/kontextual-engine.yaml +- repo: llm-connect + count: 1 + url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/llm-connect.yaml +- repo: markitect-filter + count: 1 + url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/markitect-filter.yaml +- repo: markitect-main + count: 1 + url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/markitect-main.yaml +- repo: markitect-quarkdown + count: 1 + url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/markitect-quarkdown.yaml +- repo: markitect-tool + count: 1 + url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/markitect-tool.yaml +- repo: maturity-engine + count: 1 + index: ../maturity-engine/registry/indexes/capabilities.yaml +- repo: net-kingdom + count: 6 + index: ../net-kingdom/registry/indexes/capabilities.yaml +- repo: open-cmis-tck + count: 1 + url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/open-cmis-tck.yaml +- repo: open-reuse + count: 1 + url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/open-reuse.yaml +- repo: ops-bridge + count: 1 + index: ../ops-bridge/registry/indexes/capabilities.yaml +- repo: ops-hub + count: 1 + url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/ops-hub.yaml +- repo: ops-mason + count: 1 + index: ../ops-mason/registry/indexes/capabilities.yaml +- repo: ops-warden + count: 3 + index: ../ops-warden/registry/indexes/capabilities.yaml +- repo: phase-memory + count: 1 + url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/phase-memory.yaml +- repo: policy-nexus + count: 1 + index: ../policy-nexus/registry/indexes/capabilities.yaml +- repo: rail-knative + count: 1 + index: ../rail-knative/registry/indexes/capabilities.yaml +- repo: rail-kubernetes + count: 1 + index: ../rail-kubernetes/registry/indexes/capabilities.yaml +- repo: railiance-apps + count: 1 + index: ../railiance-apps/registry/indexes/capabilities.yaml +- repo: railiance-bootstrap + count: 1 + index: ../railiance-bootstrap/registry/indexes/capabilities.yaml +- repo: railiance-cluster + count: 1 + index: ../railiance-cluster/registry/indexes/capabilities.yaml +- repo: railiance-enablement + count: 1 + index: ../railiance-enablement/registry/indexes/capabilities.yaml +- repo: railiance-fabric + count: 1 + index: ../railiance-fabric/registry/indexes/capabilities.yaml +- repo: railiance-forge + count: 2 + index: ../railiance-forge/registry/indexes/capabilities.yaml +- repo: railiance-infra + count: 1 + index: ../railiance-infra/registry/indexes/capabilities.yaml +- repo: railiance-master + count: 1 + index: ../railiance-master/registry/indexes/capabilities.yaml +- repo: railiance-platform + count: 1 + index: ../railiance-platform/registry/indexes/capabilities.yaml +- repo: railiance-telemetry + count: 1 + index: ../railiance-telemetry/registry/indexes/capabilities.yaml +- repo: rapp-openbao + count: 1 + index: ../rapp-openbao/registry/indexes/capabilities.yaml +- repo: rapp-playwright + count: 1 + index: ../rapp-playwright/registry/indexes/capabilities.yaml +- repo: rapp-policy-nexus + count: 1 + index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml +- repo: rapp-postgres + count: 1 + index: ../rapp-postgres/registry/indexes/capabilities.yaml +- repo: rapp-sbom-nexus + count: 1 + index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml +- repo: rapp-telemetry + count: 1 + index: ../rapp-telemetry/registry/indexes/capabilities.yaml +- repo: rapp-tenant-engine + count: 1 + index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml +- repo: rapp-user-engine + count: 1 + index: ../rapp-user-engine/registry/indexes/capabilities.yaml +- repo: reef-railiance + count: 1 + index: ../reef-railiance/registry/indexes/capabilities.yaml +- repo: rein-aharness + count: 1 + index: ../rein-aharness/registry/indexes/capabilities.yaml +- repo: rein-openweights + count: 1 + index: ../rein-openweights/registry/indexes/capabilities.yaml +- repo: repo-manager + count: 1 + index: ../repo-manager/registry/indexes/capabilities.yaml +- repo: repo-scoping + count: 1 + url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/repo-scoping.yaml +- repo: repo-seed + count: 1 + url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/repo-seed.yaml +- repo: resource-control + count: 1 + index: ../resource-control/registry/indexes/capabilities.yaml +- repo: reuse-surface + count: 3 + index: ../reuse-surface/registry/indexes/capabilities.yaml +- repo: risk-nexus + count: 1 + index: ../risk-nexus/registry/indexes/capabilities.yaml +- repo: role-engine + count: 1 + index: ../role-engine/registry/indexes/capabilities.yaml +- repo: runbook-tutorials + count: 1 + index: ../runbook-tutorials/registry/indexes/capabilities.yaml +- repo: sand-boxer + count: 1 + index: ../sand-boxer/registry/indexes/capabilities.yaml +- repo: sbom-nexus + count: 1 + index: ../sbom-nexus/registry/indexes/capabilities.yaml +- repo: secrets-engine + count: 1 + index: ../secrets-engine/registry/indexes/capabilities.yaml +- repo: security-canon + count: 1 + index: ../security-canon/registry/indexes/capabilities.yaml +- repo: shard-wiki + count: 8 + url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- repo: state-hub + count: 2 + index: ../state-hub/registry/indexes/capabilities.yaml +- repo: tegwick-control + count: 0 + url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/tegwick-control.yaml +- repo: tenant-engine + count: 1 + index: ../tenant-engine/registry/indexes/capabilities.yaml +- repo: the-custodian + count: 1 + index: ../the-custodian/registry/indexes/capabilities.yaml +- repo: user-engine + count: 1 + index: ../user-engine/registry/indexes/capabilities.yaml +- repo: vantage-point + count: 1 + url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/vantage-point.yaml +- repo: vergabe-teilnahme + count: 1 + url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/vergabe-teilnahme.yaml +- repo: whitehat-security + count: 1 + index: ../whitehat-security/registry/indexes/capabilities.yaml +- repo: whynot-control + count: 0 + url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/whynot-control.yaml +- repo: whynot-design + count: 1 + url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml + cache: /tmp/netkingdom-reuse-federation-cache/whynot-design.yaml +- repo: zone-engine + count: 1 + index: ../zone-engine/registry/indexes/capabilities.yaml +capabilities: +- id: capability.activity.event-coordinate + name: Durable automation and bounded operations + summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime + sinks. + domain: helix_forge + status: draft + owner: activity-core + tags: + - activity + - coordination + - automation + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.activity.event-coordinate.md + consumption_modes: + - HTTP API + - source + source_repo: activity-core + source_index: ../activity-core/registry/indexes/capabilities.yaml +- id: capability.agents.cli-assistant + name: Console-Native LLM Assistant (cya) + summary: Console-native, backend-agnostic assistant CLI that expresses user intent + in natural language and returns safe, explainable, context-aware help. + vector: D2 / A2 / C1 / R0 + domain: agents + status: draft + owner: can-you-assist + path: registry/capabilities/capability.agents.cli-assistant.md + tags: + - cli + - assistant + - llm + - safety + consumption_modes: + - cli + source_repo: can-you-assist + source_url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/can-you-assist.yaml +- id: capability.agents.custodian-runtime-tooling + name: Generic agent runtime and repository tooling + summary: Agent runtime modules and repository classification tooling. + domain: custodian + status: draft + owner: the-custodian + tags: + - agents + - runtime + - classification + - security + - netkingdom + - framework-reuse + vector: D2 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.custodian-runtime-tooling.md + consumption_modes: + - CLI + - source + source_repo: the-custodian + source_index: ../the-custodian/registry/indexes/capabilities.yaml +- id: capability.agents.kaizen-framework + name: Kaizen Agentic Framework + summary: AI agency framework providing 20 deployable agent instruction sets, project + memory, metrics, role and engagement contracts, and scheduled preparation for + governed execution. + vector: D3 / A2 / C1 / R0 + domain: agents + status: draft + owner: kaizen-agentic + path: registry/capabilities/capability.agents.kaizen-framework.md + tags: + - agents + - memory + - coordination + - metrics + - scheduling + - engagements + consumption_modes: + - cli + - library import + - file contracts + source_repo: kaizen-agentic + source_url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/kaizen-agentic.yaml +- id: capability.agents.llm-connector + name: Pluggable LLM Adapter Library (llm-connect) + summary: Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, + Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract + interface for adding new providers. + vector: D3 / A2 / C2 / R1 + domain: agents + status: draft + owner: llm-connect + path: registry/capabilities/capability.agents.llm-connector.md + tags: + - llm + - adapter + - provider-neutral + consumption_modes: + - library import + - cli + source_repo: llm-connect + source_url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/llm-connect.yaml +- id: capability.agents.performance-learning + name: Agent performance learning + summary: Capture sessions, curate patterns, distribute lessons and measure outcomes. + domain: infotech + status: draft + owner: agentic-resources + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.performance-learning.md + consumption_modes: + - CLI + - source + source_repo: agentic-resources + source_index: ../agentic-resources/registry/indexes/capabilities.yaml +- id: capability.agents.repo-scoping-service + name: Repository Scoping Service + summary: Maps repositories from usefulness to implementation (Ability -> Capability + -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP + API, and curator UI. + vector: D2 / A2 / C1 / R0 + domain: agents + status: draft + owner: repo-scoping + path: registry/capabilities/capability.agents.repo-scoping-service.md + tags: + - classification + - scoping + - registry + consumption_modes: + - http api + - library import + - ui + source_repo: repo-scoping + source_url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/repo-scoping.yaml +- id: capability.audit.event-retain + name: Independent audit custody + summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. + domain: infotech + status: draft + owner: audit-core + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C3 / R2 + path: registry/capabilities/capability.audit.event-retain.md + consumption_modes: + - HTTP API + - source + source_repo: audit-core + source_index: ../audit-core/registry/indexes/capabilities.yaml +- id: capability.authorization.policy-evaluate + name: Policy evaluation and decision evidence + summary: Check, batch, list-allowed, explain, binding, lifetime and decision records. + domain: helix_forge + status: draft + owner: access-engine + tags: + - authorization + - policy + - flex-auth + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.authorization.policy-evaluate.md + consumption_modes: + - HTTP API + - source + source_repo: access-engine + source_index: ../access-engine/registry/indexes/capabilities.yaml +- id: capability.cmis.tck + name: OpenCMIS Conformance-Preparation Extension + summary: CMIS conformance-preparation extension for guide-board, keeping CMIS-specific + runner code, profiles, capability mappings, and workplans outside the generic + compliance framework. + vector: D2 / A1 / C1 / R0 + domain: communication + status: draft + owner: open-cmis-tck + path: registry/capabilities/capability.cmis.tck.md + tags: + - cmis + - compliance + - guide-board-extension + consumption_modes: + - library import (guide-board extension) + source_repo: open-cmis-tck + source_url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/open-cmis-tck.yaml +- id: capability.communication.compliance-evidence-framework + name: Certification And Compliance Evidence Framework + summary: Framework that turns standards, conformance, regulatory, and repository-quality + claims into structured, reviewable, repeatable, comparable evidence via a pluggable + extension architecture. + vector: D2 / A2 / C1 / R0 + domain: communication + status: draft + owner: guide-board + path: registry/capabilities/capability.communication.compliance-evidence-framework.md + tags: + - compliance + - certification + - evidence + - extensions + consumption_modes: + - cli + source_repo: guide-board + source_url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/guide-board.yaml +- id: capability.communication.context-engine + name: Kontextual Engine (Knowledge Operations Runtime) + summary: Headless knowledge-operations engine turning heterogeneous information + assets into persistent, contextual, governed, retrievable, transformable, and + agent-operable knowledge. + vector: D4 / A1 / C1 / R0 + domain: communication + status: draft + owner: kontextual-engine + path: registry/capabilities/capability.communication.context-engine.md + tags: + - knowledge + - context + - runtime + consumption_modes: + - library import + source_repo: kontextual-engine + source_url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/kontextual-engine.yaml +- id: capability.communication.infospace-workspace + name: Infospace Workspace And Evaluation Bench + summary: Workspace and service for creating, developing, evaluating, and inspecting + structured knowledge spaces (infospaces); application-layer successor to the infospace + work begun in markitect-main. + vector: D3 / A1 / C2 / R1 + domain: communication + status: draft + owner: infospace-bench + path: registry/capabilities/capability.communication.infospace-workspace.md + tags: + - infospace + - knowledge + - evaluation + consumption_modes: + - cli + - library import (consumed by info-tech-canon) + source_repo: infospace-bench + source_url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/infospace-bench.yaml +- id: capability.communication.markitect-legacy-platform + name: MarkiTect Legacy Platform + summary: Intelligent markdown engine and information-management platform treating + documents as structured, queryable information spaces with schema validation, + transclusion, and LLM-driven evaluation; the legacy umbrella now being split into + markitect-tool, infospace-bench, and kontextual-engine. + vector: D3 / A1 / C1 / R0 + domain: communication + status: draft + owner: markitect-main + path: registry/capabilities/capability.communication.markitect-legacy-platform.md + tags: + - markitect + - markdown + - legacy + consumption_modes: + - application (legacy, not recommended for new integration) + source_repo: markitect-main + source_url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/markitect-main.yaml +- id: capability.communication.markitect-quarkdown-adapter + name: Markitect Quarkdown Render Adapter + summary: Concrete Quarkdown render/export adapter for Markitect, mapping Markitect + profiles to Quarkdown profiles and running controlled Quarkdown CLI execution + plans without forking or reimplementing Quarkdown. + vector: D3 / A1 / C1 / R0 + domain: communication + status: draft + owner: markitect-quarkdown + path: registry/capabilities/capability.communication.markitect-quarkdown-adapter.md + tags: + - markitect + - quarkdown + - adapter + consumption_modes: + - library import (plugin/entry-point) + source_repo: markitect-quarkdown + source_url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/markitect-quarkdown.yaml +- id: capability.communication.markitect-source-adapters + name: Markitect Source-Format Adapters + summary: Concrete source-format adapters (EPUB3, PDF) converting external document + formats into canonical Markitect Markdown, implementing the markitect-tool source + adapter contract. + vector: D2 / A1 / C1 / R0 + domain: communication + status: draft + owner: markitect-filter + path: registry/capabilities/capability.communication.markitect-source-adapters.md + tags: + - markitect + - adapter + - document-conversion + consumption_modes: + - library import (plugin/entry-point) + source_repo: markitect-filter + source_url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/markitect-filter.yaml +- id: capability.communication.markitect-toolkit + name: Markitect Markdown Toolkit And CLI + summary: Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown + into structured, queryable, reusable knowledge artifacts; syntax-layer successor + to markitect-main. + vector: D4 / A2 / C2 / R1 + domain: communication + status: draft + owner: markitect-tool + path: registry/capabilities/capability.communication.markitect-toolkit.md + tags: + - markitect + - markdown + - cli + - toolkit + consumption_modes: + - cli + - library import + source_repo: markitect-tool + source_url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/markitect-tool.yaml +- id: capability.coordination.cross-owner-work + name: Cross-owner coordination lifecycle + summary: Observation, lease, wake-up, checkpoint and receipt contracts/runtime. + domain: infotech + status: draft + owner: coordination-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.coordination.cross-owner-work.md + consumption_modes: + - CLI + - source + source_repo: coordination-engine + source_index: ../coordination-engine/registry/indexes/capabilities.yaml +- id: capability.design.whynot-system + name: Whynot Design System + summary: 'Framework-agnostic visual language for whynot prototype/market-signal + artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain + HTML, and Django template adapters.' + vector: D3 / A2 / C2 / R1 + domain: consumer + status: draft + owner: whynot-design + path: registry/capabilities/capability.design.whynot-system.md + tags: + - design-system + - web-components + - frontend + consumption_modes: + - library import (npm) + - cli + - django template adapter + source_repo: whynot-design + source_url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/whynot-design.yaml +- id: capability.evidence.binding + name: Evidence-to-Target Binding + summary: Links evidence items to structured targets with relation, status, and confidence + metadata, bidirectional queries, active-state coordination, and canonical engine + events. + vector: D3 / A2 / C3 / R3 + domain: infotech + status: draft + owner: evidence-binder + path: registry/capabilities/capability.evidence.binding.md + tags: + - evidence + - binding + - evidence-link + - form-field + - citation-evidence + consumption_modes: + - source module + - React provider + source_repo: evidence-binder + source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml +- id: capability.evidence.rect-registry + name: Visual-Guide Rect Registry + summary: Coordinates field, evidence-card, and highlight rectangles from independent + renderers so an SVG overlay can draw the active visual guide without polling. + vector: D3 / A2 / C3 / R3 + domain: infotech + status: draft + owner: evidence-binder + path: registry/capabilities/capability.evidence.rect-registry.md + tags: + - rect-registry + - visual-guide + - overlay + - active-state + - citation-evidence + consumption_modes: + - source module + - React component + source_repo: evidence-binder + source_url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/evidence-binder.yaml +- id: capability.execution.openweight-rein + name: Bounded open-weight agent execution + summary: Tool loop, path guards, turn/budget limits and verified-commit result. + domain: infotech + status: draft + owner: rein-openweights + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.openweight-rein.md + consumption_modes: + - CLI + - source + source_repo: rein-openweights + source_index: ../rein-openweights/registry/indexes/capabilities.yaml +- id: capability.execution.profile-harness + name: Profile-bound agent execution lifecycle + summary: Typed execution requests, profile/rein resolution, sandbox and cleanup + orchestration. + domain: infotech + status: draft + owner: glas-harness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.execution.profile-harness.md + consumption_modes: + - library + - CLI + source_repo: glas-harness + source_index: ../glas-harness/registry/indexes/capabilities.yaml +- id: capability.execution.sandbox-provision + name: Sandbox establishment and lifecycle + summary: Profiles, extensions, provision, checkpoints, TTL teardown and telemetry. + domain: infotech + status: draft + owner: sand-boxer + tags: + - sandbox + - isolation + - provision + - e2e + - agentic + - execution + - profile + - security + - netkingdom + - framework-reuse + vector: D5 / A5 / C5 / R0 + path: registry/capabilities/execution.sandbox-provision.md + consumption_modes: + - containerized service + - CLI + source_repo: sand-boxer + source_index: ../sand-boxer/registry/indexes/capabilities.yaml +- id: capability.execution.scheduled-agent-rein + name: Scheduled agent intake and harness routing + summary: Activity Core lease claim/heartbeat and Glas profile execution. + domain: infotech + status: draft + owner: rein-aharness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.scheduled-agent-rein.md + consumption_modes: + - CLI + - source + source_repo: rein-aharness + source_index: ../rein-aharness/registry/indexes/capabilities.yaml +- id: capability.feature-control.evaluate + name: Feature Availability Evaluation + summary: Evaluate whether a feature is active, hidden, disabled, or unavailable + for a subject in context. + vector: D5 / A4 / C3 / R3 + domain: helix_forge + status: draft + owner: feature-control + path: registry/capabilities/capability.feature-control.evaluate.md + tags: + - feature-control + - evaluation + - sdk + consumption_modes: + - SDK + - service API + source_repo: feature-control + source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml +- id: capability.feature-control.rollout + name: Feature Rollout Control + summary: Gradually expose features to subjects across tenants, domains, groups, + or cohorts using rollout rules. + vector: D4 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: feature-control + path: registry/capabilities/capability.feature-control.rollout.md + tags: + - feature-control + - rollout + - planning + consumption_modes: + - source module + - SDK + source_repo: feature-control + source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml +- id: capability.feature-control.visibility + name: Feature Visibility Control + summary: Control whether features are visible or hidden for subjects without changing + entitlement or authorization. + vector: D4 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: feature-control + path: registry/capabilities/capability.feature-control.visibility.md + tags: + - feature-control + - visibility + consumption_modes: + - source module + source_repo: feature-control + source_url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/feature-control.yaml +- id: capability.finance.security-budget-evidence + name: Budget and cost evidence for security operations + summary: Budget, commitment, spend attribution and planning-evidence consumption. + domain: infotech + status: draft + owner: fin-hub + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.finance.security-budget-evidence.md + consumption_modes: + - HTTP API + - source + source_repo: fin-hub + source_index: ../fin-hub/registry/indexes/capabilities.yaml +- id: capability.graph.nbgm-spec + name: Network-Based Graph Model (NBGM) Specification + summary: Generic system and versioned protocol specification for exploring dependency + structures as network-based graph models (NBGM), unifying entity/relationship + inspection and reasoning across arbitrary domains. + vector: D2 / A0 / C1 / R0 + domain: infotech + status: draft + owner: vantage-point + path: registry/capabilities/capability.graph.nbgm-spec.md + tags: + - graph + - nbgm + - specification + consumption_modes: + - informational (specification only) + source_repo: vantage-point + source_url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/vantage-point.yaml +- id: capability.hr.workflow-catalog + name: HR Workflow Catalog + summary: Markdown-first registry of HR planning workflows with an iterative assessment + loop tied to INTENT phases. + vector: D3 / A1 / C1 / R0 + domain: consumer + status: draft + owner: human-resources + path: registry/capabilities/capability.hr.workflow-catalog.md + tags: + - hr + - workflows + - assessment + - planning + consumption_modes: + - informational + source_repo: human-resources + source_url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/human-resources.yaml +- id: capability.iam.key-cape + name: OIDC identity and assurance + summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. + domain: infotech + status: draft + owner: key-cape + tags: + - iam + - oidc + - netkingdom + - security + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.iam.key-cape.md + consumption_modes: + - HTTP API + - source + source_repo: key-cape + source_index: ../key-cape/registry/indexes/capabilities.yaml +- id: capability.identity.subject-resolution + name: Identity Subject Resolution + summary: Resolve who or what is acting by mapping principals, accounts, actors, + and identifiers to a stable subject model. + vector: D3 / A0 / C1 / R0 + domain: helix_forge + status: draft + owner: commerce-canon + path: registry/capabilities/capability.identity.subject-resolution.md + tags: + - identity + - subject + - architecture + consumption_modes: + - informational + source_repo: commerce-canon + source_url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml +- id: capability.identity.tenant-facts + name: Tenant lifecycle and guardrail facts + summary: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store. + domain: infotech + status: draft + owner: tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.identity.tenant-facts.md + consumption_modes: + - HTTP API + - source + source_repo: tenant-engine + source_index: ../tenant-engine/registry/indexes/capabilities.yaml +- id: capability.identity.user-engine + name: User lifecycle and account journeys + summary: Accounts, identity links, membership, MFA and recovery portal, advisory + catalog. + domain: communication + status: draft + owner: user-engine + tags: + - identity + - user-management + - multi-tenant + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R0 + path: registry/capabilities/capability.identity.user-engine.md + consumption_modes: + - HTTP API + - source + source_repo: user-engine + source_index: ../user-engine/registry/indexes/capabilities.yaml +- id: capability.identity.vocabulary-canonicalize + name: Identity Vocabulary Canonicalization + summary: Define an implementation-neutral vocabulary for identity-related concepts + across overlapping domains. + vector: D4 / A0 / C2 / R0 + domain: helix_forge + status: draft + owner: commerce-canon + path: registry/capabilities/capability.identity.vocabulary-canonicalize.md + tags: + - identity + - terminology + - research + consumption_modes: + - informational + source_repo: commerce-canon + source_url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/commerce-canon.yaml +- id: capability.infotech.artifact-store + name: Artifact Registry And Storage Gateway + summary: Generic artifact registry and storage gateway for generated outputs, evidence + packages, reports, logs, snapshots, exports, and release artifacts. + vector: D3 / A1 / C1 / R0 + domain: infotech + status: draft + owner: artifact-store + path: registry/capabilities/capability.infotech.artifact-store.md + tags: + - artifact + - storage + - provenance + - registry + consumption_modes: + - library import + - cli + source_repo: artifact-store + source_url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/artifact-store.yaml +- id: capability.infotech.canon-service + name: Shared semantic contracts and validation + summary: Markdown canon with library, CLI and read-only API. + domain: infotech + status: draft + owner: info-tech-canon + tags: + - canon + - infospace + - service + - security + - netkingdom + - framework-reuse + vector: D2 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.canon-service.md + consumption_modes: + - HTTP API + - source + source_repo: info-tech-canon + source_index: ../info-tech-canon/registry/indexes/capabilities.yaml +- id: capability.infotech.citation-engine + name: Citation Evidence Domain Engine + summary: "Core domain model and engine services for the citation-evidence ecosystem\ + \ \u2014 shared vocabulary, in-memory repositories, orchestration services, event\ + \ bus, and citation card renderers." + vector: D3 / A1 / C1 / R0 + domain: infotech + status: draft + owner: citation-engine + path: registry/capabilities/capability.infotech.citation-engine.md + tags: + - citation + - evidence + - domain-model + consumption_modes: + - library import (workspace link) + source_repo: citation-engine + source_url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/citation-engine.yaml +- id: capability.infotech.citation-evidence-workspace + name: Citation Evidence Workspace + summary: "Document-centered evidence workspace for capturing, managing, presenting,\ + \ and re-opening citations \u2014 the umbrella application over the citation-evidence\ + \ six-package design." + vector: D4 / A1 / C1 / R0 + domain: infotech + status: draft + owner: citation-evidence + path: registry/capabilities/capability.infotech.citation-evidence-workspace.md + tags: + - citation + - evidence + - workspace + consumption_modes: + - application (local dev server) + source_repo: citation-evidence + source_url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/citation-evidence.yaml +- id: capability.infotech.config-surface-atlas + name: Configuration Surface Atlas + summary: "Read-first, cross-kind map and evidence layer for configuration surfaces\ + \ \u2014 what configures a system, who owns it, its scope, and where the source\ + \ of truth lives." + vector: D5 / A0 / C2 / R2 + domain: infotech + status: draft + owner: config-atlas + path: registry/capabilities/capability.infotech.config-surface-atlas.md + tags: + - configuration + - registry + - control-plane + - effective-config + - evidence + consumption_modes: + - informational + - source module + source_repo: config-atlas + source_url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/config-atlas.yaml +- id: capability.infotech.core-hub + name: Core Hub Production Interaction Framework + summary: Contract-first framework for cross-domain state, agent coordination, evidence, + registries, workplans, and operator interaction surfaces. + vector: D3 / A1 / C1 / R1 + domain: infotech + status: draft + owner: core-hub + path: registry/capabilities/capability.infotech.core-hub.md + tags: + - interaction-framework + - state-hub + - inter-hub-successor + - agent-coordination + - registry + - api + consumption_modes: + - informational + - planning + - cli + source_repo: core-hub + source_url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/core-hub.yaml +- id: capability.infotech.email-connector + name: Mailbox Evidence Scanner (email-connect) + summary: Headless, provider-neutral email communication and evidence service; first + slice scans a mailbox or fixture directory and produces timestamped CSV evidence + reports. + vector: D2 / A1 / C1 / R0 + domain: infotech + status: draft + owner: email-connect + path: registry/capabilities/capability.infotech.email-connector.md + tags: + - email + - evidence + - coordination + consumption_modes: + - cli + source_repo: email-connect + source_url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/email-connect.yaml +- id: capability.infotech.headless-browser + name: Headless Browser Automation + summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright + 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; + managed Railiance admission is pending. Download the Python 3.10+ standalone client + from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then + `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, follow + the local container setup in the capability card or adapt its A2 source examples; + this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.' + vector: D3 / A5 / C2 / R2 + domain: infotech + status: reviewed + owner: reuse-surface + path: registry/capabilities/capability.infotech.headless-browser.md + tags: + - headless + - browser + - automation + - playwright + - chromium + - testing + - screenshots + - extraction + - firefox + - webkit + - selenium + - puppeteer + consumption_modes: + - informational + - source adaptation + - JavaScript library + - Python library + - cli + - service API + - container + source_repo: reuse-surface + source_index: ../reuse-surface/registry/indexes/capabilities.yaml +- id: capability.infotech.hub-core-library + name: Reusable FOS Hub Core Primitives + summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State + Hub for use by other FOS (Federation of Services) hubs. + vector: D2 / A1 / C1 / R1 + domain: infotech + status: draft + owner: hub-core + path: registry/capabilities/capability.infotech.hub-core-library.md + tags: + - hub + - fastapi + - sqlalchemy + - mcp + consumption_modes: + - library import + source_repo: hub-core + source_url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/hub-core.yaml +- id: capability.infotech.issue-tracking + name: External issue tracker connector + summary: CLI and Python adapters for external issue systems. + domain: infotech + status: draft + owner: issue-core + tags: + - issue-tracking + - connector + - work-record + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.infotech.issue-tracking.md + consumption_modes: + - CLI + - source + source_repo: issue-core + source_index: ../issue-core/registry/indexes/capabilities.yaml +- id: capability.infotech.oss-integration-continuity + name: Managed Continuity For OSS Integrations + summary: Turns proven open-source integrations into structured, maintainable, continuously + managed assets with clear boundaries and update loops, so they remain robust and + transparent as upstream evolves. + vector: D2 / A1 / C1 / R0 + domain: infotech + status: draft + owner: open-reuse + path: registry/capabilities/capability.infotech.oss-integration-continuity.md + tags: + - oss + - integration + - maintenance + consumption_modes: + - library import + source_repo: open-reuse + source_url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/open-reuse.yaml +- id: capability.infotech.pdf-evidence-ingest + name: Headless PDF Evidence Ingest + summary: "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation\ + \ \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map\ + \ \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling." + vector: D2 / A1 / C1 / R1 + domain: infotech + status: draft + owner: evidence-source + path: registry/capabilities/capability.infotech.pdf-evidence-ingest.md + tags: + - pdf + - ingest + - fingerprint + - canonical-text + - evidence + consumption_modes: + - library import + source_repo: evidence-source + source_url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/evidence-source.yaml +- id: capability.infotech.repo-template + name: Coulomb Repository Template + summary: Bootstrap new git repositories with agent instructions, registry scaffold, + and State Hub onboarding conventions. + vector: D3 / A3 / C2 / R2 + domain: infotech + status: draft + owner: repo-seed + path: registry/capabilities/capability.infotech.repo-template.md + tags: + - template + - bootstrap + - state-hub + - onboarding + consumption_modes: + - git clone + - informational + source_repo: repo-seed + source_url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/repo-seed.yaml +- id: capability.infotech.runbook-tutorials + name: Guided administrative runbooks + summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. + domain: infotech + status: draft + owner: runbook-tutorials + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.infotech.runbook-tutorials.md + consumption_modes: + - CLI + - source + source_repo: runbook-tutorials + source_index: ../runbook-tutorials/registry/indexes/capabilities.yaml +- id: capability.infotech.sbom-management + name: Dependency provenance and SBOM evidence + summary: Controlled archive ingest, immutable snapshots, freshness and license review. + domain: infotech + status: draft + owner: sbom-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.sbom-management.md + consumption_modes: + - HTTP API + - source + source_repo: sbom-nexus + source_index: ../sbom-nexus/registry/indexes/capabilities.yaml +- id: capability.memory.phase-planning + name: Profile-Driven Memory Phase Planning (phase-memory) + summary: Interprets Markitect memory profiles as runtime plans, modeling memory + phases and producing deterministic dry-run actions for retention, refresh, compaction, + stabilization, and activation. + vector: D3 / A1 / C1 / R0 + domain: communication + status: draft + owner: phase-memory + path: registry/capabilities/capability.memory.phase-planning.md + tags: + - memory + - agentic + - planning + consumption_modes: + - library import + source_repo: phase-memory + source_url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/phase-memory.yaml +- id: capability.observability.security-signals + name: Security-relevant telemetry contracts and adapters + summary: Signal contract, platform adapters, report exporter and absence/alert rules. + domain: infotech + status: draft + owner: railiance-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.observability.security-signals.md + consumption_modes: + - CLI + - source + source_repo: railiance-telemetry + source_index: ../railiance-telemetry/registry/indexes/capabilities.yaml +- id: capability.operations.ops-hub + name: Operations Hub Extension Contract + summary: Versioned hub-extension package and bootstrap client for operational truth, + service-catalog records, readiness evidence, and migration gates. + vector: D3 / A1 / C1 / R1 + domain: operations + status: reviewed + owner: ops-hub + path: registry/capabilities/capability.operations.ops-hub.md + tags: + - operations + - service-catalog + - readiness + - hub-extension + consumption_modes: + - contract package + - command-line bootstrap + source_repo: ops-hub + source_url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/ops-hub.yaml +- id: capability.ops.tunnel-bridge + name: SSH tunnel lifecycle + summary: Named tunnels, reconnect, health and TTL-aware cert_command. + domain: infotech + status: draft + owner: ops-bridge + tags: + - ssh + - tunnel + - ops + - connectivity + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.ops.tunnel-bridge.md + consumption_modes: + - CLI + - source + source_repo: ops-bridge + source_index: ../ops-bridge/registry/indexes/capabilities.yaml +- id: capability.organization.role-catalog + name: Organizational role definitions + summary: Versioned documentation catalog. + domain: infotech + status: draft + owner: role-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.organization.role-catalog.md + consumption_modes: + - informational + source_repo: role-engine + source_index: ../role-engine/registry/indexes/capabilities.yaml +- id: capability.procurement.vergabe-teilnahme + name: Vergabe Teilnahme (Public Procurement Participation) Application + summary: "Django application (with a Vite/Tailwind frontend) for managing German\ + \ public-procurement (Vergabe) tender participation \u2014 Ausschreibungs- und\ + \ Teilnahme-Management-System." + vector: D3 / A1 / C1 / R1 + domain: communication + status: draft + owner: vergabe-teilnahme + path: registry/capabilities/capability.procurement.vergabe-teilnahme.md + tags: + - procurement + - django + - vergabe + consumption_modes: + - application (Django + Vite, local dev via docker-compose) + source_repo: vergabe-teilnahme + source_url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/vergabe-teilnahme.yaml +- id: capability.railiance.bootstrap-sequencing + name: Bootstrap sequencing contracts + summary: Bare-VM to estate sequence and handoff contract. + domain: infotech + status: draft + owner: railiance-bootstrap + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.bootstrap-sequencing.md + consumption_modes: + - informational + source_repo: railiance-bootstrap + source_index: ../railiance-bootstrap/registry/indexes/capabilities.yaml +- id: capability.railiance.browser-verification + name: Managed browser verification pilot + summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts. + domain: infotech + status: draft + owner: rapp-playwright + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.railiance.browser-verification.md + consumption_modes: + - HTTP API + - source + source_repo: rapp-playwright + source_index: ../rapp-playwright/registry/indexes/capabilities.yaml +- id: capability.railiance.ci-enablement + name: Developer delivery and CI templates + summary: Reusable CI workflows, build and deployment patterns. + domain: financials + status: draft + owner: railiance-enablement + tags: + - railiance + - ci-cd + - developer-enablement + - forgejo + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.ci-enablement.md + consumption_modes: + - CLI + - source + source_repo: railiance-enablement + source_index: ../railiance-enablement/registry/indexes/capabilities.yaml +- id: capability.railiance.cluster-bootstrap + name: Kubernetes runtime and cluster controls + summary: k3s, ingress, CNI, operators and kubeconfig/runtime checks. + domain: financials + status: draft + owner: railiance-cluster + tags: + - railiance + - kubernetes + - iac + - bootstrap + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.cluster-bootstrap.md + consumption_modes: + - CLI + - source + source_repo: railiance-cluster + source_index: ../railiance-cluster/registry/indexes/capabilities.yaml +- id: capability.railiance.fabric-graph + name: Infrastructure ownership and dependency graph + summary: Schemas, validation, graph queries and State Hub exports. + domain: financials + status: draft + owner: railiance-fabric + tags: + - railiance + - graph + - ownership + - discovery + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.fabric-graph.md + consumption_modes: + - CLI + - source + source_repo: railiance-fabric + source_index: ../railiance-fabric/registry/indexes/capabilities.yaml +- id: capability.railiance.forge-infrastructure + name: Source forge, registries and runner substrate + summary: Forgejo operation, package registries and runner lifecycle. + domain: financials + status: draft + owner: railiance-forge + tags: + - railiance + - forgejo + - forge + - ci-runner + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.forge-infrastructure.md + consumption_modes: + - CLI + - source + source_repo: railiance-forge + source_index: ../railiance-forge/registry/indexes/capabilities.yaml +- id: capability.railiance.infra-provisioning + name: Host convergence and security baseline + summary: Ansible inventory, firewall, SSH bootstrap and baseline verification. + domain: financials + status: draft + owner: railiance-infra + tags: + - railiance + - terraform + - ansible + - infrastructure + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.infra-provisioning.md + consumption_modes: + - CLI + - source + source_repo: railiance-infra + source_index: ../railiance-infra/registry/indexes/capabilities.yaml +- id: capability.railiance.knative-rail + name: Knative workload lifecycle + summary: Derived rail for activation, revisions, traffic, scaling and rollback. + domain: infotech + status: draft + owner: rail-knative + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.knative-rail.md + consumption_modes: + - CLI + - source + source_repo: rail-knative + source_index: ../rail-knative/registry/indexes/capabilities.yaml +- id: capability.railiance.kubernetes-rail + name: Generic Kubernetes workload lifecycle + summary: Workload declaration, rollout, observe, promote and rollback surfaces. + domain: infotech + status: draft + owner: rail-kubernetes + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.kubernetes-rail.md + consumption_modes: + - CLI + - source + source_repo: rail-kubernetes + source_index: ../rail-kubernetes/registry/indexes/capabilities.yaml +- id: capability.railiance.openbao-package + name: Managed OpenBao deployment package + summary: Helm values, package deploy/status/smoke/rollback and custody boundary. + domain: infotech + status: draft + owner: rapp-openbao + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.openbao-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-openbao + source_index: ../rapp-openbao/registry/indexes/capabilities.yaml +- id: capability.railiance.platform-services + name: Secret custody and platform data services + summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts. + domain: financials + status: draft + owner: railiance-platform + tags: + - railiance + - platform + - secrets + - postgres + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.platform-services.md + consumption_modes: + - CLI + - source + source_repo: railiance-platform + source_index: ../railiance-platform/registry/indexes/capabilities.yaml +- id: capability.railiance.policy-publication-package + name: Policy publication runtime package + summary: Immutable image, non-root/read-only runtime and approved TLS exposure. + domain: infotech + status: draft + owner: rapp-policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.policy-publication-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-policy-nexus + source_index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml +- id: capability.railiance.postgres-isolation-recovery + name: Database isolation and recovery package + summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures. + domain: infotech + status: draft + owner: rapp-postgres + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.postgres-isolation-recovery.md + consumption_modes: + - CLI + - source + source_repo: rapp-postgres + source_index: ../rapp-postgres/registry/indexes/capabilities.yaml +- id: capability.railiance.sbom-runtime-package + name: Private SBOM runtime and dynamic database delivery + summary: Immutable deployment, private network policy, dynamic database leases and + migration/rollback. + domain: infotech + status: draft + owner: rapp-sbom-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.sbom-runtime-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-sbom-nexus + source_index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml +- id: capability.railiance.security-consumption-contracts + name: Platform security consumption architecture + summary: Rail/rapp/reef boundaries, exposure and security consumption contracts. + domain: infotech + status: draft + owner: railiance-master + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.security-consumption-contracts.md + consumption_modes: + - informational + source_repo: railiance-master + source_index: ../railiance-master/registry/indexes/capabilities.yaml +- id: capability.railiance.substrate-bindings + name: Substrate topology and bindings + summary: Grouped home-reef identity, topology and placement declarations. + domain: infotech + status: draft + owner: reef-railiance + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.substrate-bindings.md + consumption_modes: + - informational + source_repo: reef-railiance + source_index: ../reef-railiance/registry/indexes/capabilities.yaml +- id: capability.railiance.telemetry-package + name: Private monitoring package + summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence. + domain: infotech + status: draft + owner: rapp-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.telemetry-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-telemetry + source_index: ../rapp-telemetry/registry/indexes/capabilities.yaml +- id: capability.railiance.tenant-engine-package + name: Tenant Engine runtime package + summary: Package declaration, smoke and rollback. + domain: infotech + status: draft + owner: rapp-tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.tenant-engine-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-tenant-engine + source_index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.user-engine-package + name: User Engine runtime package + summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. + domain: infotech + status: draft + owner: rapp-user-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.user-engine-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-user-engine + source_index: ../rapp-user-engine/registry/indexes/capabilities.yaml +- id: capability.railiance.workload-deployment-tooling + name: Workload release configuration and guards + summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback. + domain: financials + status: draft + owner: railiance-apps + tags: + - railiance + - kubernetes + - helm + - deployment + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.railiance.workload-deployment-tooling.md + consumption_modes: + - CLI + - source + source_repo: railiance-apps + source_index: ../railiance-apps/registry/indexes/capabilities.yaml +- id: capability.registry.register + name: Capability registry and federation + summary: Owner Markdown entries, indexes, federation hub and planning queries. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - governance + - meta + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C2 / R3 + path: registry/capabilities/capability.registry.register.md + consumption_modes: + - library + - CLI + source_repo: reuse-surface + source_index: ../reuse-surface/registry/indexes/capabilities.yaml +- id: capability.registry.validate + name: Capability registry validation + summary: Schema, index consistency and relation checks. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - validation + - cli + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R3 + path: registry/capabilities/capability.registry.validate.md + consumption_modes: + - library + - CLI + source_repo: reuse-surface + source_index: ../reuse-surface/registry/indexes/capabilities.yaml +- id: capability.resources.security-capacity + name: Capacity and recovery resource planning + summary: Provider-neutral inventory, procurement evidence and optimization reports. + domain: infotech + status: draft + owner: resource-control + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.resources.security-capacity.md + consumption_modes: + - CLI + - source + source_repo: resource-control + source_index: ../resource-control/registry/indexes/capabilities.yaml +- id: capability.security.access-routing + name: Credential routing and contained access + summary: warden route and access catalog; exact lane conduit and secret-exec routing. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.security.access-routing.md + consumption_modes: + - library + - CLI + source_repo: ops-warden + source_index: ../ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.adversarial-evidence + name: Authorized adversarial evidence harness + summary: Offline ASM and tenancy calibrations and engagement admission. + domain: infotech + status: draft + owner: whitehat-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.adversarial-evidence.md + consumption_modes: + - CLI + - source + source_repo: whitehat-security + source_index: ../whitehat-security/registry/indexes/capabilities.yaml +- id: capability.security.agent-knowledge + name: Verified security orientation for agents + summary: Versioned source-pinned cards, read-only CLI, provider adapters and sealed + exports. + domain: infotech + status: draft + owner: emergent-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.agent-knowledge.md + consumption_modes: + - CLI + - source + source_repo: emergent-security + source_index: ../emergent-security/registry/indexes/capabilities.yaml +- id: capability.security.approval-lifecycle + name: Bound approval lifecycle + summary: Authenticated issue, claim, revoke, supersede and atomic consume API with + outbox. + domain: infotech + status: draft + owner: approval-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.approval-lifecycle.md + consumption_modes: + - HTTP API + - source + source_repo: approval-engine + source_index: ../approval-engine/registry/indexes/capabilities.yaml +- id: capability.security.bootstrap-recovery + name: Guarded bootstrap and recovery preparation + summary: Local identity, bootstrap console, encrypted custody handoff and caller + tools. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.bootstrap-recovery.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: ../net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.case-contracts + name: Security case types and instance validation + summary: Versioned types, cases and schema validation. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-contracts.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: ../net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.case-follow-through + name: Security case operational follow-through + summary: KnownSecurityCase route, plan and operational receipts. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-follow-through.md + consumption_modes: + - CLI + - source + source_repo: ops-warden + source_index: ../ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.credential-lifecycle + name: Cataloged credential lifecycle + summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke. + domain: infotech + status: draft + owner: secrets-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.credential-lifecycle.md + consumption_modes: + - CLI + - source + source_repo: secrets-engine + source_index: ../secrets-engine/registry/indexes/capabilities.yaml +- id: capability.security.doctrine-review + name: Security doctrine and architecture review + summary: Layer rules, authority context, ASM criteria and interpretations. + domain: infotech + status: draft + owner: gate-house + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.doctrine-review.md + consumption_modes: + - informational + source_repo: gate-house + source_index: ../gate-house/registry/indexes/capabilities.yaml +- id: capability.security.emission-profile + name: Security emission cadence validation + summary: Security profile over generic emission contracts and validator. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.emission-profile.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: ../net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.forge-secret-prevention + name: Independent introduced-history secret prevention + summary: Pinned receive adapter, lifecycle template and fail-closed scan. + domain: infotech + status: draft + owner: railiance-forge + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.forge-secret-prevention.md + consumption_modes: + - CLI + - source + source_repo: railiance-forge + source_index: ../railiance-forge/registry/indexes/capabilities.yaml +- id: capability.security.human-decision-workspace + name: Human security decision presentation and disposition + summary: Headless lifecycle and browser workspace with exact native approval references. + domain: infotech + status: draft + owner: informed-decision + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.human-decision-workspace.md + consumption_modes: + - HTTP API + - source + source_repo: informed-decision + source_index: ../informed-decision/registry/indexes/capabilities.yaml +- id: capability.security.iam-tooling-suite + name: NetKingdom security architecture and conformance tooling + summary: Versioned IAM, layer, tenancy and credential contracts plus validators. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - iam + - kubernetes + - conformance + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.security.iam-tooling-suite.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: ../net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.maturity-claims + name: Evidence-based maturity claims and gap register + summary: SQLite library and CLI for ladders, evidence expiry, compute, explain and + stance inventory. + domain: infotech + status: draft + owner: maturity-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.maturity-claims.md + consumption_modes: + - CLI + - source + source_repo: maturity-engine + source_index: ../maturity-engine/registry/indexes/capabilities.yaml +- id: capability.security.policy-publication + name: Policy publication with source provenance + summary: Generated immutable publication, source currency and stable policy URLs. + domain: infotech + status: draft + owner: policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.policy-publication.md + consumption_modes: + - CLI + - source + source_repo: policy-nexus + source_index: ../policy-nexus/registry/indexes/capabilities.yaml +- id: capability.security.posture-assessment + name: Security posture assessment and response proposals + summary: Normalized observation evaluator, cadence checks and secret-use snapshot + adapter. + domain: infotech + status: draft + owner: kings-guard + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-assessment.md + consumption_modes: + - CLI + - source + source_repo: kings-guard + source_index: ../kings-guard/registry/indexes/capabilities.yaml +- id: capability.security.posture-feedback + name: Deterministic posture feedback + summary: CLI evaluates evidence age and posture into owner-routed findings. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-feedback.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: ../net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.practice-canon + name: Security practice and authority vocabulary + summary: Versioned SEC-DSM and Mode of Authority documents. + domain: infotech + status: draft + owner: security-canon + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.practice-canon.md + consumption_modes: + - informational + source_repo: security-canon + source_index: ../security-canon/registry/indexes/capabilities.yaml +- id: capability.security.repository-secret-prevention + name: Repository metadata and staged-secret prevention + summary: Repository observation plus pinned staged-blob scanner and hook integration. + domain: infotech + status: draft + owner: repo-manager + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.repository-secret-prevention.md + consumption_modes: + - CLI + - source + source_repo: repo-manager + source_index: ../repo-manager/registry/indexes/capabilities.yaml +- id: capability.security.risk-register + name: Security risk and exception review register + summary: Markdown findings and Python review, verification and due-work reports. + domain: infotech + status: draft + owner: risk-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.risk-register.md + consumption_modes: + - CLI + - source + source_repo: risk-nexus + source_index: ../risk-nexus/registry/indexes/capabilities.yaml +- id: capability.security.scenario-compose + name: Deterministic security scenario composition + summary: CLI selects pinned providers and orders trust transitions. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.scenario-compose.md + consumption_modes: + - CLI + - source + source_repo: net-kingdom + source_index: ../net-kingdom/registry/indexes/capabilities.yaml +- id: capability.security.ssh-certificate-issuance + name: Decision-bound SSH certificates + summary: warden sign with local and OpenBao backends and adm/agt/atm actors. + domain: helix_forge + status: draft + owner: ops-warden + tags: + - ssh + - certificate + - ca + - ops-warden + - openbao + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R2 + path: registry/capabilities/capability.security.ssh-certificate-issuance.md + consumption_modes: + - library + - CLI + source_repo: ops-warden + source_index: ../ops-warden/registry/indexes/capabilities.yaml +- id: capability.security.structure-construction + name: Reviewed security structure construction + summary: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply. + domain: infotech + status: draft + owner: ops-mason + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.structure-construction.md + consumption_modes: + - CLI + - source + source_repo: ops-mason + source_index: ../ops-mason/registry/indexes/capabilities.yaml +- id: capability.security.zone-reference + name: Zone membership reference conformance + summary: Offline resolution, exception and lineage checks. + domain: infotech + status: draft + owner: zone-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.zone-reference.md + consumption_modes: + - CLI + - source + source_repo: zone-engine + source_index: ../zone-engine/registry/indexes/capabilities.yaml +- id: capability.statehub.progress-log + name: Progress and work evidence indexing + summary: REST progress and task evidence references. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - progress + - coordination + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R3 + path: registry/capabilities/capability.statehub.progress-log.md + consumption_modes: + - HTTP API + - source + source_repo: state-hub + source_index: ../state-hub/registry/indexes/capabilities.yaml +- id: capability.statehub.workstream-coordinate + name: Cross-repository work tracking + summary: File-derived workplans, tasks, dependencies, decisions and coordination + views. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - coordination + - workplans + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R2 + path: registry/capabilities/capability.statehub.workstream-coordinate.md + consumption_modes: + - HTTP API + - source + source_repo: state-hub + source_index: ../state-hub/registry/indexes/capabilities.yaml +- id: capability.wiki.adapter-contract + name: Capability-Aware Shard Adapter Contract + summary: A versioned backend interface where each binding declares a verified capability + profile, so federation ops degrade by capability. + vector: D5 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.adapter-contract.md + tags: + - wiki + - adapter + - capability + - contract + - conformance + - shard-wiki + consumption_modes: + - source module + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- id: capability.wiki.coordination-journal + name: Event-Sourced Coordination Journal + summary: An append-only, totally-ordered-per-space decision log whose current state + is a derived fold; git-addressable history. + vector: D5 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.coordination-journal.md + tags: + - wiki + - event-sourcing + - coordination + - git + - journal + - shard-wiki + consumption_modes: + - source module + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- id: capability.wiki.derived-views + name: Wiki Derived Views + summary: "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges,\ + \ AllPages, SiteMap, and (delegate-or-derive) Search \u2014 carrying provenance." + vector: D3 / A0 / C0 / R0 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.derived-views.md + tags: + - wiki + - derived-views + - backlinks + - recentchanges + - search + - shard-wiki + consumption_modes: + - informational + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- id: capability.wiki.engine-typed-extensions + name: Wiki Engine with Typed Extensions + summary: A small-core wiki engine realizing a typed-extension framework that addresses + all wiki use cases and lets each shard activate only the features it needs. + vector: D3 / A0 / C0 / R0 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.engine-typed-extensions.md + tags: + - wiki + - engine + - typed-extensions + - feature-activation + - shard-wiki + consumption_modes: + - informational + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- id: capability.wiki.federation-models + name: Selectable Federation-Model Taxonomy + summary: Federation as a plural, composable coordination axis (fork+journal, VCS-replication, + query-join, feed, activity-streams, engine-mirror) selected per space. + vector: D4 / A0 / C1 / R0 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.federation-models.md + tags: + - wiki + - federation + - taxonomy + - composable + - shard-wiki + consumption_modes: + - informational + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- id: capability.wiki.overlay + name: Overlay-Before-Mutation Write Path + summary: Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only + or limited backends be edited safely without silent remote mutation. + vector: D5 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.overlay.md + tags: + - wiki + - overlay + - patch + - write-path + - conflict + - shard-wiki + consumption_modes: + - source module + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- id: capability.wiki.page-model + name: Backend-Neutral Wiki Page Model + summary: A Markdown-first but stretchable page model with stable identity separate + from placement and layered provenance. + vector: D5 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.page-model.md + tags: + - wiki + - page-model + - identity + - provenance + - markdown + - shard-wiki + consumption_modes: + - source module + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml +- id: capability.wiki.shard-orchestration + name: Wiki Shard Orchestration + summary: Present a union of pages across heterogeneous wiki-shaped shards while + preserving each shard's provenance, capabilities, and history. + vector: D5 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: shard-wiki + path: registry/capabilities/capability.wiki.shard-orchestration.md + tags: + - wiki + - federation + - orchestration + - union + - shard-wiki + consumption_modes: + - source module + source_repo: shard-wiki + source_url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + source_index: /tmp/netkingdom-reuse-federation-cache/shard-wiki.yaml diff --git a/docs/assessments/netkingdom-2026-10-14/local-default-federation-receipt.json b/docs/assessments/netkingdom-2026-10-14/local-default-federation-receipt.json new file mode 100644 index 00000000..ac92baa9 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/local-default-federation-receipt.json @@ -0,0 +1,8 @@ +{ + "source_count": 99, + "reviewed_count": 70, + "all_exactly_once": true, + "warnings": [], + "previous_sources_sha256": "29a877f165b8d474ceb032f199efa87349a4c4f90c3599fab0cb244110113d10", + "scope": "Workstation local federation. Existing unrelated sources preserved; hosted registration is separate." +} diff --git a/docs/assessments/netkingdom-2026-10-14/local-discovery-receipt.json b/docs/assessments/netkingdom-2026-10-14/local-discovery-receipt.json new file mode 100644 index 00000000..b38a32d4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/local-discovery-receipt.json @@ -0,0 +1,21 @@ +{ + "default_federated_index": "/home/worsch/reuse-surface/registry/indexes/federated.yaml", + "total_capabilities_including_unrelated_sources": 114, + "reviewed_exactly_once": 70, + "composition_warnings": [], + "plan_check_trials": [ + { + "intent": "bound approval consumption before credential delivery", + "top_id": "capability.security.approval-lifecycle", + "verdict": "extend", + "score": 0.2857 + }, + { + "intent": "deterministic posture feedback evidence expiry", + "top_id": "capability.security.posture-feedback", + "verdict": "reuse", + "score": 0.6 + } + ], + "meaning": "Discovery works through the normal CLI. Ranking verdicts are lexical planning recommendations, not permission or runtime readiness." +} diff --git a/docs/assessments/netkingdom-2026-10-14/local-federation-guide.md b/docs/assessments/netkingdom-2026-10-14/local-federation-guide.md new file mode 100644 index 00000000..5fe1446f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/local-federation-guide.md @@ -0,0 +1,27 @@ +# NetKingdom security capability discovery + +The workstation federation includes 70 reviewed security and supporting capabilities from 60 sibling repositories. Two additional inspected repositories are nonproviders: rapp-secrets-engine is retired and rapp-forgejo is a placeholder without a package declaration. The owner capability entries are the reusable source; the architecture assessment is in the-custodian CUST-WP-0081. + +## Local discovery + +From a reuse-surface checkout beside those repositories: + +```sh +reuse-surface federation compose +reuse-surface plan-check --intent "bound approval consumption before credential delivery" --no-llm +reuse-surface plan-check --intent "deterministic posture feedback evidence expiry" --no-llm +``` + +The source manifest uses relative sibling paths for the reviewed cohort and requires their indexes to exist. Other federation sources are preserved. A missing sibling is a composition error rather than silent loss of a reviewed capability. The composed local index supports planning; it is not a runtime readiness or authorization grant. `reuse-surface query` searches this repository's own index, while `plan-check` uses the composed federation. + +## Hosted discovery + +```sh +reuse-surface plan-check --hub-url https://reuse.coulomb.social --intent "bound approval consumption" --no-llm +``` + +As checked on 2026-10-14, all 60 source registry commits are published, while the hosted hub contains 32 of the 70 reviewed capabilities. Thirty-eight new owner registrations remain pending scoped write access: the normal Warden lane was allowed by the PDP but OpenBao refused the current caller with HTTP 403. Seven of those indexes also require admitted private-source read access; anonymous retrieval returns 404. Do not change repository visibility or reuse another workload's credential to make discovery pass. + +The seven private sources are rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-telemetry, rapp-tenant-engine, rapp-user-engine and rapp-sbom-nexus. Hosted registration supports an `auth_env` reference to a credential already configured at the hub. Source-owner approval, scoped read provisioning and a successful native fetch must precede their registration. Thirty-one public-source registrations are otherwise ready. + +The exact registration plan, source commits, raw retrieval results and local/hosted verification receipts are retained in the-custodian at `docs/assessments/netkingdom-2026-10-14/`. Existing IDs were preserved where valid; the copied Secrets Engine repository-template entry was removed. Registry C/R values retained from older entries remain owner assessments, not renewed evidence. diff --git a/docs/assessments/netkingdom-2026-10-14/local-sources-before.yaml b/docs/assessments/netkingdom-2026-10-14/local-sources-before.yaml new file mode 100644 index 00000000..457f4e6c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/local-sources-before.yaml @@ -0,0 +1,431 @@ +version: 1 +domain: helix_forge +collision_policy: warn +sources: +- repo: activity-core + url: https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: agentic-resources + url: https://forgejo.coulomb.social/coulomb/agentic-resources/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: artifact-store + url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: audit-core + url: https://forgejo.coulomb.social/coulomb/audit-core/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: can-you-assist + url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: citation-engine + url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: citation-evidence + url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: citation-work + url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: config-atlas + url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: infotech + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: coordination-engine + url: https://forgejo.coulomb.social/coulomb/coordination-engine/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: core-hub + url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: domain-tree + url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: email-connect + url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: evidence-anchor + url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: evidence-binder + url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: evidence-source + url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: feature-control + url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: access-engine + url: https://forgejo.coulomb.social/coulomb/access-engine/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: guide-board + url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: helix-forge + url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: hub-core + url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: human-resources + url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: commerce-canon + url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: ihp-railiance-probe + url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: info-tech-canon + url: https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: infospace-bench + url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: issue-core + url: https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: kaizen-agentic + url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: key-cape + url: https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: kontextual-engine + url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: llm-connect + url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-filter + url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-main + url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-quarkdown + url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-tool + url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: net-kingdom + url: https://forgejo.coulomb.social/coulomb/net-kingdom/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: open-cmis-tck + url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: open-reuse + url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: ops-bridge + url: https://forgejo.coulomb.social/coulomb/ops-bridge/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: ops-hub + url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: ops-warden + url: https://forgejo.coulomb.social/coulomb/ops-warden/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: phase-memory + url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: railiance-apps + url: https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: railiance-cluster + url: https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: railiance-enablement + url: https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: railiance-fabric + url: https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: railiance-forge + url: https://forgejo.coulomb.social/coulomb/railiance-forge/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: railiance-infra + url: https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: railiance-platform + url: https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: repo-scoping + url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: repo-seed + url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: reuse-surface + # Include this checkout's entries in local plan-check before publication. + index: registry/indexes/capabilities.yaml + enabled: true + required: true + domain: helix_forge + description: Capability registry for helix_forge +- repo: shard-wiki + url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: state-hub + url: https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: tegwick-control + url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: the-custodian + url: https://forgejo.coulomb.social/coulomb/the-custodian/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: user-engine + url: https://forgejo.coulomb.social/coulomb/user-engine/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: vantage-point + url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: vergabe-teilnahme + url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: whynot-control + url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: whynot-design + url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization diff --git a/docs/assessments/netkingdom-2026-10-14/local-sources.yaml b/docs/assessments/netkingdom-2026-10-14/local-sources.yaml new file mode 100644 index 00000000..02a3e229 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/local-sources.yaml @@ -0,0 +1,577 @@ +version: 1 +domain: helix_forge +collision_policy: warn +sources: +- repo: access-engine + index: ../access-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: activity-core + index: ../activity-core/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: agentic-resources + index: ../agentic-resources/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: approval-engine + index: ../approval-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: artifact-store + url: https://forgejo.coulomb.social/coulomb/artifact-store/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: audit-core + index: ../audit-core/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: can-you-assist + url: https://forgejo.coulomb.social/coulomb/can-you-assist/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: citation-engine + url: https://forgejo.coulomb.social/coulomb/citation-engine/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: citation-evidence + url: https://forgejo.coulomb.social/coulomb/citation-evidence/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: citation-work + url: https://forgejo.coulomb.social/coulomb/citation-work/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: commerce-canon + url: https://forgejo.coulomb.social/coulomb/commerce-canon/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: config-atlas + url: https://forgejo.coulomb.social/coulomb/config-atlas/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: infotech + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: coordination-engine + index: ../coordination-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: core-hub + url: https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: domain-tree + url: https://forgejo.coulomb.social/coulomb/domain-tree/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: email-connect + url: https://forgejo.coulomb.social/coulomb/email-connect/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: emergent-security + index: ../emergent-security/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: evidence-anchor + url: https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: evidence-binder + url: https://forgejo.coulomb.social/coulomb/evidence-binder/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: evidence-source + url: https://forgejo.coulomb.social/coulomb/evidence-source/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: feature-control + url: https://forgejo.coulomb.social/coulomb/feature-control/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: fin-hub + index: ../fin-hub/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: gate-house + index: ../gate-house/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: glas-harness + index: ../glas-harness/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: guide-board + url: https://forgejo.coulomb.social/coulomb/guide-board/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: helix-forge + url: https://forgejo.coulomb.social/coulomb/helix-forge/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: hub-core + url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: human-resources + url: https://forgejo.coulomb.social/coulomb/human-resources/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: ihp-railiance-probe + url: https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: info-tech-canon + index: ../info-tech-canon/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: informed-decision + index: ../informed-decision/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: infospace-bench + url: https://forgejo.coulomb.social/coulomb/infospace-bench/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: issue-core + index: ../issue-core/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: kaizen-agentic + url: https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: key-cape + index: ../key-cape/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: kings-guard + index: ../kings-guard/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: kontextual-engine + url: https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: llm-connect + url: https://forgejo.coulomb.social/coulomb/llm-connect/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-filter + url: https://forgejo.coulomb.social/coulomb/markitect-filter/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-main + url: https://forgejo.coulomb.social/coulomb/markitect-main/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-quarkdown + url: https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: markitect-tool + url: https://forgejo.coulomb.social/coulomb/markitect-tool/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: maturity-engine + index: ../maturity-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: net-kingdom + index: ../net-kingdom/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: open-cmis-tck + url: https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: open-reuse + url: https://forgejo.coulomb.social/coulomb/open-reuse/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: ops-bridge + index: ../ops-bridge/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: ops-hub + url: https://forgejo.coulomb.social/coulomb/ops-hub/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: ops-mason + index: ../ops-mason/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: ops-warden + index: ../ops-warden/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: phase-memory + url: https://forgejo.coulomb.social/coulomb/phase-memory/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: policy-nexus + index: ../policy-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rail-knative + index: ../rail-knative/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rail-kubernetes + index: ../rail-kubernetes/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-apps + index: ../railiance-apps/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-bootstrap + index: ../railiance-bootstrap/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-cluster + index: ../railiance-cluster/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-enablement + index: ../railiance-enablement/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-fabric + index: ../railiance-fabric/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-forge + index: ../railiance-forge/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-infra + index: ../railiance-infra/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-master + index: ../railiance-master/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-platform + index: ../railiance-platform/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: railiance-telemetry + index: ../railiance-telemetry/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-openbao + index: ../rapp-openbao/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-playwright + index: ../rapp-playwright/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-policy-nexus + index: ../rapp-policy-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-postgres + index: ../rapp-postgres/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-sbom-nexus + index: ../rapp-sbom-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-telemetry + index: ../rapp-telemetry/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-tenant-engine + index: ../rapp-tenant-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rapp-user-engine + index: ../rapp-user-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: reef-railiance + index: ../reef-railiance/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rein-aharness + index: ../rein-aharness/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: rein-openweights + index: ../rein-openweights/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: repo-manager + index: ../repo-manager/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: repo-scoping + url: https://forgejo.coulomb.social/coulomb/repo-scoping/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: repo-seed + url: https://forgejo.coulomb.social/coulomb/repo-seed/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: resource-control + index: ../resource-control/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: reuse-surface + index: ../reuse-surface/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: risk-nexus + index: ../risk-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: role-engine + index: ../role-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: runbook-tutorials + index: ../runbook-tutorials/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: sand-boxer + index: ../sand-boxer/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: sbom-nexus + index: ../sbom-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: secrets-engine + index: ../secrets-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: security-canon + index: ../security-canon/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: shard-wiki + url: https://forgejo.coulomb.social/coulomb/shard-wiki/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: state-hub + index: ../state-hub/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: tegwick-control + url: https://forgejo.coulomb.social/coulomb/tegwick-control/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: tenant-engine + index: ../tenant-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: the-custodian + index: ../the-custodian/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: user-engine + index: ../user-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: vantage-point + url: https://forgejo.coulomb.social/coulomb/vantage-point/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: vergabe-teilnahme + url: https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: whitehat-security + index: ../whitehat-security/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech +- repo: whynot-control + url: https://forgejo.coulomb.social/coulomb/whynot-control/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: whynot-design + url: https://forgejo.coulomb.social/coulomb/whynot-design/raw/main/registry/indexes/capabilities.yaml + enabled: true + required: false + domain: helix_forge + cache_ttl_seconds: 86400 + auth_header: Authorization +- repo: zone-engine + index: ../zone-engine/registry/indexes/capabilities.yaml + enabled: true + required: true + domain: infotech diff --git a/docs/assessments/netkingdom-2026-10-14/prepare_local_federation.py b/docs/assessments/netkingdom-2026-10-14/prepare_local_federation.py new file mode 100644 index 00000000..901cc557 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/prepare_local_federation.py @@ -0,0 +1,17 @@ +from pathlib import Path +import hashlib,json,sys,yaml +sys.path.insert(0,'/home/worsch/reuse-surface') +from reuse_surface.federation import compose_federated_index +OUT=Path(__file__).resolve().parent;ROOT=Path('/home/worsch/reuse-surface') +v=json.loads((OUT/'full-inventory.json').read_text());src=ROOT/'registry/federation/sources.yaml';old=yaml.safe_load(src.read_text()) +sources={s['repo']:s for s in old['sources']} +for n in v['repositories']: + sources[n]={'repo':n,'index':f'../{n}/registry/indexes/capabilities.yaml','enabled':True,'required':True,'domain':'infotech'} +manifest={**old,'sources':sorted(sources.values(),key=lambda s:s['repo'])} +(OUT/'local-sources-before.yaml').write_bytes(src.read_bytes());(OUT/'local-sources.yaml').write_text(yaml.safe_dump(manifest,sort_keys=False)) +federated,warnings=compose_federated_index(manifest,cache_dir=Path('/tmp/netkingdom-reuse-federation-cache')) +counts={r['id']:sum(c['id']==r['id'] for c in federated['capabilities']) for r in v['capabilities']} +receipt={'source_count':len(sources),'reviewed_count':len(counts),'all_exactly_once':all(n==1 for n in counts.values()),'warnings':warnings,'previous_sources_sha256':hashlib.sha256(src.read_bytes()).hexdigest(),'scope':'Workstation local federation. Existing unrelated sources preserved; hosted registration is separate.'} +(OUT/'local-default-federation-receipt.json').write_text(json.dumps(receipt,indent=2)+'\n') +(OUT/'local-default-federated.yaml').write_text(yaml.safe_dump(federated,sort_keys=False)) +print(json.dumps(receipt,indent=2));assert receipt['all_exactly_once'] diff --git a/docs/assessments/netkingdom-2026-10-14/prepare_registry.py b/docs/assessments/netkingdom-2026-10-14/prepare_registry.py new file mode 100644 index 00000000..f38bc66b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/prepare_registry.py @@ -0,0 +1,122 @@ +"""Prepare exact registry edits for review. Does not mutate owner repositories.""" +from pathlib import Path +import json, hashlib, sys, copy +import yaml +sys.path.insert(0,'/home/worsch/reuse-surface') +from reuse_surface.registry import parse_front_matter,entry_vector +from reuse_surface.cli import _run_validate +BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent; STAGE=OUT/'registry-stage' +data=json.loads((OUT/'inventory.json').read_text()); rows=data['capabilities'] +CASES={ +'U01':'Architect composes a security deployment from explicit owner contracts and case types', +'U02':'Human signs in with MFA and manages account or factor recovery', +'U03':'Application combines identity, tenant and resource facts and enforces a bound decision', +'U04':'Protected operation obtains and consumes exact human approval before its side effect', +'U05':'Operator provisions and delivers a scoped workload credential through the approved owner lane', +'U06':'Operator or automation obtains a bounded SSH certificate and maintains private connectivity', +'U07':'Owner inventories, rotates, revokes and detects exposure of credentials', +'U08':'Consumer emits security events and reconciles independently retained evidence', +'U09':'Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes', +'U10':'Operator recovers identity, custody or data with independently held recovery material', +'U11':'Agent executes an attributable bounded task and supplies supervision evidence', +'U12':'Developer builds and publishes through controlled source, dependency and runner paths', +'U13':'Platform owner deploys and rolls back a workload with explicit substrate and custody bindings', +'U14':'Framework adopter validates and reuses selected contracts, tools and reference compositions', +} +# Adjacencies express interfaces, not a claim that every edge is natively admitted. +NEIGHBORS={ +'net-kingdom':['security-canon','gate-house','key-cape','access-engine','reuse-surface'], +'key-cape':['user-engine','tenant-engine','access-engine'], +'user-engine':['key-cape','tenant-engine','access-engine','audit-core'], +'access-engine':['approval-engine','key-cape','tenant-engine','zone-engine','maturity-engine'], +'approval-engine':['access-engine','key-cape','secrets-engine','audit-core'], +'secrets-engine':['approval-engine','access-engine','railiance-platform','ops-warden'], +'ops-warden':['secrets-engine','access-engine','ops-bridge','ops-mason'], +'ops-mason':['secrets-engine','net-kingdom','railiance-platform'], +'audit-core':['approval-engine','tenant-engine','kings-guard','railiance-telemetry'], +'kings-guard':['maturity-engine','audit-core','risk-nexus','net-kingdom'], +'maturity-engine':['gate-house','access-engine','kings-guard'], +'whitehat-security':['gate-house','audit-core','approval-engine'], +'emergent-security':['net-kingdom','gate-house','glas-harness'], +'informed-decision':['approval-engine','access-engine','state-hub'], +'policy-nexus':['net-kingdom','security-canon','risk-nexus'], +'glas-harness':['sand-boxer','rein-aharness','rein-openweights'], +'agentic-resources':['glas-harness','activity-core','fin-hub'], +'repo-manager':['railiance-forge','sbom-nexus','state-hub'], +'railiance-forge':['repo-manager','railiance-enablement','railiance-apps'], +'railiance-platform':['rapp-openbao','rapp-postgres','key-cape','secrets-engine'], +'railiance-telemetry':['rapp-telemetry','audit-core','kings-guard'], +'rapp-telemetry':['railiance-telemetry','rail-kubernetes','reef-railiance'], +'fin-hub':['resource-control','agentic-resources'], +} +primary={} +for r in rows: primary.setdefault(r['repo'],r['id']) +changes=[]; validation=[] +def stage(repo,rel,content): + dst=STAGE/repo/rel;dst.parent.mkdir(parents=True,exist_ok=True); dst.write_text(content) + src=BASE/repo/rel + if src.exists(): + baseline=OUT/'registry-before'/repo/rel;baseline.parent.mkdir(parents=True,exist_ok=True);baseline.write_bytes(src.read_bytes()) + if not src.exists() or src.read_bytes()!=dst.read_bytes(): + changes.append({'repo':repo,'path':rel,'before_sha256':hashlib.sha256(src.read_bytes()).hexdigest() if src.exists() else None,'after_sha256':hashlib.sha256(dst.read_bytes()).hexdigest(),'operation':'write'}) +for repo,rv in data['repositories'].items(): + root=BASE/repo; rs=[r for r in rows if r['repo']==repo] + ix=copy.deepcopy(rv['existing_index'] or {'version':1,'domain':'infotech','capabilities':[]}) + marker=root/'registry/NO_CAPABILITIES.md' + if marker.exists(): changes.append({'repo':repo,'path':'registry/NO_CAPABILITIES.md','before_sha256':hashlib.sha256(marker.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'}) + ix['updated']='2026-10-14';ix.setdefault('version',1);ix.setdefault('domain','infotech') + # Include unchanged sibling entries in staged validation without rewriting them. + for p in (root/'registry/capabilities').glob('*.md'): + if repo=='secrets-engine' and parse_front_matter(p).get('id')=='capability.infotech.repo-template': + changes.append({'repo':repo,'path':str(p.relative_to(root)),'before_sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'}) + ix['capabilities']=[c for c in ix['capabilities'] if c['id']!='capability.infotech.repo-template'];continue + dst=STAGE/repo/p.relative_to(root);dst.parent.mkdir(parents=True,exist_ok=True);dst.write_bytes(p.read_bytes()) + for r in rs: + rel=r['existing_entry_path'] or f"registry/capabilities/{r['id']}.md" + try: old=parse_front_matter(root/rel) if (root/rel).exists() else {} + except (ValueError,yaml.YAMLError): + try: old=yaml.safe_load((root/rel).read_text()[4:]) + except yaml.YAMLError: old={} + valid_old='maturity' in old and 'external_evidence' in old + fm=copy.deepcopy(old) if valid_old else {'id':r['id'],'owner':repo,'status':'draft','domain':'infotech','maturity':{'discovery':{'current':'D3','target':'D5','confidence':'medium'},'availability':{'current':r['availability'],'target':r['availability'],'confidence':'medium'}},'external_evidence':{'completeness':{'level':'C1','confidence':'low','basis':'Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review.'},'reliability':{'level':'R0','confidence':'low','basis':'No longitudinal consumer reliability measurement established by this review.'}}} + fm.pop('consumption_modes',None) + fm.update(name=r['name'],summary=r['surface']+'.',owner=repo) + fm['tags']=list(dict.fromkeys(fm.get('tags',[])+['security','netkingdom','framework-reuse'])) + if old.get('external_evidence'): + for key in ['completeness','reliability']: + if key in old['external_evidence']: fm['external_evidence'][key]=old['external_evidence'][key] + fm['external_evidence'].setdefault('reliability',{'level':'R0','confidence':'low','basis':'No longitudinal reliability assessment available.'}) + previous=entry_vector(fm) + fm['maturity']['availability']['current']=r['availability'] + if int(fm['maturity']['availability'].get('target',r['availability'])[1:]) + Provide inspectable authorization decisions between verified identity and + protected resources using policy-as-code. + includes: + - policy evaluation + - authorization registry + - decision explainability + excludes: + - identity issuance + - authentication protocols + use_cases: [] + +availability: + current_level: A2 + target_level: A5 + current_artifacts: + - flex-auth/ + consumption_modes: + - source module + +relations: + depends_on: + - capability.identity.subject-resolution + related_to: + - capability.feature-control.evaluate + +consumer_guidance: + recommended_for: + - planning authorization layer between identity and resources + not_recommended_for: + - feature visibility toggles without policy intent + known_limitations: + - maturity evidence is registry-external today +--- + +# Authorization Policy Evaluation + +Policy evaluation from flex-auth sits between identity resolution and protected +systems. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..6784c9b4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/access-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-06-16' +domain: helix_forge +capabilities: +- id: capability.authorization.policy-evaluate + name: Authorization Policy Evaluation + summary: Evaluate access decisions from policy-as-code rules for subjects, resources, + and actions. + vector: D4 / A2 / C2 / R1 + domain: helix_forge + status: draft + owner: flex-auth + path: registry/capabilities/capability.authorization.policy-evaluate.md + tags: + - authorization + - policy + - flex-auth + consumption_modes: + - source module diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/capabilities/capability.activity.event-coordinate.md b/docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/capabilities/capability.activity.event-coordinate.md new file mode 100644 index 00000000..fd0037a0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/capabilities/capability.activity.event-coordinate.md @@ -0,0 +1,77 @@ +--- +id: capability.activity.event-coordinate +name: Organizational Event Coordination +summary: Coordinate structured responses to cross-domain events through activity workflows and automation. +owner: activity-core +status: draft +domain: helix_forge +tags: [activity, coordination, automation] + +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: activity-core INTENT defines org-wide event response boundary. + availability: + current: A1 + target: A4 + confidence: low + rationale: Conceptual workflows exist; consumable API surface still emerging. + +external_evidence: + completeness: + level: C1 + name: Fragmentary + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - problem and boundary documented in INTENT + broken_expectations: + - no registry-native automation artifacts indexed yet + out_of_scope_expectations: + - owning domain-specific business logic + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: [] + +discovery: + intent: > + Give the organization a structural home for responding to events across repos + and domains in an auditable, automation-ready way. + includes: + - event-triggered coordination + - cross-domain maintenance workflows + excludes: + - single-repo cron replacements only + use_cases: [] + +availability: + current_level: A1 + target_level: A4 + current_artifacts: + - activity-core/INTENT.md + consumption_modes: + - informational + +relations: + depends_on: [] + related_to: + - capability.statehub.workstream-coordinate + - capability.audit.event-retain + +consumer_guidance: + recommended_for: + - planning org-wide event response patterns + not_recommended_for: + - assuming production automation is available + known_limitations: + - early discovery stage +--- + +# Organizational Event Coordination + +activity-core coordinates how the org responds to events—not the domain logic +inside each repo. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..ded089e3 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/activity-core/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-06-16' +domain: helix_forge +capabilities: +- id: capability.activity.event-coordinate + name: Organizational Event Coordination + summary: Coordinate structured responses to cross-domain events through activity + workflows and automation. + vector: D3 / A1 / C1 / R0 + domain: helix_forge + status: draft + owner: activity-core + path: registry/capabilities/capability.activity.event-coordinate.md + tags: + - activity + - coordination + - automation + consumption_modes: + - informational diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/NO_CAPABILITIES.md b/docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/NO_CAPABILITIES.md new file mode 100644 index 00000000..60aa0019 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/NO_CAPABILITIES.md @@ -0,0 +1,15 @@ +--- +repo: agentic-resources +reason: > + INTENT/SCOPE are aspirational HR-for-agents vision prose; no src/, no package manifest — vision-stage only, nothing implemented to reuse. +reviewed: "2026-07-06" +reviewed_by: claude-code +revisit: > + Revisit once an implementation exists (src/ or package manifest lands). +--- + +# No reusable capability + +This repo was reviewed for the `reuse-surface` capability registry +(REUSE-WP-0017 coverage campaign) and has no capability to register at this +time. See the `reason` field above. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..f944e472 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/agentic-resources/registry/indexes/capabilities.yaml @@ -0,0 +1,4 @@ +version: 1 +updated: '2026-06-16' +domain: helix_forge +capabilities: [] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/capabilities/capability.audit.event-retain.md b/docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/capabilities/capability.audit.event-retain.md new file mode 100644 index 00000000..a5055a5f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/capabilities/capability.audit.event-retain.md @@ -0,0 +1,88 @@ +--- +id: capability.audit.event-retain +name: Audit Event Retention +summary: Collect, normalize, retain, and search audit events with integrity evidence across tenants. +owner: audit-core +status: production +domain: infotech +tags: [audit, retention, compliance] +joins: + itc_cap: operations.audit + provision: data/capability/audit-core-operational.json + provision_maturity: D4 + +external_evidence: + completeness: + level: C3 + name: Substantial + confidence: medium + basis: live_receiver_and_restore_walk + satisfied_expectations: + - HTTP ingest through the backend contract + - append-only Postgres custody on platform-pg + - recovery cited to the live platform data.backup provision + broken_expectations: + - data.archive sink not provided + out_of_scope_expectations: + - application business audit semantics ownership + - booked-cost origination + reliability: + level: R2 + confidence: medium + basis: failure_matrix_and_restore_walk + known_reliability_risks: + - single replica + +discovery: + intent: > + Provide independent audit fabric for collecting, retaining, searching, and + proving integrity of audit events. + includes: + - audit ingestion + - retention policy + - search and export + - tamper evidence + excludes: + - generating domain business events + - procuring or operating platform backup + - booked financial facts + use_cases: [] + +availability: + current_level: A4 + target_level: A5 + current_artifacts: + - audit-core/deploy/audit-core.yaml + - audit-core/audit_core/postgres_backend.py + - rapp-postgres/consumers/audit-core.yaml + consumption_modes: + - http ingest + - source module + +relations: + depends_on: [] + related_to: + - capability.activity.event-coordinate + - capability.statehub.progress-log + uses_provisions: + - data.transactional (rapp-postgres/platform-pg) + - data.backup (resource:platform:audit-storage, cited) + - security.secrets (OpenBao / ESO) + +consumer_guidance: + recommended_for: + - platform and application audit event delivery over POST /v1/events + not_recommended_for: + - treating this store as WORM archive + - replacing application-level logging only + known_limitations: + - recoverable history is the 30-day platform backup window + - no hash-chain or export API yet +--- + +# Audit Event Retention + +Audit Core provides the operational custody layer for audit events. +ITC-CAP join: `operations.audit` at provision maturity D4 +(`data/capability/audit-core-operational.json`). Maturity is not a +property of this abstract capability. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..573e997f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/audit-core/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-08-16' +domain: infotech +capabilities: +- id: capability.audit.event-retain + name: Audit Event Retention + summary: Collect, normalize, retain, and search audit events with integrity evidence + across tenants. + joins: operations.audit + provision: data/capability/audit-core-operational.json + vector: D4 provision / A4 / C3 / R2 + domain: infotech + status: production + owner: audit-core + path: registry/capabilities/capability.audit.event-retain.md + tags: + - audit + - retention + - compliance + consumption_modes: + - http ingest + - source module diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/NO_CAPABILITIES.md b/docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/NO_CAPABILITIES.md new file mode 100644 index 00000000..a626ddb5 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/NO_CAPABILITIES.md @@ -0,0 +1,15 @@ +--- +repo: coordination-engine +reason: > + Ambitious coordination-framework prose in INTENT, but only history/spec/registry dirs exist — no runtime code yet. +reviewed: "2026-07-06" +reviewed_by: claude-code +revisit: > + Revisit once runtime code for the coordination framework lands. +--- + +# No reusable capability + +This repo was reviewed for the `reuse-surface` capability registry +(REUSE-WP-0017 coverage campaign) and has no capability to register at this +time. See the `reason` field above. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..f944e472 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/coordination-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,4 @@ +version: 1 +updated: '2026-06-16' +domain: helix_forge +capabilities: [] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/glas-harness/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/glas-harness/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..f944e472 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/glas-harness/registry/indexes/capabilities.yaml @@ -0,0 +1,4 @@ +version: 1 +updated: '2026-06-16' +domain: helix_forge +capabilities: [] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md b/docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md new file mode 100644 index 00000000..2c22ddaa --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md @@ -0,0 +1,120 @@ +--- +id: capability.infotech.canon-service +name: InfoTechCanon Service Surface +summary: Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon + information-processing infospace, backed by infospace-bench. +owner: info-tech-canon +status: draft +domain: infotech +tags: +- canon +- infospace +- service +maturity: + discovery: + current: D2 + target: D4 + confidence: medium + rationale: README documents a working CLI surface (inspect, artifacts, models, standards, review-kit, + alignment-template, validate, graph) over one concrete infospace under infospace/. + availability: + current: A2 + target: A3 + confidence: medium + rationale: Runnable today via `PYTHONPATH=src python3 -m info_tech_canon ...`; includes a read-only + local HTTP API in addition to the CLI. +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - CLI commands for inspect/artifacts/models/standards/review-kit/alignment-template/validate/graph + - read-only local HTTP API + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - depends on infospace-bench for artifact loading/checks/graph summaries; only one concrete infospace + implemented so far +discovery: + intent: Provide a small, concrete service surface over one InfoTechCanon infospace so the canon corpus + is usable via CLI, importable functions, or a read-only API, not just documentation. + includes: + - JSON-first CLI over the infospace + - importable Python service functions + - read-only local HTTP API + excludes: + - the underlying infospace-bench workspace/evaluation tooling itself (separate capability) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - Python package (`info_tech_canon`) + target_artifacts: [] + consumption_modes: + - cli + - library import + - http api (read-only, local) +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - consumers wanting programmatic or CLI access to the InfoTechCanon infospace + not_recommended_for: + - needs requiring a writable or hosted API + known_limitations: + - only one concrete infospace implemented under infospace/ so far +promotion_history: [] +--- + +# InfoTechCanon Service Surface + +## Overview + +`info-tech-canon` implements a concrete service surface over one InfoTechCanon infospace: a JSON-first CLI, importable Python functions, and a read-only local HTTP API, backed by artifact loading and graph summaries from `infospace-bench`. + +## Assessment notes + +### Discovery + +README documents a working CLI surface (inspect, artifacts, models, standards, review-kit, alignment-template, validate, graph) over one concrete infospace under infospace/. + +### Availability + +Runnable today via `PYTHONPATH=src python3 -m info_tech_canon ...`; includes a read-only local HTTP API in addition to the CLI. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..9d37b0d8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/info-tech-canon/registry/indexes/capabilities.yaml @@ -0,0 +1,21 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.infotech.canon-service + name: InfoTechCanon Service Surface + summary: Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon + information-processing infospace, backed by infospace-bench. + vector: D2 / A2 / C1 / R0 + domain: infotech + status: draft + owner: info-tech-canon + path: registry/capabilities/capability.infotech.canon-service.md + tags: + - canon + - infospace + - service + consumption_modes: + - cli + - library import + - http api (read-only, local) diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/capabilities/capability.infotech.issue-tracking.md b/docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/capabilities/capability.infotech.issue-tracking.md new file mode 100644 index 00000000..1efc9e5c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/capabilities/capability.infotech.issue-tracking.md @@ -0,0 +1,85 @@ +--- +id: capability.infotech.issue-tracking +name: External Issue Tracker Connector +summary: Backend-agnostic CLI/Python connector to Forgejo (and SQLite cache) + with work-record UUID ↔ external issue mapping. Not the fleet work origin. +owner: issue-core +status: draft +domain: infotech +tags: +- issue-tracking +- connector +- work-record +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: INTENT.md, SCOPE.md, CAPABILITY-issue-tracking.yaml, mapping design, + boundary-sync policy, AGENT_INTEGRATION.md. + availability: + current: A2 + target: A3 + confidence: high + rationale: Python package + CLI (list/create/project/map) installable via pip; + mapping store shipped; MCP not yet available. +external_evidence: + completeness: + level: C2 + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - Forgejo + local SQLite backends + - CLI with JSON output; project/map commands + - work_record_uuid optional on TaskSpec + - credential handling via env vars (FORGEJO_TOKEN preferred; GITEA_API_TOKEN deprecated alias; ISSUE_CORE_API_KEY) + broken_expectations: [] + out_of_scope_expectations: + - Fleet task origin / intake promotion (work-record canon) + - Default IssueSink for internal findings (activity-core) + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - manual backend configuration (auto-detect planned) + - no built-in issue locking beyond assignee+state + - inward boundary sync not shipped +discovery: + intent: Project and operate on external issue trackers with a stable link to + work-record UUIDs; never replace file-first work records as coordination substrate. + includes: + - unified Python API and CLI over Forgejo/SQLite issue operations + - work_record_issue_map store + project/map/push-status + - local offline cache and backend sync + - credential handling via environment variables + excludes: + - originating workplans/tasks/intake + - MCP server (planned) + - multi-agent fleet board semantics on Forgejo + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - Python package (`issue_core`) + - '`issue` CLI (including project/map)' + target_artifacts: [] + consumption_modes: + - cli + - library import + - rest (optional `[api]` extra) +relations: + depends_on: [] + supports: [] + related_to: + - capability.activity.event-coordinate +evidence: + documentation: + - INTENT.md + - SCOPE.md + - CAPABILITY-issue-tracking.yaml + - docs/uuid-external-id-mapping.md + - docs/boundary-sync-and-status-mapping.md diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..7be3fce0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/issue-core/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +updated: '2026-07-07' +domain: helix_forge +capabilities: +- id: capability.infotech.issue-tracking + name: Universal Issue Tracking Coordination + summary: Unified Python/CLI interface for issue tracking across Forgejo, GitHub, and GitLab, preventing + direct platform API usage and credential sprawl for coordinating agents. + vector: D4 / A2 / C2 / R1 + domain: infotech + status: draft + owner: issue-core + path: registry/capabilities/capability.infotech.issue-tracking.md + tags: + - issue-tracking + - coordination + - multi-platform + consumption_modes: + - cli + - library import diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/capabilities/capability.iam.key-cape.md b/docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/capabilities/capability.iam.key-cape.md new file mode 100644 index 00000000..0c096ecb --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/capabilities/capability.iam.key-cape.md @@ -0,0 +1,125 @@ +--- +id: capability.iam.key-cape +name: KeyCape Lightweight IAM (NetKingdom Profile) +summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), + orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against + implementation internals. +owner: key-cape +status: draft +domain: infotech +tags: +- iam +- oidc +- netkingdom +- security +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), + explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status + (all 23 workplan tasks, 21 green test packages). + availability: + current: A2 + target: A3 + confidence: high + rationale: README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/` + CI already in place — ahead of most siblings on the Forgejo transition. +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - full v0.1 implementation per its own workplan (23/23 tasks) + - 21 test packages, all green + - documented lightweight-to-expanded (Keycloak) migration path + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - maturity claims rely on the repo's own workplan completion record, not independently re-verified + in this sweep +discovery: + intent: Let applications integrate against a versioned IAM profile contract rather than against Keycape + internals, so migrating from lightweight (Authelia/LLDAP/privacyIDEA) to expanded (Keycloak) mode + is a tested operation, not a rewrite. + includes: + - NetKingdom IAM Profile v0.2 lightweight-mode orchestration (Authelia, LLDAP, privacyIDEA) + - profile-contract conformance + excludes: + - expanded-mode (Keycloak) implementation itself (separate deployment target for the same profile) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - deployable lightweight-mode IAM stack + target_artifacts: [] + consumption_modes: + - service (self-hosted deployment) +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.md + - workplans/KEY-WP-0001-keycape-implementation.md + tests: + - .gitea/workflows/ + - .forgejo/workflows/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - NetKingdom deployments wanting a lightweight, self-hosted IAM profile implementation with a tested + migration path to Keycloak + not_recommended_for: + - deployments already committed to expanded/Keycloak mode + known_limitations: + - v0.1 completion claim not independently re-verified during this coverage sweep +promotion_history: [] +--- + +# KeyCape Lightweight IAM (NetKingdom Profile) + +## Overview + +KeyCape is the lightweight IAM component of NetKingdom, implementing the versioned NetKingdom IAM Profile (OIDC/PKCE) by orchestrating Authelia, LLDAP, and privacyIDEA — the same profile Keycloak implements in expanded-mode deployments, so migration is a tested operation rather than a rewrite. + +## Assessment notes + +### Discovery + +README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), explicit lightweight-vs-expanded (Keycloak) migration story, and a completed implementation status (all 23 workplan tasks, 21 green test packages). + +### Availability + +README states 'Implementation complete (v0.1)'; has both `.gitea/workflows/` and `.forgejo/workflows/` CI already in place — ahead of most siblings on the Forgejo transition. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..af664bf2 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/key-cape/registry/indexes/capabilities.yaml @@ -0,0 +1,21 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.iam.key-cape + name: KeyCape Lightweight IAM (NetKingdom Profile) + summary: Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), + orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not + against implementation internals. + vector: D4 / A2 / C2 / R1 + domain: infotech + status: draft + owner: key-cape + path: registry/capabilities/capability.iam.key-cape.md + tags: + - iam + - oidc + - netkingdom + - security + consumption_modes: + - service (self-hosted deployment) diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md b/docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md new file mode 100644 index 00000000..2064c96c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md @@ -0,0 +1,148 @@ +--- +id: capability.security.iam-tooling-suite +name: NetKingdom Security/IAM Tooling Suite +summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, + deterministic plan-only security scenario composition, and proposal-only posture feedback. +owner: net-kingdom +status: draft +domain: infotech +tags: +- security +- iam +- kubernetes +- conformance +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an explicit + integration boundary with OpenBao, flex-auth, user-engine, ops-warden, ops-bridge, info-tech-canon, + and State Hub; canon/standards/ holds versioned IAM v0.3, playbook capability, scenario composition, + tenancy, zone, and boundary standards that provider repos implement against. + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'No top-level package manifest, but tools/ holds independently documented and runnable + conformance, posture, posture-feedback, scenario-composition, and guarded bootstrap tools; local-identity is separately + packaged and tested.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - versioned canon standards already implemented by a sibling repo (key-cape) + - documented, runnable conformance, posture, composition, and bootstrap tools under tools/ + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - no top-level packaging; each tool under tools/ has its own runtime dependencies, no unified install + path yet +discovery: + intent: Own canonical NetKingdom security semantics and provide executable reference and conformance tooling + so provider implementations can integrate without inferred authority or hidden deployment coupling. + includes: + - canon/standards/ versioned IAM, tenancy, zone, credential, boundary, and composition standards + - IAM profile conformance checker + - playbook capability contract validator + - deterministic plan-only security scenario composer + - tenancy posture schema and validator + - deterministic proposal-only posture feedback evaluator + - security bootstrap console (local, non-secret-collecting) + - packaged local bootstrap identity CLI + excludes: + - concrete IAM implementations themselves (see key-cape for lightweight mode) + - live secret value handling (bootstrap console explicitly refuses live OpenBao initialization) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - tools/iam-profile-conformance + - tools/playbook-capability-contract + - tools/security-scenario-composer + - tools/tenancy-posture + - tools/posture-feedback + - tools/security-bootstrap-console + - local-identity + target_artifacts: [] + consumption_modes: + - cli + - local web ui +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.md + - docs/secrets-engine-security-infrastructure-boundary.md + - tools/*/README.md + tests: + - tools/iam-profile-conformance (pytest fixtures) + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - implementers needing to verify IAM/security conformance against Coulomb's canonical standards + not_recommended_for: + - needs for a packaged, single-install security suite (currently three separate tools) + known_limitations: + - no unified top-level packaging across the three tools +promotion_history: [] +--- + +# NetKingdom Security/IAM Tooling Suite + +## Overview + +`net-kingdom` provides canonical IAM and security architecture, executable +conformance and posture checks, deterministic plan-only scenario composition, +proposal-only posture feedback, a local bootstrap identity package, and a non-secret-collecting security +bootstrap console. Provider implementations remain in sibling repositories such +as `key-cape`; the self-optimizing platform remains an intent rather than a +current delivery claim. + +## Assessment notes + +### Discovery + +SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md describe an +explicit integration boundary with OpenBao, flex-auth, user-engine, ops-warden, +ops-bridge, info-tech-canon, and State Hub. `canon/standards/` holds the current +IAM v0.3 and related boundary, posture, zone, credential, playbook, and scenario +composition standards. + +### Availability + +No top-level package manifest exists. The independently runnable surfaces are +documented under `tools/`, and `local-identity` has its own package manifest and +test environment. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..3a618f71 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/net-kingdom/registry/indexes/capabilities.yaml @@ -0,0 +1,21 @@ +version: 1 +updated: '2026-08-23' +domain: helix_forge +capabilities: +- id: capability.security.iam-tooling-suite + name: NetKingdom Security/IAM Tooling Suite + summary: Canonical security architecture and executable reference tooling for IAM, bootstrap, posture + validation, deterministic plan-only security scenario composition, and proposal-only posture feedback. + vector: D3 / A2 / C1 / R1 + domain: infotech + status: draft + owner: net-kingdom + path: registry/capabilities/capability.security.iam-tooling-suite.md + tags: + - security + - iam + - kubernetes + - conformance + consumption_modes: + - cli + - local web ui diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md new file mode 100644 index 00000000..19f0a295 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md @@ -0,0 +1,122 @@ +--- +id: capability.ops.tunnel-bridge +name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge) +summary: CLI that manages named SSH reverse tunnels keeping remote execution environments connected to + the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events. +owner: ops-bridge +status: draft +domain: infotech +tags: +- ssh +- tunnel +- ops +- connectivity +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: README.txt documents named tunnels, auto-reconnect with exponential backoff, HTTP health + checks, and structured JSON audit events per tunnel; this is also the tool underlying reuse-surface's + own `/bridge` skill. + availability: + current: A2 + target: A3 + confidence: medium + rationale: Ships a `bridge` CLI, installable via pyproject; already actively used to keep remote Claude + Code sessions (COULOMBCORE, Railiance nodes) connected to the State Hub MCP. +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - auto-reconnecting named SSH reverse tunnels + - HTTP health checks confirming forwarded service reachability, not just SSH liveness + - structured audit event log per tunnel + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - operational tool with real production usage but no independent load/failure testing recorded in + this sweep +discovery: + intent: Keep remote execution environments' MCP connectivity to the local State Hub alive and observable + via managed, auto-reconnecting SSH reverse tunnels. + includes: + - named SSH reverse tunnel lifecycle management + - auto-reconnect with exponential backoff + - HTTP health checks + - structured audit event logging + excludes: + - the State Hub or MCP servers themselves (bridge only manages connectivity) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - '`bridge` CLI' + target_artifacts: [] + consumption_modes: + - cli +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.txt + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - any workstation/remote-machine pair needing durable SSH-tunneled MCP or service connectivity + not_recommended_for: + - needs for tunnel types other than SSH reverse port-forwards + known_limitations: + - no independent load/failure testing recorded beyond production usage observations +promotion_history: [] +--- + +# SSH Reverse Tunnel Lifecycle Manager (ops-bridge) + +## Overview + +`ops-bridge` is an SSH reverse tunnel lifecycle manager: a `bridge` CLI that keeps remote execution environments (COULOMBCORE, Railiance nodes) connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit logging per tunnel. + +## Assessment notes + +### Discovery + +README.txt documents named tunnels, auto-reconnect with exponential backoff, HTTP health checks, and structured JSON audit events per tunnel; this is also the tool underlying reuse-surface's own `/bridge` skill. + +### Availability + +Ships a `bridge` CLI, installable via pyproject; already actively used to keep remote Claude Code sessions (COULOMBCORE, Railiance nodes) connected to the State Hub MCP. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..a67521ae --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-bridge/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.ops.tunnel-bridge + name: SSH Reverse Tunnel Lifecycle Manager (ops-bridge) + summary: CLI that manages named SSH reverse tunnels keeping remote execution environments connected + to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events. + vector: D3 / A2 / C2 / R1 + domain: infotech + status: draft + owner: ops-bridge + path: registry/capabilities/capability.ops.tunnel-bridge.md + tags: + - ssh + - tunnel + - ops + - connectivity + consumption_modes: + - cli diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md new file mode 100644 index 00000000..d62d3487 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md @@ -0,0 +1,137 @@ +--- +id: capability.security.ssh-certificate-issuance +name: SSH Certificate Issuance +summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward operational access routing across NetKingdom security lanes. +owner: ops-warden +status: draft +domain: helix_forge +tags: + - ssh + - certificate + - ca + - ops-warden + - openbao + - security + +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: > + SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command + contract are documented; production OpenBao integration is documented but + engine deployment lives in railiance-platform. A machine-readable routing + catalog (registry/routing/catalog.yaml) and wiki/AccessRouting.md make the + "issue SSH, route the rest" boundary discoverable. + availability: + current: A3 + target: A5 + confidence: medium + rationale: > + Installable `warden` CLI and `ops-ssh-wrapper` entry points; ops-bridge and + other callers integrate via cert_command without backend-specific branching. + A `warden route` lookup over the pointer catalog (WARDEN-WP-0011) will move + routing discovery from wiki prose to a structured surface for agents (A3 -> A4). + +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - local and OpenBao/Vault-compatible signing backends + - TTL policy enforcement per actor type + - principals inventory and cert-side scorecard + - signatures audit log and stale-cert cleanup + - cert_command stdout contract for ops-bridge + broken_expectations: + - host-side principal deployment not owned here + - OpenBao SSH engine mount not deployed from this repo + out_of_scope_expectations: + - long-lived API key custody + - tunnel lifecycle management + - Vault/OpenBao cluster operations + reliability: + level: R2 + name: Tolerable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - production signing depends on OpenBao availability and token policy + - local backend requires protected CA key handling by operators + +discovery: + intent: > + Give the ops fleet short-lived SSH credentials for humans, agents, and + automations without static keys, through a single cert_command surface that + callers can rely on regardless of CA backend; route non-SSH credential needs + to the correct NetKingdom subsystems (OpenBao, flex-auth, key-cape). + includes: + - certificate signing for adm, agt, and atm actors + - actor principals inventory and TTL policy + - cert_command interface (`warden sign`) + - cert-side compliance scorecard and signatures log + - ops-ssh-wrapper for automatic cert acquisition + - NetKingdom credential routing and alignment documentation + - machine-readable routing pointer catalog (registry/routing/catalog.yaml) + excludes: + - tunnel lifecycle + - host /etc/ssh/auth_principals deployment + - OpenBao or Vault cluster setup + - long-lived secret storage + assumptions: + - callers supply actor public keys; humans self-issue admin keys + - production platform uses OpenBao with Vault-compatible SSH engine API + use_cases: + - ops-bridge tunnel cert_command + - Inter-Hub bootstrap short-lived agent access + research_memos: + - ops-warden/SCOPE.md + - ops-warden/wiki/CertCommandInterface.md + - ops-warden/wiki/OpsWardenConfig.md + - ops-warden/wiki/AccessRouting.md + +availability: + current_level: A3 + target_level: A5 + current_artifacts: + - ops-warden/src/warden/ + - ops-warden/wiki/CertCommandInterface.md + - ops-warden/wiki/OpsWardenConfig.md + target_artifacts: + - packaged ops-warden release with documented OpenBao role bootstrap + - "`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)" + consumption_modes: + - CLI + - cert_command subprocess + +relations: + depends_on: [] + supports: [] + related_to: [] + +consumer_guidance: + recommended_for: + - issuing short-lived SSH certs for ops-bridge tunnels + - agent or automation access with TTL-bound principals + - checking cert-side compliance before rotation windows + - orienting dev workers on which NetKingdom subsystem owns each credential type + not_recommended_for: + - storing OpenRouter or Inter-Hub API keys + - replacing OpenBao deployment or host SSH hardening playbooks + - static-key-only legacy access (use ops-bridge static key mode instead) + known_limitations: + - "VaultCA backend config key remains backend: vault for API compatibility" + - host-side scorecard checks live in railiance-infra +--- + +# SSH Certificate Issuance + +ops-warden is the custodian-domain SSH CA tool. It signs short-lived certificates, +maintains the actor inventory, and exposes `warden sign` as the cert_command +contract for ops-bridge and other callers. + +Production environments point the vault-compatible backend at OpenBao; labs use +the local ssh-keygen CA backend without platform dependencies. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..218a9ab0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/ops-warden/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-06-17' +domain: helix_forge +capabilities: +- id: capability.security.ssh-certificate-issuance + name: SSH Certificate Issuance + summary: Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors + through a stable cert_command CLI interface; steward NetKingdom operational access routing. + vector: D4 / A3 / C3 / R2 + domain: helix_forge + status: draft + owner: ops-warden + path: registry/capabilities/capability.security.ssh-certificate-issuance.md + tags: + - ssh + - certificate + - ca + - ops-warden + - openbao + - security + consumption_modes: + - CLI + - cert_command subprocess \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md new file mode 100644 index 00000000..4e64f96e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md @@ -0,0 +1,127 @@ +--- +id: capability.railiance.workload-deployment-tooling +name: Railiance Application Workload Deployment Tooling +summary: S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack — application Helm releases, + Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services. +owner: railiance-apps +status: draft +domain: financials +tags: +- railiance +- kubernetes +- helm +- deployment +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: SCOPE.md places this repo precisely in the Railiance OAS Stack layering (S5), scoped to + application Helm releases, workload manifests, and operator runbooks for user-facing services such + as vergabe-teilnahme. + availability: + current: A2 + target: A3 + confidence: medium + rationale: No top-level package manifest, but ships real, runnable tooling under tools/ (build-database-url-secret.sh, + check-oci-image.sh, check-sops.sh, forgejo-smoke.sh, inter-hub-smoke.sh, k8s-server-dry-run.sh, + smoke-service.sh) plus charts/ and manifests/; has both .gitea and .forgejo CI already. +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - Helm charts and Kubernetes manifests for application workloads + - smoke-test and dry-run check scripts, including a forgejo-smoke.sh already ahead of the platform-wide + Forgejo transition + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - no top-level packaging; tooling is a collection of shell scripts under tools/ +discovery: + intent: 'Own the S5 layer of the Railiance OAS Stack: deploying and verifying user-facing application + workloads via Helm/Kubernetes with guardrails and operator runbooks.' + includes: + - application Helm releases and Kubernetes workload manifests + - deployment guardrails + - smoke-test and dry-run tooling (including forgejo-smoke.sh) + excludes: + - cluster/platform substrate (see railiance-cluster, railiance-platform) + - CI/CD enablement templates (see railiance-enablement) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - Helm charts + - Kubernetes manifests + - tools/*.sh smoke and check scripts + target_artifacts: [] + consumption_modes: + - cli (shell scripts) + - helm/kubernetes deployment +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - SCOPE.md + tests: + - tools/forgejo-smoke.sh + - tools/inter-hub-smoke.sh + - tools/k8s-server-dry-run.sh + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - operators deploying or verifying Railiance user-facing application workloads + not_recommended_for: + - needs at the cluster/platform substrate layer (see railiance-cluster, railiance-platform) + known_limitations: + - no unified packaging; tooling is a set of independent shell scripts +promotion_history: [] +--- + +# Railiance Application Workload Deployment Tooling + +## Overview + +`railiance-apps` is the S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack: Helm releases, Kubernetes workload manifests, deployment guardrails, and operator runbooks for user-facing services such as `vergabe-teilnahme`, including a `forgejo-smoke.sh` check already ahead of the platform-wide Gitea-to-Forgejo transition. + +## Assessment notes + +### Discovery + +SCOPE.md places this repo precisely in the Railiance OAS Stack layering (S5), scoped to application Helm releases, workload manifests, and operator runbooks for user-facing services such as vergabe-teilnahme. + +### Availability + +No top-level package manifest, but ships real, runnable tooling under tools/ (build-database-url-secret.sh, check-oci-image.sh, check-sops.sh, forgejo-smoke.sh, inter-hub-smoke.sh, k8s-server-dry-run.sh, smoke-service.sh) plus charts/ and manifests/; has both .gitea and .forgejo CI already. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..38b1f911 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-apps/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.railiance.workload-deployment-tooling + name: Railiance Application Workload Deployment Tooling + summary: S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack — application Helm releases, + Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing + services. + vector: D3 / A2 / C1 / R1 + domain: financials + status: draft + owner: railiance-apps + path: registry/capabilities/capability.railiance.workload-deployment-tooling.md + tags: + - railiance + - kubernetes + - helm + - deployment + consumption_modes: + - cli (shell scripts) + - helm/kubernetes deployment diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-bootstrap/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-bootstrap/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..f944e472 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-bootstrap/registry/indexes/capabilities.yaml @@ -0,0 +1,4 @@ +version: 1 +updated: '2026-06-16' +domain: helix_forge +capabilities: [] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md new file mode 100644 index 00000000..b1e3b8a7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md @@ -0,0 +1,122 @@ +--- +id: capability.railiance.cluster-bootstrap +name: Railiance Cluster Runtime Bootstrap +summary: 'Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare + Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.' +owner: railiance-cluster +status: draft +domain: financials +tags: +- railiance +- kubernetes +- iac +- bootstrap +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: README documents the 'Rails for Ops' convention-over-configuration philosophy and a concrete + quick-start (clone, from two bare servers rebuild a full k8s environment); has .forgejo CI already + in place. + availability: + current: A2 + target: A3 + confidence: medium + rationale: Real Python package (pyproject, requires-python >=3.11) plus bin/railiance CLI and ansible + playbooks (bootstrap/harden), with a documented quick-start path. +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - documented quick-start from two bare servers to a running Kubernetes environment + - bootstrap/harden ansible playbooks + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - reproducibility claims not independently re-verified (no live bootstrap run during this sweep) +discovery: + intent: 'Provide the cluster runtime entry point for Railiance: reproducible, self-reliant Kubernetes + environment bootstrap from bare servers via convention-over-configuration IaC.' + includes: + - cluster bootstrap CLI and ansible playbooks (bootstrap/harden) + - Kubernetes-based environment rebuild path + excludes: + - application workload deployment (see railiance-apps) + - platform services like Postgres/Valkey (see railiance-platform) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - '`railiance` CLI (bin/railiance)' + - ansible playbooks + target_artifacts: [] + consumption_modes: + - cli + - ansible playbook +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.md + tests: + - tests/ + - .forgejo/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - operators bootstrapping a new Railiance Kubernetes cluster from bare servers + not_recommended_for: + - application-level or platform-service deployment (see railiance-apps, railiance-platform) + known_limitations: + - reproducibility not independently re-verified via a live bootstrap run in this sweep +promotion_history: [] +--- + +# Railiance Cluster Runtime Bootstrap + +## Overview + +`railiance-cluster` is the cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, it rebuilds a fully automated Kubernetes-based environment via convention-over-configuration IaC (Terraform/cloud-init/Ansible-adjacent tooling, `railiance` CLI). + +## Assessment notes + +### Discovery + +README documents the 'Rails for Ops' convention-over-configuration philosophy and a concrete quick-start (clone, from two bare servers rebuild a full k8s environment); has .forgejo CI already in place. + +### Availability + +Real Python package (pyproject, requires-python >=3.11) plus bin/railiance CLI and ansible playbooks (bootstrap/harden), with a documented quick-start path. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..f235a350 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-cluster/registry/indexes/capabilities.yaml @@ -0,0 +1,21 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.railiance.cluster-bootstrap + name: Railiance Cluster Runtime Bootstrap + summary: 'Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare + Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.' + vector: D3 / A2 / C1 / R0 + domain: financials + status: draft + owner: railiance-cluster + path: registry/capabilities/capability.railiance.cluster-bootstrap.md + tags: + - railiance + - kubernetes + - iac + - bootstrap + consumption_modes: + - cli + - ansible playbook diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md new file mode 100644 index 00000000..fd762e64 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md @@ -0,0 +1,125 @@ +--- +id: capability.railiance.ci-enablement +name: Railiance Developer Enablement And CI/CD Templates +summary: S4 Developer Enablement layer of the Railiance OAS Stack — reusable CI/CD workflow templates, + developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning + forge runtime. +owner: railiance-enablement +status: draft +domain: financials +tags: +- railiance +- ci-cd +- developer-enablement +- forgejo +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: SCOPE.md places this repo precisely at S4 in the Railiance OAS Stack, explicitly scoped + to reusable CI/CD templates and enablement tooling while using (not owning) forge capabilities. + availability: + current: A2 + target: A3 + confidence: high + rationale: Ships real, reusable Forgejo Actions workflow templates (container-build-push.yaml, container-build-push-multirepo.yaml, + ci-smoke.yaml) plus `tools/promote-repo-to-forgejo.sh` — directly relevant tooling for the ecosystem-wide + Gitea-to-Forgejo transition (REUSE-WP-0019). +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - reusable Forgejo Actions CI/CD workflow templates already in production shape + - a repo-promotion-to-forgejo script directly usable for the platform-wide forge transition + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - templates are workflow YAML, not a packaged/versioned artifact; consumption is copy/reference rather + than dependency-managed +discovery: + intent: Give Railiance repos reusable CI/CD templates and developer-enablement tooling (including forge-promotion + tooling) without each repo owning the forge runtime or runner substrate itself. + includes: + - reusable Forgejo Actions CI/CD workflow templates + - repo-to-forgejo promotion tooling + - developer portal/platform template scope (per SCOPE.md) + excludes: + - forge runtime and runner substrate ownership (see railiance-forge) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - workflows/container-build-push.yaml + - workflows/ci-smoke.yaml + - tools/promote-repo-to-forgejo.sh + target_artifacts: [] + consumption_modes: + - ci workflow template (copy/reference) + - cli (promote-repo-to-forgejo.sh) +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - SCOPE.md + tests: + - workflows/ci-smoke.yaml + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Railiance repos needing reusable Forgejo Actions CI/CD templates, or any repo executing a Gitea-to-Forgejo + promotion + not_recommended_for: + - needs for owning forge runtime/runner infrastructure itself (see railiance-forge) + known_limitations: + - templates are consumed by copy/reference, not as a versioned dependency +promotion_history: [] +--- + +# Railiance Developer Enablement And CI/CD Templates + +## Overview + +`railiance-enablement` is the S4 Developer Enablement layer of the Railiance OAS Stack: reusable CI/CD workflow templates and developer-enablement tooling, including a `promote-repo-to-forgejo.sh` script directly relevant to the ecosystem-wide Gitea-to-Forgejo transition tracked in REUSE-WP-0019. + +## Assessment notes + +### Discovery + +SCOPE.md places this repo precisely at S4 in the Railiance OAS Stack, explicitly scoped to reusable CI/CD templates and enablement tooling while using (not owning) forge capabilities. + +### Availability + +Ships real, reusable Forgejo Actions workflow templates (container-build-push.yaml, container-build-push-multirepo.yaml, ci-smoke.yaml) plus `tools/promote-repo-to-forgejo.sh` — directly relevant tooling for the ecosystem-wide Gitea-to-Forgejo transition (REUSE-WP-0019). + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..6fdd5372 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-enablement/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.railiance.ci-enablement + name: Railiance Developer Enablement And CI/CD Templates + summary: S4 Developer Enablement layer of the Railiance OAS Stack — reusable CI/CD workflow templates, + developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without + owning forge runtime. + vector: D3 / A2 / C2 / R1 + domain: financials + status: draft + owner: railiance-enablement + path: registry/capabilities/capability.railiance.ci-enablement.md + tags: + - railiance + - ci-cd + - developer-enablement + - forgejo + consumption_modes: + - ci workflow template (copy/reference) + - cli (promote-repo-to-forgejo.sh) diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md new file mode 100644 index 00000000..798f15ac --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md @@ -0,0 +1,122 @@ +--- +id: capability.railiance.fabric-graph +name: Railiance Fabric Ecosystem Graph +summary: 'Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, + discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, + repos, deployables, endpoints, ownership, dependencies, and bindings.' +owner: railiance-fabric +status: draft +domain: financials +tags: +- railiance +- graph +- ownership +- discovery +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: README and SCOPE.md document the ecosystem graph model bounded by financial/operational + accountability (who pays, who is accountable), with king/lord/tenant ownership concepts referenced + in docs/FabricDiscoveryAndUpdate.md. + availability: + current: A1 + target: A3 + confidence: medium + rationale: Python package (`railiance-fabric`) providing a declaration loader and validator; consumed + as a library, no hosted service documented yet. +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - ecosystem graph declaration loader and validator + - schemas for services/machines/repos/deployables/endpoints/ownership/dependencies/bindings + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - discovery/rebuild/update-loop architecture documented as still evolving per docs/FabricDiscoveryAndUpdate.md +discovery: + intent: Let repos declare services, capabilities, interfaces, dependencies, and bindings in source-controlled + files, and model the resulting durable infrastructure-responsibility graph across the Railiance ecosystem. + includes: + - ecosystem graph schema and declaration loader/validator + - State Hub export contracts for the graph + excludes: + - actual infrastructure provisioning (see railiance-infra, railiance-cluster) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A1 + target_level: A3 + current_artifacts: + - Python package (`railiance-fabric`) + target_artifacts: [] + consumption_modes: + - library import + - cli (validation) +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.md + - SCOPE.md + - docs/FabricDiscoveryAndUpdate.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Railiance repos wanting to declare their place in the ecosystem ownership/dependency graph + not_recommended_for: + - needs for actual infrastructure provisioning (see railiance-infra/-cluster) + known_limitations: + - discovery/rebuild/update-loop architecture still evolving +promotion_history: [] +--- + +# Railiance Fabric Ecosystem Graph + +## Overview + +`railiance-fabric` models the durable infrastructure-responsibility graph of the Railiance netkingdom — who pays for infrastructure, who is accountable for it, and which durable interfaces create value across boundaries — via schemas, a declaration loader/validator, and State Hub export contracts. + +## Assessment notes + +### Discovery + +README and SCOPE.md document the ecosystem graph model bounded by financial/operational accountability (who pays, who is accountable), with king/lord/tenant ownership concepts referenced in docs/FabricDiscoveryAndUpdate.md. + +### Availability + +Python package (`railiance-fabric`) providing a declaration loader and validator; consumed as a library, no hosted service documented yet. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..b87197e0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-fabric/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.railiance.fabric-graph + name: Railiance Fabric Ecosystem Graph + summary: 'Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, + discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, + repos, deployables, endpoints, ownership, dependencies, and bindings.' + vector: D3 / A1 / C1 / R0 + domain: financials + status: draft + owner: railiance-fabric + path: registry/capabilities/capability.railiance.fabric-graph.md + tags: + - railiance + - graph + - ownership + - discovery + consumption_modes: + - library import + - cli (validation) diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md new file mode 100644 index 00000000..9dc21e27 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md @@ -0,0 +1,129 @@ +--- +id: capability.railiance.forge-infrastructure +name: Railiance Forge And Artifact Infrastructure +summary: Source forge, registry, and automation-runner infrastructure for Railiance, separated out from + railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package + registries, and Actions runner substrate. +owner: railiance-forge +status: draft +domain: financials +tags: +- railiance +- forgejo +- forge +- ci-runner +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: README and SCOPE.md explicitly name 'current Gitea operation, future Forgejo migration, + container and package registries, Actions runner substrate, artifact lifecycle' as the scope; status + noted as 'active forge extraction' with canonical registry operation docs already landed. + availability: + current: A1 + target: A3 + confidence: medium + rationale: README explicitly states 'no live Helm deploy or Kubernetes apply was run as part of the + move' — documentation and operator targets exist, but this repo is mid-extraction; has .gitea CI + (not yet migrated to .forgejo itself, notably, despite owning the migration). +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - scope separation from railiance-apps/railiance-enablement documented + - canonical registry operation docs and runner ownership contracts + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - repo is actively being founded/extracted; no live deploy yet by its own account + - directly relevant to REUSE-WP-0019 but hasn't migrated its own CI to .forgejo/ yet +discovery: + intent: Own source forge, artifact registry, and CI runner substrate responsibilities for Railiance, + separated from application (railiance-apps) and enablement (railiance-enablement) concerns, across + the Gitea-to-Forgejo transition. + includes: + - forge operation (current Gitea, migrating to Forgejo) + - container/package registries + - Actions runner substrate + - artifact lifecycle + excludes: + - application workload deployment (railiance-apps) + - CI/CD templates for consuming repos (railiance-enablement) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A1 + target_level: A3 + current_artifacts: + - operator docs and tools/ (extraction in progress) + target_artifacts: [] + consumption_modes: + - cli (operator tooling) + - documentation/runbooks +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.md + - SCOPE.md + tests: [] + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Railiance operators managing forge/registry/runner infrastructure, especially during the Gitea-to-Forgejo + transition + not_recommended_for: + - treating this as production-stable — the repo's own README states the extraction is active and no + live deploy has run yet + known_limitations: + - actively being founded; no live Helm/k8s deploy has run as part of the extraction yet; own CI still + under .gitea/ pending its own Forgejo migration +promotion_history: [] +--- + +# Railiance Forge And Artifact Infrastructure + +## Overview + +`railiance-forge` is being founded to separate source forge, artifact registry, and CI/Actions runner responsibilities from `railiance-apps` and `railiance-enablement`. It directly owns the current Gitea operation and the future Forgejo migration — of particular relevance to REUSE-WP-0019 — though by its own account no live deploy has run yet. + +## Assessment notes + +### Discovery + +README and SCOPE.md explicitly name 'current Gitea operation, future Forgejo migration, container and package registries, Actions runner substrate, artifact lifecycle' as the scope; status noted as 'active forge extraction' with canonical registry operation docs already landed. + +### Availability + +README explicitly states 'no live Helm deploy or Kubernetes apply was run as part of the move' — documentation and operator targets exist, but this repo is mid-extraction; has .gitea CI (not yet migrated to .forgejo itself, notably, despite owning the migration). + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..64379916 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-forge/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.railiance.forge-infrastructure + name: Railiance Forge And Artifact Infrastructure + summary: Source forge, registry, and automation-runner infrastructure for Railiance, separated out from + railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package + registries, and Actions runner substrate. + vector: D3 / A1 / C1 / R0 + domain: financials + status: draft + owner: railiance-forge + path: registry/capabilities/capability.railiance.forge-infrastructure.md + tags: + - railiance + - forgejo + - forge + - ci-runner + consumption_modes: + - cli (operator tooling) + - documentation/runbooks diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md new file mode 100644 index 00000000..a66ab42e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md @@ -0,0 +1,131 @@ +--- +id: capability.railiance.infra-provisioning +name: RailianceHosts Infrastructure Provisioning +summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, + cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source + of truth. +owner: railiance-infra +status: draft +domain: financials +tags: +- railiance +- terraform +- ansible +- infrastructure +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets + setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) + as source of truth — an unusually complete operational README among the swept repos. + availability: + current: A2 + target: A3 + confidence: high + rationale: Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI + already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack. +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - documented end-to-end quickstart from bare cloud account to converged servers + - SOPS+age encrypted secrets with a documented key-custody model + - inventory/servers.yaml as explicit source of truth + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - reproducibility not independently re-verified via a live provisioning run in this sweep +discovery: + intent: Provision and manage servers on Hosteurope/Hetzner Cloud entirely from Git — Terraform for lifecycle, + cloud-init for first boot, Ansible for convergence — as the S1 Infrastructure Substrate of the Railiance + OAS Stack. + includes: + - Terraform server lifecycle management + - cloud-init first-boot configuration + - Ansible convergence playbooks + - SOPS+age encrypted secrets in-repo + excludes: + - Kubernetes cluster bootstrap on top of provisioned hosts (see railiance-cluster) + - platform services (see railiance-platform) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - Terraform configs + - Ansible playbooks + - scripts/ + - tools/ + target_artifacts: [] + consumption_modes: + - cli (terraform/ansible) + - gitops +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - README.md + - SCOPE.md + tests: + - sbom-tools.yaml + - .forgejo/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - operators provisioning Railiance bare-metal/cloud hosts from Git with encrypted-secret custody + not_recommended_for: + - needs above the OS/host substrate layer (see railiance-cluster for Kubernetes, railiance-platform + for shared services) + known_limitations: + - reproducibility not independently re-verified via a live provisioning run in this sweep +promotion_history: [] +--- + +# RailianceHosts Infrastructure Provisioning + +## Overview + +`railiance-infra` (RailianceHosts) is Git-driven automation for provisioning and converging servers on Hosteurope and Hetzner Cloud — Terraform for lifecycle, cloud-init for first boot, Ansible for convergence — with secrets encrypted in-repo via SOPS/age and `inventory/servers.yaml` as the source of truth. It is the S1 Infrastructure Substrate layer of the Railiance OAS Stack. + +## Assessment notes + +### Discovery + +README documents a complete, concrete quickstart (clone, prerequisites, SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) with a specific inventory file (`inventory/servers.yaml`) as source of truth — an unusually complete operational README among the swept repos. + +### Availability + +Real ansible playbooks, terraform config, and scripts/tools present; has `.forgejo/` CI already; documented as the S1 Infrastructure Substrate layer of the Railiance OAS Stack. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..6a463c2b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-infra/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.railiance.infra-provisioning + name: RailianceHosts Infrastructure Provisioning + summary: Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, + cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source + of truth. + vector: D4 / A2 / C2 / R1 + domain: financials + status: draft + owner: railiance-infra + path: registry/capabilities/capability.railiance.infra-provisioning.md + tags: + - railiance + - terraform + - ansible + - infrastructure + consumption_modes: + - cli (terraform/ansible) + - gitops diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/capabilities/capability.railiance.platform-services.md b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/capabilities/capability.railiance.platform-services.md new file mode 100644 index 00000000..905bdbe1 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/capabilities/capability.railiance.platform-services.md @@ -0,0 +1,122 @@ +--- +id: capability.railiance.platform-services +name: Railiance Platform Services +summary: 'S3 Platform Services layer of the Railiance OAS Stack — shared cluster services: PostgreSQL + HA, Valkey cache, secret management, identity integration, and object storage.' +owner: railiance-platform +status: draft +domain: financials +tags: +- railiance +- platform +- secrets +- postgres +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: SCOPE.md places this repo precisely at S3 in the Railiance OAS Stack, scoped to shared + cluster services (PostgreSQL HA, Valkey, secrets, identity integration, object storage). + availability: + current: A2 + target: A3 + confidence: medium + rationale: No top-level package manifest, but ships real scripts/ (OpenBao/Vault apply/verify, credential-change + Python tooling) and tools/; has `.forgejo/` CI already in place. +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - OpenBao/Vault secret-management apply/verify scripting + - credential-change tooling + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - no top-level packaging; scripts/tools have no unified install path +discovery: + intent: Own the shared platform services layer (Postgres HA, Valkey, secrets, identity integration, + object storage) that application and enablement layers depend on, without owning the underlying host/cluster + substrate. + includes: + - PostgreSQL HA and Valkey cache service management + - secret management (OpenBao/Vault) apply/verify tooling + - identity integration and object storage + excludes: + - host/cluster substrate provisioning (see railiance-infra, railiance-cluster) + - application workload deployment (see railiance-apps) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - scripts/ (OpenBao/Vault, credential-change tooling) + - tools/ + target_artifacts: [] + consumption_modes: + - cli (shell/python scripts) +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - SCOPE.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Railiance operators managing shared platform services (Postgres, Valkey, secrets, identity, storage) + not_recommended_for: + - needs at the host/cluster substrate layer (see railiance-infra/-cluster) or application layer (see + railiance-apps) + known_limitations: + - no unified top-level packaging across scripts/tools +promotion_history: [] +--- + +# Railiance Platform Services + +## Overview + +`railiance-platform` is the S3 Platform Services layer of the Railiance OAS Stack: shared cluster services including PostgreSQL HA, Valkey cache, OpenBao/Vault secret management, identity integration, and object storage, consumed by application and enablement layers above it. + +## Assessment notes + +### Discovery + +SCOPE.md places this repo precisely at S3 in the Railiance OAS Stack, scoped to shared cluster services (PostgreSQL HA, Valkey, secrets, identity integration, object storage). + +### Availability + +No top-level package manifest, but ships real scripts/ (OpenBao/Vault apply/verify, credential-change Python tooling) and tools/; has `.forgejo/` CI already in place. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..3c28091a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/railiance-platform/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.railiance.platform-services + name: Railiance Platform Services + summary: 'S3 Platform Services layer of the Railiance OAS Stack — shared cluster services: PostgreSQL + HA, Valkey cache, secret management, identity integration, and object storage.' + vector: D3 / A2 / C1 / R0 + domain: financials + status: draft + owner: railiance-platform + path: registry/capabilities/capability.railiance.platform-services.md + tags: + - railiance + - platform + - secrets + - postgres + consumption_modes: + - cli (shell/python scripts) diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.register.md b/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.register.md new file mode 100644 index 00000000..05185f9f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.register.md @@ -0,0 +1,199 @@ +--- +id: capability.registry.register +name: Capability Registration +summary: Register a new capability so it becomes visible for planning and implementation reuse. +owner: reuse-surface +status: draft +domain: helix_forge +tags: + - registry + - governance + - meta + +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: > + Core use case UC-RS-001 is documented in specs/UseCaseCatalog.md and the + registry model is bounded in INTENT.md, but concrete promotion workflows + are not yet grounded in registry artifacts. + availability: + current: A4 + target: A5 + confidence: medium + rationale: > + Local registry workflows use the reuse-surface CLI (A3). Federation repo + registration is also available through the hosted hub HTTP API at + reuse.coulomb.social (POST/PATCH /v1/repos), deployed and dogfood-tested + on Railiance01 (REUSE-WP-0011). + +external_evidence: + completeness: + level: C2 + name: Partial + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - capability IDs can be assigned in registry entries + - maturity vectors can be recorded at registration time + - CLI validate, query, and export support registry workflows + - promotion history can be recorded in entries + - federation repo registration via hosted hub API and hub CLI + broken_expectations: + - no automated duplicate detection yet + out_of_scope_expectations: + - hosting registered capabilities + - enforcing implementation architecture + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - index drift still possible if authors skip validate + - CLI requires local venv install + - sibling repos cannot register until indexes publish raw URLs + evidence: + satisfied_signals: + - CI validate with fail-on-warnings on every push + - hub register/list/federated smoke on production reuse.coulomb.social + - pytest coverage for hub API and federation compose paths + +discovery: + intent: > + Make a capability candidate visible in the registry so humans and agents can + discover, assess, compare, and reuse it instead of rebuilding it in isolation. + includes: + - stable capability ID assignment + - initial discovery and availability classification + - explicit completeness and reliability placeholders + - evidence and relation references + excludes: + - implementing the registered capability + - certifying implementation quality + - operating runtime services for registered capabilities + assumptions: + - unregistered capabilities are invisible for registry-driven reuse + - low-maturity entries are acceptable when evidence gaps are explicit + use_cases: + - UC-RS-001 + research_memos: + - specs/UseCaseCatalog.md + - specs/ProductRequirementsDocument.md + +availability: + current_level: A4 + target_level: A5 + current_artifacts: + - templates/capability-entry.template.md + - registry/indexes/capabilities.yaml + - reuse_surface/cli.py + - reuse_surface/hub/ + - specs/FederationHubAPI.md + - https://reuse.coulomb.social + target_artifacts: + - packaged container release with documented SLO + consumption_modes: + - informational + - markdown authoring + - cli + - service API + +relations: + depends_on: [] + supports: + - capability.feature-control.evaluate + - capability.identity.vocabulary-canonicalize + related_to: + - capability.registry.validate + +evidence: + documentation: + - INTENT.md + - specs/UseCaseCatalog.md + - specs/FederationHubAPI.md + - docs/deploy/reuse-kubernetes.md + tests: + - tests/test_hub.py + - tests/test_hub_sync.py + - .forgejo/workflows/ci.yml + consumer_feedback: + - > + reuse-surface dogfood (REUSE-WP-0011): production hub registration and + /v1/federated compose succeeded on Railiance01 without write-path + regressions after WP-0011 deploy. + bug_reports: [] + incidents: [] + +consumer_guidance: + recommended_for: + - making a new capability visible at D0/A0/C0/R0 with minimal friction + - seeding planning discussions before implementation exists + not_recommended_for: + - treating registry presence as proof of implementation readiness + - skipping explicit evidence for maturity promotion + known_limitations: + - manual index updates are required after adding an entry + - duplicate detection is guidance-only in the MVP + +promotion_history: + - date: "2026-06-14" + dimension: discovery + from: D0 + to: D1 + rationale: Added name, summary, and registry-first intent from INTENT.md. + author: reuse-surface + - date: "2026-06-15" + dimension: discovery + from: D1 + to: D3 + rationale: Bounded scope with UC-RS-001 and MVP registry artifacts in specs/. + author: reuse-surface + - date: "2026-06-15" + dimension: availability + from: A0 + to: A3 + rationale: reuse-surface CLI shipped validate, query, and export commands. + author: reuse-surface + - date: "2026-06-15" + dimension: availability + from: A3 + to: A4 + rationale: > + Hosted federation hub live at reuse.coulomb.social; hub register/update + via HTTP API and reuse-surface hub CLI; production deploy on Railiance01. + author: reuse-surface + - date: "2026-06-16" + dimension: reliability + from: R2 + to: R3 + rationale: > + CI gates, pytest hub/federation coverage, and production hub smoke support + normal registration workflows with documented limitations. + author: reuse-surface +--- + +# Capability Registration + +## Overview + +Registration is the entry point for reuse visibility. A capability that is not +registered cannot be discovered through the registry surface, even if code or +documentation exists elsewhere. + +## Current reuse mode + +**Local registry (A3 CLI):** add Markdown entries under `registry/capabilities/`, +update `registry/indexes/capabilities.yaml`, run `reuse-surface validate`. + +**Federation registration (A4 API):** register published index URLs on the hosted +hub (`reuse-surface hub register`, `POST /v1/repos`) for cross-repo discovery +via `GET /v1/federated`. + +## Next promotion steps + +1. Attach concrete use cases and actors to reach D5. +2. Package hub as a versioned container release with operator SLO (A5). +3. Record consumer expectations and broken expectations as external evidence. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.validate.md b/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.validate.md new file mode 100644 index 00000000..bd68d338 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/capabilities/capability.registry.validate.md @@ -0,0 +1,107 @@ +--- +id: capability.registry.validate +name: Registry Entry Validation +summary: Validate capability registry entries against schema, index consistency, and relation integrity. +owner: reuse-surface +status: draft +domain: helix_forge +tags: [registry, validation, cli] + +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: UC-RS-023 is implemented via reuse-surface validate with schema and drift checks. + availability: + current: A3 + target: A3 + confidence: high + rationale: Available as reuse-surface validate CLI command. + +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - schema validation for entry front matter + - index drift detection + - optional relation integrity checks + broken_expectations: [] + out_of_scope_expectations: + - runtime validation of registered capability implementations + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - requires local venv install + - relation warnings require explicit --relations flag + evidence: + satisfied_signals: + - validate --relations --fail-on-warnings in CI + - tests/test_registry.py schema and drift coverage + +discovery: + intent: Keep registry data structurally sound so agents and humans can trust discovery metadata. + includes: + - JSON Schema validation + - index drift warnings + - relation reference checks + excludes: + - validating implementation code in other repos + use_cases: + - UC-RS-023 + research_memos: + - specs/UseCaseCatalog.md + +availability: + current_level: A3 + target_level: A3 + current_artifacts: + - reuse_surface/cli.py + - schemas/capability.schema.yaml + consumption_modes: + - cli + +relations: + depends_on: + - capability.registry.register + supports: [] + related_to: + - capability.registry.register + +evidence: + documentation: + - tools/README.md + - .forgejo/workflows/ci.yml + tests: + - tests/test_registry.py + consumer_feedback: + - > + reuse-surface CI: registry changes fail when schema validation or relation + checks warn with --fail-on-warnings, giving agents a dependable pre-merge gate. + +consumer_guidance: + recommended_for: + - pre-commit and CI validation of registry changes + not_recommended_for: + - certifying business correctness of capability claims + known_limitations: + - warnings do not fail CI unless --fail-on-warnings is set + +promotion_history: + - date: "2026-06-16" + dimension: reliability + from: R2 + to: R3 + rationale: CI fail-on-warnings and pytest registry coverage support dependable validation. + author: reuse-surface +--- + +# Registry Entry Validation + +Validates registry shape and consistency through the reuse-surface CLI. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..21ca35ab --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/reuse-surface/registry/indexes/capabilities.yaml @@ -0,0 +1,49 @@ +# Manually maintained capability index for humans and agents. +version: 1 +updated: "2026-10-13" +domain: helix_forge +capabilities: + - id: capability.infotech.headless-browser + name: Headless Browser Automation + summary: >- + Headless browser automation, screenshots and keyboard trials through + rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). + Published A5 local container; managed Railiance admission is pending. + Download the Python 3.10+ standalone client from + https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, + then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, + follow the local container setup in the capability card or adapt its A2 source + examples; this is an availability gap on the existing capability. + Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md. + vector: D3 / A5 / C2 / R2 + domain: infotech + status: reviewed + owner: reuse-surface + path: registry/capabilities/capability.infotech.headless-browser.md + tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer] + consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container] + + - id: capability.registry.register + name: Capability Registration + summary: Register a new capability so it becomes visible for planning and implementation reuse. + vector: D3 / A4 / C2 / R3 + domain: helix_forge + status: draft + owner: reuse-surface + path: registry/capabilities/capability.registry.register.md + tags: [registry, governance, meta] + consumption_modes: [informational, markdown authoring, cli, service API] + + - id: capability.registry.validate + name: Registry Entry Validation + summary: Validate capability registry entries against schema, index consistency, and relation integrity. + vector: D4 / A3 / C3 / R3 + domain: helix_forge + status: draft + owner: reuse-surface + path: registry/capabilities/capability.registry.validate.md + tags: [registry, validation, cli] + consumption_modes: [cli] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md b/docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md new file mode 100644 index 00000000..b2e6d578 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md @@ -0,0 +1,18 @@ +--- +id: capability.infotech.runbook-tutorials +name: Runbook-tutorial engine +summary: Engine, local UI and CLI for guided, parameterized operator runbooks: pack specification and validators, runs with evidence and locked records, maturity, attribute sets, projects and whole-project runs. Packs live in the repos that own the procedure. +owner: runbook-tutorials +status: active +domain: infotech +tags: + - runbook + - tutorial + - operator + - guided +--- + +Working: specifications `runbook-pack/v0.1` and `v0.2` with validators, the engine and local UI, projects and project templates, and the `rtut` +CLI (see `SCOPE.md`). Not built by decision: execution of steps, a cross-repository pack index, a feedback assistant (`workplans/RBT-WP-0006`). +Only the NetKingdom repository provides packs so far, and its three v0.2 packs have not had their first attended run, so this capability is +`active` but has no operational evidence yet. The fleet maturity vector is not assessed here: it needs the fleet's assessment method. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..4d9dd8df --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/runbook-tutorials/registry/indexes/capabilities.yaml @@ -0,0 +1,13 @@ +version: 1 +updated: '2026-09-29' +domain: infotech +capabilities: + - id: capability.infotech.runbook-tutorials + name: Runbook-tutorial engine + summary: Engine, local UI and CLI for guided, parameterized operator runbooks; packs live in the repos that own the procedure. + domain: infotech + status: active + owner: runbook-tutorials + path: registry/capabilities/capability.infotech.runbook-tutorials.md + tags: [runbook, tutorial, operator, guided] + consumption_modes: [git clone, cli] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/capabilities/execution.sandbox-provision.md b/docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/capabilities/execution.sandbox-provision.md new file mode 100644 index 00000000..7921f0b5 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/capabilities/execution.sandbox-provision.md @@ -0,0 +1,48 @@ +--- +id: capability.execution.sandbox-provision +name: Sandbox Provisioning +summary: Isolated execution environments for agentic development, e2e testing, and bounded automations — profile-based provision, TTL teardown, and State Hub lifecycle registration. +owner: sand-boxer +status: draft +domain: infotech +tags: [sandbox, isolation, provision, e2e, agentic, execution, profile] + +maturity: + discovery: + current: D5 + target: D6 + confidence: high + rationale: > + Charter (INTENT.md), meta-framework spec, extension SDK, integration docs, + and research synthesis. Capability indexed in registry/. + availability: + current: A5 + target: A5 + confidence: high + rationale: > + CLI v0 (create/destroy/snapshot/TTL), HTTP API, CoulombCore remote smoke. + Cloud adapters E2B/Modal + routing + credits (SAND-WP-0010). + +external_evidence: + completeness: + level: C5 + name: Mature + confidence: high + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - profile-based create/destroy/snapshot/restore via CLI + - TTL extend and expire/reap (SAND-WP-0009) + - E2B and Modal cloud adapters with BYOK (SAND-WP-0010) + - State Hub lifecycle events on transitions + - wise-validator and the-custodian migration arc complete + - extension SDK with compose-ssh, vm-packer attach, saas-stub, e2b, modal + broken_expectations: + - sandboxer01 dedicated host not live (CoulombCore interim) + out_of_scope_expectations: + - agent harness and tool orchestration (glas-harness) + - e2e test semantics (wise-validator) + +consumption_modes: + - CLI (sandboxer) + - core library (Python) + - HTTP API (uvicorn sandboxer.api.app:app) \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..bd661a35 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/sand-boxer/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-06-22' +domain: infotech +capabilities: +- id: capability.execution.sandbox-provision + name: Sandbox Provisioning + summary: Isolated execution environments for agentic development, e2e testing, and bounded automations — profile-based provision, TTL teardown, and State Hub lifecycle registration. + vector: D4 / A2 / C2 / R1 + domain: infotech + status: draft + owner: sand-boxer + path: registry/capabilities/execution.sandbox-provision.md + tags: + - sandbox + - isolation + - provision + - e2e + - agentic + - execution + - profile + consumption_modes: + - CLI + - core library \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md b/docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md new file mode 100644 index 00000000..5531a5fb --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md @@ -0,0 +1,19 @@ +--- +id: capability.infotech.sbom-management +type: capability +name: SBOM management +repo: sbom-nexus +domain: infotech +status: emerging +interfaces: + - http + - cli +--- + +# SBOM management + +Capture repository dependency evidence, preserve immutable SBOM snapshot +history, query current inventory and licence signals, and select a deterministic +bounded fleet catch-up queue. + +The extraction interface is documented in `ProductRequirementsDocument.md`. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..60db680a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/sbom-nexus/registry/indexes/capabilities.yaml @@ -0,0 +1,6 @@ +schema: reuse-surface.capability-index.v1 +repo: sbom-nexus +capabilities: + - id: capability.infotech.sbom-management + path: registry/capabilities/capability.infotech.sbom-management.md + status: emerging diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/capabilities/capability.infotech.repo-template.md b/docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/capabilities/capability.infotech.repo-template.md new file mode 100644 index 00000000..5ee0399a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/capabilities/capability.infotech.repo-template.md @@ -0,0 +1,121 @@ +--- +id: capability.infotech.repo-template +name: Coulomb Repository Template +summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions. +owner: repo-seed +status: draft +domain: infotech +tags: + - template + - bootstrap + - state-hub + - onboarding + +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: > + Template purpose, consumer guide, and validation checklist are documented. + Scope boundaries are explicit in SCOPE.md. + availability: + current: A3 + target: A4 + confidence: medium + rationale: > + Consumers clone or copy repo-seed and run statehub register. Template + files are markdown/git artifacts without a hosted provisioning API. + +external_evidence: + completeness: + level: C2 + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - agent instruction scaffold (AGENTS.md, CLAUDE.md, .claude/rules/) + - registry directory scaffold + - statehub register consumer documentation + - template validation checklist for bootstrap verification + - bootstrap workplan pattern (WP-0001) + broken_expectations: [] + out_of_scope_expectations: + - automated repo creation on Gitea + - runtime application code generation + reliability: + level: R2 + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - register output evolves with state-hub releases; checklist must be revalidated + - LLM inference path depends on llm-connect availability + +discovery: + intent: > + Give new Coulomb repositories a consistent starting point for agent + coordination, capability registry growth, and State Hub workplan tracking. + includes: + - git template files for agent instructions and registry scaffold + - documentation for statehub register usage + - consumer validation checklist + - bootstrap workplan convention + excludes: + - application runtime implementation + - owning downstream project code + assumptions: + - consumers have access to state-hub CLI and API + - workplans remain canonical in repo files (ADR-001) + use_cases: [] + research_memos: + - docs/statehub-register.md + - docs/template-validation-checklist.md + +availability: + current_level: A3 + target_level: A4 + current_artifacts: + - README.md + - AGENTS.md + - CLAUDE.md + - .claude/rules/ + - registry/ + - docs/statehub-register.md + - docs/template-validation-checklist.md + consumption_modes: + - git clone + - informational + +relations: + depends_on: + - capability.statehub.workstream-coordinate + supports: [] + related_to: + - capability.registry.register + +evidence: + documentation: + - docs/statehub-register.md + - docs/template-validation-checklist.md + - SCOPE.md + tests: [] + +consumer_guidance: + recommended_for: + - bootstrapping new Coulomb domain repositories + - standardizing agent onboarding and workplan conventions + not_recommended_for: + - repos that already have mature agent instructions and hub registration + - application templates with heavy code generation requirements + known_limitations: + - register must be run separately after cloning + - fix-consistency requires operator access to state-hub checkout +--- + +# Coulomb Repository Template + +`repo-seed` is the canonical git template for new Coulomb repositories. Clone it, +run `statehub register`, complete the bootstrap workplan, and sync with +`make fix-consistency`. + +See `docs/statehub-register.md` for the consumer workflow and +`docs/template-validation-checklist.md` for verification steps. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..359c385f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/secrets-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,14 @@ +version: 1 +updated: '2026-06-24' +domain: infotech +capabilities: + - id: capability.infotech.repo-template + name: Coulomb Repository Template + summary: Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions. + vector: D3 / A3 / C2 / R2 + domain: infotech + status: draft + owner: repo-seed + path: registry/capabilities/capability.infotech.repo-template.md + tags: [template, bootstrap, state-hub, onboarding] + consumption_modes: [git clone, informational] \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.progress-log.md b/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.progress-log.md new file mode 100644 index 00000000..cf9b109f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.progress-log.md @@ -0,0 +1,91 @@ +--- +id: capability.statehub.progress-log +name: Work Progress Logging +summary: Record progress events, decisions, and session notes against workstreams and tasks in State Hub. +owner: state-hub +status: draft +domain: helix_forge +tags: [state-hub, progress, coordination] + +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: Progress API and agent session protocol are documented in state-hub AGENTS.md. + availability: + current: A4 + target: A6 + confidence: medium + rationale: Available via State Hub HTTP POST /progress/ endpoint. + +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - progress events attach to workstreams + - agents can log session summaries + broken_expectations: [] + out_of_scope_expectations: + - replacing git commit history + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - depends on hub availability and tunnel health for remote agents + evidence: + satisfied_signals: + - reuse-surface AGENTS.md session-close protocol cites POST /progress/ + - cross-repo agents log progress with workstream_id linkage + +discovery: + intent: Provide auditable progress memory for cross-repo agent and operator work. + includes: + - progress event creation + - workstream and task linkage + - author attribution + excludes: + - canonical workplan storage + use_cases: [] + +availability: + current_level: A4 + target_level: A6 + current_artifacts: + - state-hub/api/ + consumption_modes: + - service API + +relations: + depends_on: + - capability.statehub.workstream-coordinate + supports: [] + related_to: + - capability.statehub.workstream-coordinate + +evidence: + documentation: + - AGENTS.md + consumer_feedback: + - > + reuse-surface agents (REUSE-WP-0012): session-close progress posts to State + Hub succeeded for workstream fb0b6067 during federation workplan work. + +consumer_guidance: + recommended_for: + - closing agent sessions with hub progress notes + not_recommended_for: + - authoritative task status (use workplan files + fix-consistency) + known_limitations: + - hub must be running locally or via tunnel +--- + +# Work Progress Logging + +Progress logging complements file-backed workplans with live session memory in +State Hub. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md b/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md new file mode 100644 index 00000000..889446eb --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md @@ -0,0 +1,121 @@ +--- +id: capability.statehub.workstream-coordinate +name: Workstream And Task Coordination +summary: Track active workstreams, tasks, progress, and consistency across domain repositories through a local-first coordination service. +owner: state-hub +status: draft +domain: helix_forge +tags: + - state-hub + - coordination + - workplans + +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: > + State Hub intent, scope, and ADR-001 workplan conventions are documented; + concrete agent workflows are still being standardized across repos. + availability: + current: A4 + target: A6 + confidence: medium + rationale: > + Consumers integrate through the State Hub HTTP API and custodian scripts. + Managed platform operation is the natural target for multi-repo agents. + +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - workstream and task tracking via HTTP API + - workplan file to database consistency sync + - progress event logging + broken_expectations: + - no native MCP server for all agent environments + out_of_scope_expectations: + - replacing git-backed workplan canon + - identity authority + reliability: + level: R2 + name: Tolerable + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - depends on local hub availability and operator maintenance + +discovery: + intent: > + Give agents and operators a live, queryable memory of work across domains + without replacing file-backed workplans and governance canon. + includes: + - workstream and task indexing + - progress and decision events + - repo consistency synchronization + - inbox and human-review flags + excludes: + - canon ownership + - task factory for all work origins + - identity authority + assumptions: + - workplans remain authoritative in git for ADR-001 repos + use_cases: + - UC-RS-013 + research_memos: + - state-hub/INTENT.md + +availability: + current_level: A4 + target_level: A6 + current_artifacts: + - state-hub/api/ + - state-hub/scripts/consistency_check.py + target_artifacts: + - state-hub/platform/state-hub-service + consumption_modes: + - service API + - HTTP REST + +relations: + depends_on: + - capability.infotech.hub-core-library + supports: + - capability.registry.register + - capability.infotech.core-hub + related_to: + - capability.statehub.progress-log + - capability.infotech.hub-core-library + - capability.infotech.core-hub + +evidence: + documentation: + - state-hub/INTENT.md + - state-hub/AGENTS.md + tests: [] + consumer_feedback: [] + bug_reports: [] + incidents: [] + +consumer_guidance: + recommended_for: + - cross-repo agent orientation and task status sync + - logging progress after workplan changes + not_recommended_for: + - storing canonical requirements or architecture canon + - assuming hub state overrides git workplan files + known_limitations: + - requires running State Hub locally or via tunnel +--- + +# Workstream And Task Coordination + +## Overview + +State Hub provides live coordination for helix_forge repositories while +workplans remain file-backed. This entry represents the service/API consumption +mode for cross-repo agent work. \ No newline at end of file diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..c8d68831 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/state-hub/registry/indexes/capabilities.yaml @@ -0,0 +1,35 @@ +version: 1 +updated: '2026-06-16' +domain: helix_forge +capabilities: +- id: capability.statehub.progress-log + name: Work Progress Logging + summary: Record progress events, decisions, and session notes against workstreams + and tasks in State Hub. + vector: D4 / A4 / C3 / R3 + domain: helix_forge + status: draft + owner: state-hub + path: registry/capabilities/capability.statehub.progress-log.md + tags: + - state-hub + - progress + - coordination + consumption_modes: + - service API +- id: capability.statehub.workstream-coordinate + name: Workstream And Task Coordination + summary: Track active workstreams, tasks, progress, and consistency across domain + repositories. + vector: D4 / A4 / C3 / R2 + domain: helix_forge + status: draft + owner: state-hub + path: registry/capabilities/capability.statehub.workstream-coordinate.md + tags: + - state-hub + - coordination + - workplans + consumption_modes: + - service API + - HTTP REST diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/tenant-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/tenant-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..7648beda --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/tenant-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,4 @@ +version: 1 +updated: '2026-07-23' +domain: infotech +capabilities: [] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md b/docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md new file mode 100644 index 00000000..a07a42b0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md @@ -0,0 +1,131 @@ +--- +id: capability.agents.custodian-runtime-tooling +name: Custodian Runtime And Repo-Classification Tooling +summary: 'Generic tooling from The Custodian''s runtime and ecosystem-management surface: an agent runtime + framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across + the workstation''s 61 repos.' +owner: the-custodian +status: draft +domain: custodian +tags: +- agents +- runtime +- classification +maturity: + discovery: + current: D2 + target: D4 + confidence: medium + rationale: This repo's README and canon content are marked confidential/proprietary; this entry deliberately + scopes to the generic, non-proprietary tooling surface only (runtime/ agent framework, tools/ classification + scripts), which is separately reusable and does not disclose canon/memory contents. + availability: + current: A1 + target: A2 + confidence: medium + rationale: '`runtime/agent.py` plus context/actions/tool_adapters/policies modules form a real Python + package (own pyproject, tests, README) under `runtime/`; `tools/` holds standalone scripts (batch_author_repo_classifications.py, + human_review_classifications.py, validate_repo_classification.py, push_repo_classifications.sh, + patch-forgejo-remote-urls.sh) used for ecosystem-wide repo classification and the Gitea-to-Forgejo + remote URL migration.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - standalone agent-runtime package under runtime/ with its own tests + - repo-classification batch/review/validate/push scripts used across the workstation roster + - a patch-forgejo-remote-urls.sh script directly relevant to REUSE-WP-0019 + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - repo root is confidential/proprietary (NDA); this entry's scope is deliberately narrow and must + not be widened to canon/memory contents without explicit review +discovery: + intent: Expose only the generic, non-confidential tooling that emerged from The Custodian's ecosystem-management + work — an agent runtime framework and repo-classification batch tooling — as reusable, without describing + canon or memory content. + includes: + - runtime/ agent framework (context, actions, tool adapters, policies) + - repo-classification batch/review/validate/push scripts + - patch-forgejo-remote-urls.sh + excludes: + - canon/ (curated knowledge substrate) and memory/ (operational logs) — confidential, out of registry + scope entirely + - governance/constitution content + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A1 + target_level: A2 + current_artifacts: + - '`runtime/` Python package' + - '`tools/*.py` and `tools/*.sh` classification scripts' + target_artifacts: [] + consumption_modes: + - library import (runtime/) + - cli (tools/ scripts) +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - runtime/README.md + tests: + - runtime/tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - ecosystem-management tooling reuse (repo classification batching, Forgejo remote-URL migration) — + not for canon/governance content, which is out of scope + not_recommended_for: + - any attempt to reuse or reference canon/memory contents (confidential, NDA-protected, explicitly excluded + from this entry) + known_limitations: + - registry entry intentionally narrow; confidentiality boundary must be respected in any future promotion +promotion_history: [] +--- + +# Custodian Runtime And Repo-Classification Tooling + +## Overview + +The Custodian's repository root is confidential and proprietary. This capability entry deliberately scopes only to its generic, non-confidential tooling surface: the `runtime/` agent framework (context, actions, tool adapters, policies) and the `tools/` repo-classification batch/review/validate/push scripts — including `patch-forgejo-remote-urls.sh`, directly relevant to the ecosystem's Gitea-to-Forgejo transition. Canon and memory content are explicitly excluded from this entry. + +## Assessment notes + +### Discovery + +This repo's README and canon content are marked confidential/proprietary; this entry deliberately scopes to the generic, non-proprietary tooling surface only (runtime/ agent framework, tools/ classification scripts), which is separately reusable and does not disclose canon/memory contents. + +### Availability + +`runtime/agent.py` plus context/actions/tool_adapters/policies modules form a real Python package (own pyproject, tests, README) under `runtime/`; `tools/` holds standalone scripts (batch_author_repo_classifications.py, human_review_classifications.py, validate_repo_classification.py, push_repo_classifications.sh, patch-forgejo-remote-urls.sh) used for ecosystem-wide repo classification and the Gitea-to-Forgejo remote URL migration. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..112e727a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/the-custodian/registry/indexes/capabilities.yaml @@ -0,0 +1,21 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.agents.custodian-runtime-tooling + name: Custodian Runtime And Repo-Classification Tooling + summary: 'Generic tooling from The Custodian''s runtime and ecosystem-management surface: an agent runtime + framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across + the workstation''s 61 repos.' + vector: D2 / A1 / C1 / R0 + domain: custodian + status: draft + owner: the-custodian + path: registry/capabilities/capability.agents.custodian-runtime-tooling.md + tags: + - agents + - runtime + - classification + consumption_modes: + - library import (runtime/) + - cli (tools/ scripts) diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/capabilities/capability.identity.user-engine.md b/docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/capabilities/capability.identity.user-engine.md new file mode 100644 index 00000000..4cc90c99 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/capabilities/capability.identity.user-engine.md @@ -0,0 +1,123 @@ +--- +id: capability.identity.user-engine +name: Headless Multi-Tenant User Engine +summary: Headless, multi-application, multi-tenant user management engine covering registration, identity/factor + models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys. +owner: user-engine +status: draft +domain: communication +tags: +- identity +- user-management +- multi-tenant +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: 'Unusually large documentation set for its size: docs/development.md, configuration.md, + contracts.md, canon-mapping.md, canon-interface-card.yaml, family-dataspace-onboarding.md, registration-identity-and-factor-model.md, + prepared-accounts-and-entitlement-claims.md, hats-realms-services-assets-access-profiles.md, onboarding-journeys-and-welcome-protocols.md, + and more — scope and contracts are thoroughly documented.' + availability: + current: A1 + target: A3 + confidence: medium + rationale: Python package with `make test`; no packaged distribution or hosted service confirmed in + this sweep. +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - registration/identity/factor model documented + - entitlement claims and access-profile model (hats/realms/services/assets) documented + - canon mapping and interface card present + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - breadth of documented scope not independently verified against implementation completeness in this + sweep +discovery: + intent: Provide a headless, multi-application, multi-tenant user-management engine covering the full + registration-to-entitlement lifecycle, reusable across NetKingdom-family applications. + includes: + - multi-tenant registration and identity/factor model + - entitlement claims and hats/realms/services/assets access profiles + - onboarding journeys and welcome protocols + excludes: + - IAM/OIDC protocol implementation itself (see key-cape, net-kingdom) + assumptions: [] + use_cases: [] + research_memos: [] +availability: + current_level: A1 + target_level: A3 + current_artifacts: + - Python package (`user-engine`) + target_artifacts: [] + consumption_modes: + - library import +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - docs/contracts.md + - docs/registration-identity-and-factor-model.md + - docs/canon-mapping.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - multi-tenant applications needing a headless user/identity/entitlement engine + not_recommended_for: + - needs for the IAM/OIDC protocol layer itself (see key-cape/net-kingdom) + known_limitations: + - large documented scope; implementation completeness not independently verified in this sweep +promotion_history: [] +--- + +# Headless Multi-Tenant User Engine + +## Overview + +`user-engine` is a headless, multi-application, multi-tenant user-management engine: registration, identity/factor models, prepared accounts and entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys, documented in unusual depth for its size. + +## Assessment notes + +### Discovery + +Unusually large documentation set for its size: docs/development.md, configuration.md, contracts.md, canon-mapping.md, canon-interface-card.yaml, family-dataspace-onboarding.md, registration-identity-and-factor-model.md, prepared-accounts-and-entitlement-claims.md, hats-realms-services-assets-access-profiles.md, onboarding-journeys-and-welcome-protocols.md, and more — scope and contracts are thoroughly documented. + +### Availability + +Python package with `make test`; no packaged distribution or hosted service confirmed in this sweep. + +### Completeness + +First-pass honest assessment from the REUSE-WP-0017 coverage campaign +(reuse-surface). No external consumer feedback exists yet; levels reflect +scope-vs-intent documentation quality, not internal code quality. + +### Reliability + +No production consumer telemetry exists yet; reliability level is +intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. + +## Promotion checklist + +- [x] ID follows `capability..` pattern +- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` +- [x] `external_evidence` is populated separately from `maturity` +- [ ] Relations reference valid capability IDs (none yet) +- [x] Index entry added in `registry/indexes/capabilities.yaml` diff --git a/docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..e0cb8e2e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-before/user-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-07-06' +domain: helix_forge +capabilities: +- id: capability.identity.user-engine + name: Headless Multi-Tenant User Engine + summary: Headless, multi-application, multi-tenant user management engine covering registration, identity/factor + models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys. + vector: D4 / A1 / C2 / R0 + domain: communication + status: draft + owner: user-engine + path: registry/capabilities/capability.identity.user-engine.md + tags: + - identity + - user-management + - multi-tenant + consumption_modes: + - library import diff --git a/docs/assessments/netkingdom-2026-10-14/registry-changes.json b/docs/assessments/netkingdom-2026-10-14/registry-changes.json new file mode 100644 index 00000000..c7c91ca0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-changes.json @@ -0,0 +1,905 @@ +[ + { + "repo": "access-engine", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "before_sha256": "aaeb31f583f35a16abff75674227aff7f8a45ebd481c14470932d1adfeffe680", + "after_sha256": "a209848f31635e4637b481fc4fefca2331957ebb89b0ae2198b90affeae247fc", + "operation": "write" + }, + { + "repo": "access-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "e78fd82c4b4cec018acb09344793845ffa8ae24dd39d95bca562e8dbcf89abcd", + "after_sha256": "7d59022dac9da4d8dcbecab936d3cea9b154c8c51478b378932fd9ebe5ec7e02", + "operation": "write" + }, + { + "repo": "activity-core", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "before_sha256": "1f9e305b00680e7cc93ec5c1fa3c3ffa6fc710b7a44737327727786e0c122872", + "after_sha256": "72f5366d6eae0a26568ad62ea646b928ac96adaa7fcb864fb9934d405475f03b", + "operation": "write" + }, + { + "repo": "activity-core", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "4579700304a50d05cb5371749feb4294dce13c9b76f849248efe5a59a7d5968a", + "after_sha256": "536d359366ccf3db3b2b0d390635bc2c5311bd37ac7ff89dae11d809ef15b848", + "operation": "write" + }, + { + "repo": "agentic-resources", + "path": "registry/NO_CAPABILITIES.md", + "before_sha256": "1628a447745bb24d4e7bc55b9586a718064c4d8e249e055fa58310705a8c9e0e", + "after_sha256": null, + "operation": "delete" + }, + { + "repo": "agentic-resources", + "path": "registry/capabilities/capability.agents.performance-learning.md", + "before_sha256": null, + "after_sha256": "2d9988711c84968dc86a9149caed87f09362916d23b82cd28d3f7ad947378e8b", + "operation": "write" + }, + { + "repo": "agentic-resources", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86", + "after_sha256": "42986b7a274ef510166e566a9756d594a6f88706189bc97ac889bab86b20240d", + "operation": "write" + }, + { + "repo": "approval-engine", + "path": "registry/capabilities/capability.security.approval-lifecycle.md", + "before_sha256": null, + "after_sha256": "bb1e47b94183c41d45c2dccb7ae5bc1f7bc98ad3f0ef5c4ee6d0cd1c5b5b06bb", + "operation": "write" + }, + { + "repo": "approval-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "b6812fd12dc530270fb66bae592c828f56f17f2fc86759cb04d750162fc619a4", + "operation": "write" + }, + { + "repo": "audit-core", + "path": "registry/capabilities/capability.audit.event-retain.md", + "before_sha256": "679d47a986b9d6bf5c24cd5d995ce19236daf35f5d542365e907afc822be49b4", + "after_sha256": "88f58dc61aef8746124827f47eac5dd20ec5761e11551a864a3c5d5a7f28f172", + "operation": "write" + }, + { + "repo": "audit-core", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "b9247a087984a636ef4b421c92f9c280572161f358559cf0e5fb7f5f8f1a598e", + "after_sha256": "6a1d7dbb442f0fd0e481d54fb0acbee37ef2e693198b6f2108e154d3c3795e0e", + "operation": "write" + }, + { + "repo": "coordination-engine", + "path": "registry/NO_CAPABILITIES.md", + "before_sha256": "92e03b7609777348fd1c7609e8fa4922730378f3870496c9580f9b27a9fe0a4b", + "after_sha256": null, + "operation": "delete" + }, + { + "repo": "coordination-engine", + "path": "registry/capabilities/capability.coordination.cross-owner-work.md", + "before_sha256": null, + "after_sha256": "f4a7a4ee2bf689056eb02d647ae97a94dd1a16462180fbed6762a006983fe7ae", + "operation": "write" + }, + { + "repo": "coordination-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86", + "after_sha256": "f7a2c140ac1a7628a2106b1047b59e208879257b23ffed6dceef8ecf6c3bd420", + "operation": "write" + }, + { + "repo": "emergent-security", + "path": "registry/capabilities/capability.security.agent-knowledge.md", + "before_sha256": null, + "after_sha256": "66bdfd445f0292c0b9fec6999c3d7ca6134a2a1b1f781a6fc6cfa4bd62baa34c", + "operation": "write" + }, + { + "repo": "emergent-security", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "268d9192dc9b97da462d46fe5b40ea33e678840b23944ab0cd73622c130bdef6", + "operation": "write" + }, + { + "repo": "fin-hub", + "path": "registry/capabilities/capability.finance.security-budget-evidence.md", + "before_sha256": null, + "after_sha256": "314525b624e290bffb3817f3fe0e4a5f6d729ac93d1be485fa06fbe8896d0576", + "operation": "write" + }, + { + "repo": "fin-hub", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "c6bb1aa6b770f684721fae9f1576f2c2f0128d1b758f4e33b8a277e0b4ff087a", + "operation": "write" + }, + { + "repo": "gate-house", + "path": "registry/capabilities/capability.security.doctrine-review.md", + "before_sha256": null, + "after_sha256": "55964589de53f6b07c184b0d8e18e511fbc870ceff0f5f28fa2b015b97568d26", + "operation": "write" + }, + { + "repo": "gate-house", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "2b63d94375d29649c41a7eae7cfb3f6e35210fd3438aa5013f3ddc22a662511a", + "operation": "write" + }, + { + "repo": "glas-harness", + "path": "registry/capabilities/capability.execution.profile-harness.md", + "before_sha256": null, + "after_sha256": "6eea0a69ea80236bdd30379b189eb1c1e8b50d95e89eac8b43ec8fbf51ad659f", + "operation": "write" + }, + { + "repo": "glas-harness", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86", + "after_sha256": "8f86dbdaf6535c909ff19967f7806d85c1f7a09db1e999033abf9b9007ed805b", + "operation": "write" + }, + { + "repo": "info-tech-canon", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "before_sha256": "d07fdd36dc877681e6111eedc435defeed188b55092312273b51aa433846b323", + "after_sha256": "db9721777788773026d646462fad03df04cf3d1846a0ebf5d1cf1a809ea9f945", + "operation": "write" + }, + { + "repo": "info-tech-canon", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "b8a294905a361a3cc8df8ddb9c725e89310426c3539e5e9a00a1160aed00b858", + "after_sha256": "6015ec78772586e6e351422741430be8c40d7c7116403ee4b92933df342c4c72", + "operation": "write" + }, + { + "repo": "informed-decision", + "path": "registry/capabilities/capability.security.human-decision-workspace.md", + "before_sha256": null, + "after_sha256": "d64c27fcfe13ffcf0de9db7a916044f93d45b36a1dff26486efa3ac0f5ca4fc1", + "operation": "write" + }, + { + "repo": "informed-decision", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "b43ea44c725dcbd59fe957ffc307805e0aabc23b60a4a9049005c70ca4871a62", + "operation": "write" + }, + { + "repo": "issue-core", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "before_sha256": "61ff410aa7a86d5f50238395919e361fa96f01214a1ba3c14ef53a065f84ec29", + "after_sha256": "60282cc3b4ab58a9df621b895bfd1e7b485d6b7ef47bde11f7d339907aeb262b", + "operation": "write" + }, + { + "repo": "issue-core", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "ceb4ba66ad67c8db1e4e5fe83305f1e4552dc6358daf00862255614d17802051", + "after_sha256": "70eb00870ed87072aeb0f7c38de0a879f1b3910fe6f976b982a191e261e8e7be", + "operation": "write" + }, + { + "repo": "key-cape", + "path": "registry/capabilities/capability.iam.key-cape.md", + "before_sha256": "ca65622d7d7443c5ca67f59bfe6bccb2ac5b3d17aac042adcf43ef782b455158", + "after_sha256": "c987ddd0155c248e35409878e9b2dc36ffd18bbd1b82fce8a90157fc4224a915", + "operation": "write" + }, + { + "repo": "key-cape", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "efd1dc5095124a0978986af4f0c0555be44ec1b7bb50d3e2417cfedeceb12420", + "after_sha256": "901d15c15cacd844cf19a1a7b74c890ce5e0b00a3372a9e10bd7114f328596c8", + "operation": "write" + }, + { + "repo": "kings-guard", + "path": "registry/capabilities/capability.security.posture-assessment.md", + "before_sha256": null, + "after_sha256": "e6bb4704a9e008dc8bbe8a2b14be880c8b8122ace4f2828b3fbee6ecf2583a89", + "operation": "write" + }, + { + "repo": "kings-guard", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "8a143864a6ce9a7b6c5a0f64eb75f67cfa99c2b9b155baac4f81a261d3a5312c", + "operation": "write" + }, + { + "repo": "maturity-engine", + "path": "registry/capabilities/capability.security.maturity-claims.md", + "before_sha256": null, + "after_sha256": "498736f3da2eaa4e1a3f9f223820eb630a8fa72be4a9c1423dc7c1722b55c28f", + "operation": "write" + }, + { + "repo": "maturity-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "42b4cd1f9c6fe0960acadd10a337a579a6313fa46c2ff5a2a34bbacf2749d049", + "operation": "write" + }, + { + "repo": "net-kingdom", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "before_sha256": "653a18602efce1938ed05206f2514c41fafb7fc7c4f968248bce85e31bd8633e", + "after_sha256": "235773e0913ec2f2cb4b8d5ac09839851bf9af7c7c5cb38b5207a3305e2eaf15", + "operation": "write" + }, + { + "repo": "net-kingdom", + "path": "registry/capabilities/capability.security.scenario-compose.md", + "before_sha256": null, + "after_sha256": "e9bab551d4ca5afac63cc70b59a783e6da96a1a361cc713fab31dbff604d351f", + "operation": "write" + }, + { + "repo": "net-kingdom", + "path": "registry/capabilities/capability.security.posture-feedback.md", + "before_sha256": null, + "after_sha256": "470ffa52b5da01ee6562de7654503da592c456c80eaa4a1b623d92594cfbb00f", + "operation": "write" + }, + { + "repo": "net-kingdom", + "path": "registry/capabilities/capability.security.case-contracts.md", + "before_sha256": null, + "after_sha256": "6880ee826febb8cb6da0c804ec59558fffbcaa22e3893065a2d9f2bb1d6b6732", + "operation": "write" + }, + { + "repo": "net-kingdom", + "path": "registry/capabilities/capability.security.bootstrap-recovery.md", + "before_sha256": null, + "after_sha256": "f98058ad567bc1fc8f0f8b5ae9c337a93bec87434ec3b0060488ae8335f5dd50", + "operation": "write" + }, + { + "repo": "net-kingdom", + "path": "registry/capabilities/capability.security.emission-profile.md", + "before_sha256": null, + "after_sha256": "575b651fe421659594deef4381bff6f20ff09acffd4f68e36dfd18060742aaed", + "operation": "write" + }, + { + "repo": "net-kingdom", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "edad1cc15d3eec0aaa02517a8ccf04a00e0a6ceb6c8c7846b46fd5512018c168", + "after_sha256": "6fadeb0e89729a9226d6eebd44fbb07723512a3ebe6737f5a1113b14829447ed", + "operation": "write" + }, + { + "repo": "ops-bridge", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "before_sha256": "d291311b5911cc512f05394cf57f804ae26b8844bb972063a42d423060051e9f", + "after_sha256": "1c3a43c90650adb730e86e3aa8df885e0e87499a0228bfb88a31eac699028af9", + "operation": "write" + }, + { + "repo": "ops-bridge", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "c1d311ba89d0c06efb86d5648bae87fdc83903ccc359dfc8ce4f9476728fc068", + "after_sha256": "aefd795eb16fcfdebc108450826a0f62e000bc61e9d78007bc6221bc2328e40c", + "operation": "write" + }, + { + "repo": "ops-mason", + "path": "registry/capabilities/capability.security.structure-construction.md", + "before_sha256": null, + "after_sha256": "7d6699c19f89d1ab916e0e2da6f7a36232b4960f693b042bf4374c86b7115f13", + "operation": "write" + }, + { + "repo": "ops-mason", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "5eb499bc819c874835b8e6727ccbd5f9889ebb6f25a90018e3e574e5b6082b32", + "operation": "write" + }, + { + "repo": "ops-warden", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "before_sha256": "76196d038635dd2114854b233dab9ebeaf91a8c7ceb9de222997674cce36b58a", + "after_sha256": "f48c749ec3342b57d94866c847be5f3ff10934bfa86b5953b729afde6d3e6b5f", + "operation": "write" + }, + { + "repo": "ops-warden", + "path": "registry/capabilities/capability.security.access-routing.md", + "before_sha256": null, + "after_sha256": "e3d5b2737fa743174216e0b106cba8ae861b9a1fd7797331a041ffa941a3beae", + "operation": "write" + }, + { + "repo": "ops-warden", + "path": "registry/capabilities/capability.security.case-follow-through.md", + "before_sha256": null, + "after_sha256": "8a69a28b2f17ee247305fae6201decb0805ff903ced37ab91d8c6c5dbe8a681d", + "operation": "write" + }, + { + "repo": "ops-warden", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "795194870562a3273125b78f6460c2b27dfff1de956e79298dc9600cb520c633", + "after_sha256": "4d3aba70ead10c826814dc766f9d23e3e0ce52475330acf57905bf62b01c819c", + "operation": "write" + }, + { + "repo": "policy-nexus", + "path": "registry/capabilities/capability.security.policy-publication.md", + "before_sha256": null, + "after_sha256": "b961365f5a8a067226290e56cc31f6c254c345451d1830f032b670c013575d8a", + "operation": "write" + }, + { + "repo": "policy-nexus", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "c1eb3e23621de354a9081cbf29a2f3d772b5f8538aaceca417574cde5a04c021", + "operation": "write" + }, + { + "repo": "rail-kubernetes", + "path": "registry/capabilities/capability.railiance.kubernetes-rail.md", + "before_sha256": null, + "after_sha256": "896feea967e22f276287408aaae6e34b95839e29a18c4fdc30e4c83baa30e05f", + "operation": "write" + }, + { + "repo": "rail-kubernetes", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "699f69facea1ce4e71d90fe0790db19b68d3a546015453651d3afc808d31d09d", + "operation": "write" + }, + { + "repo": "railiance-apps", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "before_sha256": "c312d273ac62128642c1d55e6a993ee998f69dbec173594f78a809cb6e2db497", + "after_sha256": "ad24b7656512f93698af3182a3187c2e32efd5e74ae69007cb86eb7cd889528f", + "operation": "write" + }, + { + "repo": "railiance-apps", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "2f01f8e8099e9130350db943be800b0eaf0cd3b65d22bc4e7f5b832b055efbad", + "after_sha256": "2a550acf8545e95bd81842bb1b00f4db46c4dbb42b522823f043e948667ddf2c", + "operation": "write" + }, + { + "repo": "railiance-bootstrap", + "path": "registry/capabilities/capability.railiance.bootstrap-sequencing.md", + "before_sha256": null, + "after_sha256": "9bbfe970a0bca433f5e4f0e13f244d26ff97280db0123533ea403cc1bbaaa790", + "operation": "write" + }, + { + "repo": "railiance-bootstrap", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "c20b96c226bb9465d7154c127ee19a94396c7b03307e7581ff827eba42651d86", + "after_sha256": "feefcc699e045a1a72f254d71f46460ad2362ed23c9de6e54c952711fcb33788", + "operation": "write" + }, + { + "repo": "railiance-cluster", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "before_sha256": "d8cb1061eb7ce2f528eb1514975ce978755de1b4a0f067755429e5379e42fe4d", + "after_sha256": "dec1d194f06a35a35d80ed5bd4f59a7a309737ae611fafd52d6aad9896346d78", + "operation": "write" + }, + { + "repo": "railiance-cluster", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "3946542cfb17368e405fa31c0f2b37073e4b9d0162410b5b916875e3d335565c", + "after_sha256": "0e67a2aca183ee7ef9c4c04e618fcb03647120f456a133e84a8f42c2b8d8fcde", + "operation": "write" + }, + { + "repo": "railiance-enablement", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "before_sha256": "24f46220be11362de2da38d908dc9decd9999a7c46779b586d1a79859890d182", + "after_sha256": "3f90be42901660ed177f2636455919c21adf382ac6118950f0ec52526ba6e147", + "operation": "write" + }, + { + "repo": "railiance-enablement", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "503bbc9ce27b9048fe1c86624883c7c7d366561c9371f2952757bc93de06ebbd", + "after_sha256": "4b1f91b0da94e3098916f3e360b20b9926be4dd8683d6fb167a027aaf04ebfac", + "operation": "write" + }, + { + "repo": "railiance-fabric", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "before_sha256": "51ff86d99777b422eb44b55bba4eb4aa915c23b8243ea3dace995449c97ccd67", + "after_sha256": "25ad5efa3f874c60c4adc4f0eb46b4ce27805659062c0453a581e8d5b146443d", + "operation": "write" + }, + { + "repo": "railiance-fabric", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "13c4da2de7e45f42ea1c6e6099bb011245f986250d7e31984725e1953ac4ba46", + "after_sha256": "f473644906fe3f331702b407c3519e6a3cd0d96d362cf30d80e03aac53c3b862", + "operation": "write" + }, + { + "repo": "railiance-forge", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "before_sha256": "bb811c687874c7f65d0baf6719ea44477a6b22f9793ff57d2234d454fc8c3966", + "after_sha256": "a974968ea22aa2ce39f243677ae6a7997e2850f0b5630c4fd0107819a8151135", + "operation": "write" + }, + { + "repo": "railiance-forge", + "path": "registry/capabilities/capability.security.forge-secret-prevention.md", + "before_sha256": null, + "after_sha256": "54a1797dfcaa724be1b837bc69abc3df7e5546289c3a7faf333d7bc0b580b8f7", + "operation": "write" + }, + { + "repo": "railiance-forge", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "70bd7584464d89616fa707d4a1a1877e3fafc3f635414f6e7974fbfafd2d8587", + "after_sha256": "4df605d617b7656ffb94a43ab4633c8fc69ec723f68f5f5b8d5f24ad8efb6b98", + "operation": "write" + }, + { + "repo": "railiance-infra", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "before_sha256": "284a6120e78fce726409feb3ccd718d8316df50dfc544e94b638744daee5d899", + "after_sha256": "3a66a7ef7ea692f9908c054e7d689a374b816aeb0beefade6b42d697d3112f9f", + "operation": "write" + }, + { + "repo": "railiance-infra", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "067d7142a60637bd10224a1651d36dcc7c03945f98cfe960231ab11318a7352e", + "after_sha256": "14a76b1f1dd317a1d426502ff5f80780e9551cd1cd600543de6fb9a84cb8ada2", + "operation": "write" + }, + { + "repo": "railiance-master", + "path": "registry/capabilities/capability.railiance.security-consumption-contracts.md", + "before_sha256": null, + "after_sha256": "0477910eaabec436e7fa1cc8244bed5b1319436f6fa22e20086fb0f676f3de14", + "operation": "write" + }, + { + "repo": "railiance-master", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "f36cb2765ec04064314f43866f9a87a94a4f0f728adfaad46739f232b4986c0a", + "operation": "write" + }, + { + "repo": "railiance-platform", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "before_sha256": "569a812003ccf78e16cbceda7748d2997552ca6784899aabbf25edd9201cd1d9", + "after_sha256": "ac900d26de158ea990bd5f666dcaa1dc8e715e6f1e5b6594b3ab23e2c208b8b6", + "operation": "write" + }, + { + "repo": "railiance-platform", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "844a6ce477df5536159133160f3370e94adaf40e0e47955ee6f386f13cda588e", + "after_sha256": "0315d526165368e0a513de6b15932778d43c3e6045c589c95060f555fca3202e", + "operation": "write" + }, + { + "repo": "railiance-telemetry", + "path": "registry/capabilities/capability.observability.security-signals.md", + "before_sha256": null, + "after_sha256": "5a4ccfe91855a423cce8fe4f6432a15eb78acd2f1413475d4e5ceeb415b15f3d", + "operation": "write" + }, + { + "repo": "railiance-telemetry", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "82f3f2d188e2d7ebea71b7262e106c5f48feaf39a2da881bb645ff9352884205", + "operation": "write" + }, + { + "repo": "rapp-openbao", + "path": "registry/capabilities/capability.railiance.openbao-package.md", + "before_sha256": null, + "after_sha256": "9de890da536c34ac2b50576e2c4a9c03792c8a07545d2a0566ace68ac10a293e", + "operation": "write" + }, + { + "repo": "rapp-openbao", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "044efa3d02b90e1872f2516c581159d388a8080a689f76fcd78bb4d048d6ee64", + "operation": "write" + }, + { + "repo": "rapp-playwright", + "path": "registry/capabilities/capability.railiance.browser-verification.md", + "before_sha256": null, + "after_sha256": "ad1f3f14ccabec8b25a4a0125ad3ea6c065c3216b6bc6f84552f6c1435e5d042", + "operation": "write" + }, + { + "repo": "rapp-playwright", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "79645df817858f96230f2443d66796d1078185c7afef5948f6a38632234d33bb", + "operation": "write" + }, + { + "repo": "rapp-policy-nexus", + "path": "registry/capabilities/capability.railiance.policy-publication-package.md", + "before_sha256": null, + "after_sha256": "21415ed5e89dcf8bd2df0c8bc99b07d2c87173809c37fa2582de6d336918a126", + "operation": "write" + }, + { + "repo": "rapp-policy-nexus", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "e68bdedf61eee9ca2026f46a2434ce384c26234616e74f7a5d08a06c75b3bb00", + "operation": "write" + }, + { + "repo": "rapp-postgres", + "path": "registry/capabilities/capability.railiance.postgres-isolation-recovery.md", + "before_sha256": null, + "after_sha256": "64503872abb24bb28f291264e860ab094c6abb721fbfe90b47258ad13b77af44", + "operation": "write" + }, + { + "repo": "rapp-postgres", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "d939333eed9d85172e006f526c445fbe2602a721d53f7c0d14bc68286ae08776", + "operation": "write" + }, + { + "repo": "rapp-telemetry", + "path": "registry/capabilities/capability.railiance.telemetry-package.md", + "before_sha256": null, + "after_sha256": "a67dbf6905223c04b1c003d5f967841038743c8c1479812f5cf0bb55ad6cee77", + "operation": "write" + }, + { + "repo": "rapp-telemetry", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "ee8801f143ed5cf064205710a61c2bb24efc6ea8585d5786d6b679426ec4c1d4", + "operation": "write" + }, + { + "repo": "rapp-tenant-engine", + "path": "registry/capabilities/capability.railiance.tenant-engine-package.md", + "before_sha256": null, + "after_sha256": "e7cf0485cfdb6f497281638d81f908b5c2fe1053125c6ef28130504909d1d49e", + "operation": "write" + }, + { + "repo": "rapp-tenant-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "d8e9c1282350b5d2fd4f4d69712aa7a5fbcd2367bb1a7fad1b6eb16a97e5d732", + "operation": "write" + }, + { + "repo": "rapp-user-engine", + "path": "registry/capabilities/capability.railiance.user-engine-package.md", + "before_sha256": null, + "after_sha256": "84ec4fdce99134c88c110104cac93bdea36cffb5ba34e046b9ad161fb860dce2", + "operation": "write" + }, + { + "repo": "rapp-user-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "95b4ed2d0b189f6847b1c0899f740d1da46933a8f40491e1a02f2d4e57c819fc", + "operation": "write" + }, + { + "repo": "reef-railiance", + "path": "registry/capabilities/capability.railiance.substrate-bindings.md", + "before_sha256": null, + "after_sha256": "4df6529b95c9aff89f67de20cf19b5ad20ffdb0af6eff57936c693e4c7897af0", + "operation": "write" + }, + { + "repo": "reef-railiance", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "84a89c376021e3cb980c02c41d1a31396b874bebcc3801c2d1a9a33ae4195eb5", + "operation": "write" + }, + { + "repo": "rein-aharness", + "path": "registry/capabilities/capability.execution.scheduled-agent-rein.md", + "before_sha256": null, + "after_sha256": "85231cd1f473ed28cf826fa561f098e8b829efb9177108e9678fcb4f3205d513", + "operation": "write" + }, + { + "repo": "rein-aharness", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "20990ed0e016b3330a0d44e9b86bfff8966e82bc8800469ec0f320cfa8a63fbc", + "operation": "write" + }, + { + "repo": "rein-openweights", + "path": "registry/capabilities/capability.execution.openweight-rein.md", + "before_sha256": null, + "after_sha256": "cfb35d7d7285e5e632e09869457ccd262aa0ceb3f8a6c3461f5a6d4f82002810", + "operation": "write" + }, + { + "repo": "rein-openweights", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "2f4e59b2dbc7ea6078405f5c2f2be0aebd9434bee171a429b9ebe6baa83f3c2b", + "operation": "write" + }, + { + "repo": "repo-manager", + "path": "registry/capabilities/capability.security.repository-secret-prevention.md", + "before_sha256": null, + "after_sha256": "67f2846ff664489c938edc6ba4f65369ea0d3d5fd24fb7dbd287b9ee903281be", + "operation": "write" + }, + { + "repo": "repo-manager", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "ba068a8dd7a282664e94e2acdbbb170a2ba48e260e7ce0ec8eaaa8aee6f9e7c2", + "operation": "write" + }, + { + "repo": "resource-control", + "path": "registry/capabilities/capability.resources.security-capacity.md", + "before_sha256": null, + "after_sha256": "013900e2dc836b3eb3bc4470f0f27308cb9a923575aea998eb4693302df7ebd8", + "operation": "write" + }, + { + "repo": "resource-control", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "31b16f7d824e376f21de44aff46d5d532d3679d5e72035ce84813572b11bbd44", + "operation": "write" + }, + { + "repo": "reuse-surface", + "path": "registry/capabilities/capability.registry.register.md", + "before_sha256": "7702e46c4115f9dffbce47c366891a311362e3d3eb3f1bcf45729d40635c536e", + "after_sha256": "f0a188e7ff8a2057b4eb9a0fb998e6b777d893cad5f024a507ca22639958fb2b", + "operation": "write" + }, + { + "repo": "reuse-surface", + "path": "registry/capabilities/capability.registry.validate.md", + "before_sha256": "d5a7b7d9a339606bdbdc51c93ffdba358a4316b9f7508993d4a58b617b898a76", + "after_sha256": "dfbfeec7c795e9e666860913400b777718dd99d1eb1ed1146715edf51a3f846a", + "operation": "write" + }, + { + "repo": "reuse-surface", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "200412c7a3f82b228912a8a36bf1ae69cb67c6f8a118fae619d0c8abaa6fd9f6", + "after_sha256": "a77c952e9e1a37a3504ccd7001a7a2493d60d46f147f277071829cd05646e31c", + "operation": "write" + }, + { + "repo": "risk-nexus", + "path": "registry/capabilities/capability.security.risk-register.md", + "before_sha256": null, + "after_sha256": "f71a783e4bf946271b471c39921f88a21772cf5424017eea5b7660bb3614deb6", + "operation": "write" + }, + { + "repo": "risk-nexus", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "53f0bf9e0aa06a6db0aa991f0ebdaa1d2bf74cfaf4e30eed8c003a4d2186a746", + "operation": "write" + }, + { + "repo": "role-engine", + "path": "registry/capabilities/capability.organization.role-catalog.md", + "before_sha256": null, + "after_sha256": "e9b6bfdedafcaf2e61145d33bddcd24f85b281b42853d27c0e512f985726d5f1", + "operation": "write" + }, + { + "repo": "role-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "1188e02e0333664b3554d11c59c12942fef9e29e6491b186dcec67e6ae3e8a5c", + "operation": "write" + }, + { + "repo": "runbook-tutorials", + "path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "before_sha256": "9e22f7b357ce207fd77ad9cb170ba2ddeeed51e939d22f18dd76ff8b85fdeaea", + "after_sha256": "f25e5d9b0a061b65b0f6cc02f2f961cdcb71f7b09cfc76e42d36ae959033962f", + "operation": "write" + }, + { + "repo": "runbook-tutorials", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "4ff0949db41cafa761d3aec672fc376c5a424f90d8c1084f27975091d4e40a3a", + "after_sha256": "a74fa708c4fea755f5c52504bd227393888cca78c043349cdc182c4d783390e5", + "operation": "write" + }, + { + "repo": "sand-boxer", + "path": "registry/capabilities/execution.sandbox-provision.md", + "before_sha256": "34def3b3742df4af67e6f3e8e53d77288b1273869cc7b9583d2f388a998bc4ec", + "after_sha256": "64c68c78b383541c9e9fb832f215ca360733d692289331f012d7b8479ef81a6a", + "operation": "write" + }, + { + "repo": "sand-boxer", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "2c51e1829bb318f366bc94a7cbd99613d7286a1812a9c3fa82892a9b9bbbf87d", + "after_sha256": "a182d5672d088e80b79eacff9cb37fc2f3518c3c100537e18d125abc7f169e96", + "operation": "write" + }, + { + "repo": "sbom-nexus", + "path": "registry/capabilities/capability.infotech.sbom-management.md", + "before_sha256": "77dffddd091d5cab2d65b4edef82f4660cb194a30f519b6b78f348082bb39f1d", + "after_sha256": "f9dafe83c7d497a7c412106e2ce743bd34d75e419d075a5b19fd99ded87f2a72", + "operation": "write" + }, + { + "repo": "sbom-nexus", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "fe489981819ca807058298915d80d35da7acf05f7d2c5c600742d2e342805ff4", + "after_sha256": "ed6efd581483d0058a3928b365b933cbbd98c035b0a75c866156a69961d74edc", + "operation": "write" + }, + { + "repo": "secrets-engine", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "before_sha256": "edfb14edaf244cd52c2bac0439383a40bc8bc8e94403dd2ae19e2ce202981217", + "after_sha256": null, + "operation": "delete" + }, + { + "repo": "secrets-engine", + "path": "registry/capabilities/capability.security.credential-lifecycle.md", + "before_sha256": null, + "after_sha256": "84accd50647b46594ad1f456b157b71c9ad32fe202072773675923584408d4e0", + "operation": "write" + }, + { + "repo": "secrets-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "8cb4e4baacd95a070a96db6d72f4fb3019cffda95606c65896f796ccac0c9c7c", + "after_sha256": "d5d903336d05ccd0b75a49f7be7e866ef89c6bdb6444e8c747a5ffa934a6bbe2", + "operation": "write" + }, + { + "repo": "security-canon", + "path": "registry/capabilities/capability.security.practice-canon.md", + "before_sha256": null, + "after_sha256": "e189be678ef2510848caa5f5b3c190ecd9f7db9db8be762e9e215ae6827e62d5", + "operation": "write" + }, + { + "repo": "security-canon", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "9b9f9348e560a72d8032f62b2ba4820d81fe182353ccc886e4f5c57cbdea563f", + "operation": "write" + }, + { + "repo": "state-hub", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "before_sha256": "e0638d981eec171f5602ecf3f7fdab538b4619721d39a7bd6da23ff5370092d4", + "after_sha256": "818428997975e8f2d64d85946937b4076806a9eedda1a31d1f701f80d1a6cf31", + "operation": "write" + }, + { + "repo": "state-hub", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "before_sha256": "b5603db4665ab9cfc83021675c2be1a8050e2ee01d55d932c9a3b7b8ee697a38", + "after_sha256": "71dacad9cca8df30d487720e3072a278c489e6c52d74b3fcb84f26d61c07c846", + "operation": "write" + }, + { + "repo": "state-hub", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "670eb608e5dcfc10d49b15f28ff6b558ac6329f1142f893a7e8a14c9b297b257", + "after_sha256": "eab454bd985ab6ab83c38fd29e6e58ebdfe1e09bbc5388edddaa07a88133619a", + "operation": "write" + }, + { + "repo": "tenant-engine", + "path": "registry/capabilities/capability.identity.tenant-facts.md", + "before_sha256": null, + "after_sha256": "504341300c2e0760af214ae33946fdd31ebef605855d1250b34503349ec38370", + "operation": "write" + }, + { + "repo": "tenant-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "baab80c50d7f57ec13b795152cc128f92292e19465fe2cb48c44c4e779da54a1", + "after_sha256": "4131f1b63e52306f267204cdfb0faa90d6550f8bca51f97cf1062becea95d805", + "operation": "write" + }, + { + "repo": "the-custodian", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "before_sha256": "f03fb35d7e24f9d7fd4505f43d550af54adb59c86a223602b702d3330e0e0921", + "after_sha256": "9e136682c02d963076c89eb1f4d4b956666ece2cf0747db27986a77d0c63d1b0", + "operation": "write" + }, + { + "repo": "the-custodian", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "f18cbe0cedf4dea687efccd6fb14d102ac494d8c4ce621f619ade603fc6d2ce7", + "after_sha256": "cfe7f25e91fee824347aa22ccee2a70e7dd58ac06a7106f7e2ec9e54dc163020", + "operation": "write" + }, + { + "repo": "user-engine", + "path": "registry/capabilities/capability.identity.user-engine.md", + "before_sha256": "c68b720a06c91acbf4da85d5fc0cc6898a785140857beb93b14f81e7a343ed07", + "after_sha256": "3c9c8f1bb00b66d5f556da9cd33f42470a2e6bcfa3b3f3e9b4e8d1881db5f010", + "operation": "write" + }, + { + "repo": "user-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": "1334f4f654260ab4e7d8738776b587c3e190005d07688c9e7c8bfaab9f5d91cc", + "after_sha256": "7133c52c2013cea70d07d33960f145c370d33a8b4397c1dc927769fcaf200cbd", + "operation": "write" + }, + { + "repo": "whitehat-security", + "path": "registry/capabilities/capability.security.adversarial-evidence.md", + "before_sha256": null, + "after_sha256": "0fecc5e5ede496b0f5c4a42e1b0166e5c3f156ede9c6f3813d59b6e8eb54c82d", + "operation": "write" + }, + { + "repo": "whitehat-security", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "e4bf9bac7f62f60cf10a9fbd25aa8200c22f13d61861862ff5fa1cc90b55f37c", + "operation": "write" + }, + { + "repo": "zone-engine", + "path": "registry/capabilities/capability.security.zone-reference.md", + "before_sha256": null, + "after_sha256": "d1b4c433ad91bf4a30b02c353f5cef387b6d63d8f58defabf6f16fed15816aae", + "operation": "write" + }, + { + "repo": "zone-engine", + "path": "registry/indexes/capabilities.yaml", + "before_sha256": null, + "after_sha256": "b6b196089a3011f16e8a38f6914589efc72a29ee3aca4bc0c5e3cf30bee97ec4", + "operation": "write" + } +] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-publication.json b/docs/assessments/netkingdom-2026-10-14/registry-publication.json new file mode 100644 index 00000000..3f641632 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-publication.json @@ -0,0 +1,655 @@ +[ + { + "repo": "access-engine", + "commit": "62ac2b4e99dec2005c7c407fe633612578a7907d", + "parent": "16ca97b2776789f730cc7049a2d6533612faaccd", + "paths": [ + "registry/capabilities/capability.authorization.policy-evaluate.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "activity-core", + "commit": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0", + "parent": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df", + "paths": [ + "registry/capabilities/capability.activity.event-coordinate.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "agentic-resources", + "commit": "c4cedab945e047de068428fb943f346f093b22dc", + "parent": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709", + "paths": [ + "registry/NO_CAPABILITIES.md", + "registry/capabilities/capability.agents.performance-learning.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "approval-engine", + "commit": "db850aded5fc3b5d35938d26e8084e436a83943b", + "parent": "e1649617e8ad321f79632d5fd33e973ae5d5ae51", + "paths": [ + "registry/capabilities/capability.security.approval-lifecycle.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "audit-core", + "commit": "8d4bde6ece39ce0df3a3cc49da38613123e8f215", + "parent": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9", + "paths": [ + "registry/capabilities/capability.audit.event-retain.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "coordination-engine", + "commit": "16de8fc3f70020df646f1ebdca705a1bf88485a0", + "parent": "c401067842072b75717f76480dd6e7db1836059c", + "paths": [ + "registry/NO_CAPABILITIES.md", + "registry/capabilities/capability.coordination.cross-owner-work.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "emergent-security", + "commit": "6eead2a922ae2eb81593213f54bf1f35e1c9970f", + "parent": "4c6fda38298fa50665ead41526b893adf069d335", + "paths": [ + "registry/capabilities/capability.security.agent-knowledge.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "fin-hub", + "commit": "cace0fda7474304cc42028287f7ba1327ab07d00", + "parent": "8f527c6705bbf5d7ffed43559411ca748bec8fe4", + "paths": [ + "registry/capabilities/capability.finance.security-budget-evidence.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "gate-house", + "commit": "ab1a299674679ccfefa8df84b877614ac44c9d38", + "parent": "bc890c4d050a2e726ce8988a8260ab9caea133e3", + "paths": [ + "registry/capabilities/capability.security.doctrine-review.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "glas-harness", + "commit": "dc88f302044c7c2b41795958527e64be8a83e3ab", + "parent": "7b1557ba14f483569b90ebfdc2d0136fa69602fe", + "paths": [ + "registry/capabilities/capability.execution.profile-harness.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "info-tech-canon", + "commit": "9b9be2ec8e846ceaa05fa644323b02d8603e39b6", + "parent": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e", + "paths": [ + "registry/capabilities/capability.infotech.canon-service.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "informed-decision", + "commit": "faae9cb0dbaf4c8d23f838183f513c302ad3b9f0", + "parent": "ee6a65b80a0fea1a914dfa31434b903669656c09", + "paths": [ + "registry/capabilities/capability.security.human-decision-workspace.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "issue-core", + "commit": "1427d268a09b9334a98a167230ec7dd1d4a82053", + "parent": "de368271f6ffc06353ec409998a0d6d0ec0bf25e", + "paths": [ + "registry/capabilities/capability.infotech.issue-tracking.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "key-cape", + "commit": "61ee563b1ff7f027527ea0c6d5b0e305ed66e5f0", + "parent": "1344fc80e56315c5c99f58993f9ee02ce79e8a76", + "paths": [ + "registry/capabilities/capability.iam.key-cape.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "kings-guard", + "commit": "6aea834dc556067672f31ed762f44a39bad988e3", + "parent": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7", + "paths": [ + "registry/capabilities/capability.security.posture-assessment.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "maturity-engine", + "commit": "363e8160a4910766e9380fabee68a8642dd45ccf", + "parent": "2ef97c87a0f818a906aa42942c32d6c69f9ec899", + "paths": [ + "registry/capabilities/capability.security.maturity-claims.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": true, + "local_unrelated_head_preserved": "2f1de542cc8f24a79452f906d99f95be39d8b6a9", + "publication_checkout": "/tmp/netkingdom-registry-maturity-engine-vwnfdte1" + }, + { + "repo": "net-kingdom", + "commit": "e99c3e9791d1e53e8b0c8030d71b577f611fa901", + "parent": "1a36e857cc5aae6fe738f794417126c46dd94627", + "paths": [ + "registry/capabilities/capability.security.iam-tooling-suite.md", + "registry/capabilities/capability.security.scenario-compose.md", + "registry/capabilities/capability.security.posture-feedback.md", + "registry/capabilities/capability.security.case-contracts.md", + "registry/capabilities/capability.security.bootstrap-recovery.md", + "registry/capabilities/capability.security.emission-profile.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "ops-bridge", + "commit": "2246656f43fa5eae3ae917f63ea1dfa3f53f4a00", + "parent": "190ef1e188e12c606f1359325fd9fdd1dbef29e2", + "paths": [ + "registry/capabilities/capability.ops.tunnel-bridge.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "ops-mason", + "commit": "6434877a44e20396dc85652ad22a55f0a89d16d0", + "parent": "d86ad141befb6800468f5132d4c7c9ce2f852bb5", + "paths": [ + "registry/capabilities/capability.security.structure-construction.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "ops-warden", + "commit": "11b2a9d7bc97f5fe8606927c17fe8acc59b79cd0", + "parent": "6d2f1be9691b19e826898a2166ae4451e4802ae2", + "paths": [ + "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "registry/capabilities/capability.security.access-routing.md", + "registry/capabilities/capability.security.case-follow-through.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "policy-nexus", + "commit": "c14561b2e5318e9637ba93e4c96c06a2db92d0c4", + "parent": "f784f017b0822f34c785f0b34c7c55fcf39c9d99", + "paths": [ + "registry/capabilities/capability.security.policy-publication.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rail-kubernetes", + "commit": "5fad47fdfb7d4cabc21cf10f52ac733ef59803b0", + "parent": "35159e49c1340b7a0e30c49188975c8839d346f6", + "paths": [ + "registry/capabilities/capability.railiance.kubernetes-rail.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-apps", + "commit": "72bcad86d7531bcc27f0e465a9385be559ba0c9f", + "parent": "706461b845086ee2df8ce9acae3dae7feebfffda", + "paths": [ + "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-bootstrap", + "commit": "70bd14d3b941a49c78bbc51d8faab5ab1da1df76", + "parent": "ae00b2652737aaf18358431e66f59eeb7c01e16b", + "paths": [ + "registry/capabilities/capability.railiance.bootstrap-sequencing.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-cluster", + "commit": "750c3e5b9b4623c52bce2b8fbd758f423f81f6c1", + "parent": "12d1e881ff2086566712fbc591db293b38ea2bcf", + "paths": [ + "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-enablement", + "commit": "ce9f6d1be8ff73afdedd6d666a8485e6c7348069", + "parent": "51a7c4cee68b48ed7a236e661b39c1d3cca92063", + "paths": [ + "registry/capabilities/capability.railiance.ci-enablement.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-fabric", + "commit": "095342c72ab6f02c72dd5d40e869dcba536bc5c1", + "parent": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e", + "paths": [ + "registry/capabilities/capability.railiance.fabric-graph.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-forge", + "commit": "6e8f657e55e96b4e9f3d9d74a27b420b68467e61", + "parent": "a15fac8e938c11b041eb39386f05b63d46ae566a", + "paths": [ + "registry/capabilities/capability.railiance.forge-infrastructure.md", + "registry/capabilities/capability.security.forge-secret-prevention.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-infra", + "commit": "c42797a2ddd02270de5f6ad9fbf3270ad5fa171e", + "parent": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca", + "paths": [ + "registry/capabilities/capability.railiance.infra-provisioning.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-master", + "commit": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4", + "parent": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7", + "paths": [ + "registry/capabilities/capability.railiance.security-consumption-contracts.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-platform", + "commit": "a86dfe2220ed59061d8c1177ecff35d8317f08ee", + "parent": "d303c99e3be993ffa989bc9ba3d7b471903858ce", + "paths": [ + "registry/capabilities/capability.railiance.platform-services.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "railiance-telemetry", + "commit": "8cdb2d11dda03bd6839750d059b37932f069e66a", + "parent": "81d905971c38de9aaf11088ba605e112152d8268", + "paths": [ + "registry/capabilities/capability.observability.security-signals.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rapp-openbao", + "commit": "35672be138036c8433a5ac5de91e068c03c2b124", + "parent": "13ab9144bbb1d88fe760362df91a83c8b34e4e66", + "paths": [ + "registry/capabilities/capability.railiance.openbao-package.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rapp-playwright", + "commit": "4f76a87f67fdd9dab19564bb84235397e2f2470a", + "parent": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "paths": [ + "registry/capabilities/capability.railiance.browser-verification.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rapp-policy-nexus", + "commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", + "parent": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda", + "paths": [ + "registry/capabilities/capability.railiance.policy-publication-package.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rapp-postgres", + "commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "parent": "03744030c9258e920f6403a9ce184a26d7b75268", + "paths": [ + "registry/capabilities/capability.railiance.postgres-isolation-recovery.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rapp-telemetry", + "commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5", + "parent": "17053dbc47f7c22efd67fd90d06d108d154835fa", + "paths": [ + "registry/capabilities/capability.railiance.telemetry-package.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rapp-tenant-engine", + "commit": "9bdc86572728783a5ed94266f04f7b12d414c557", + "parent": "c160be23577ab4d99ee2cd008deb455b07f0597d", + "paths": [ + "registry/capabilities/capability.railiance.tenant-engine-package.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rapp-user-engine", + "commit": "2bfcc5f7d43dc4bce88780133ce9ec93acd51f83", + "parent": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c", + "paths": [ + "registry/capabilities/capability.railiance.user-engine-package.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "reef-railiance", + "commit": "33b840faac109f134bf1115d631d5b1242052d9a", + "parent": "ffb9e272ce1489cc37cc6388873558d8ba56c239", + "paths": [ + "registry/capabilities/capability.railiance.substrate-bindings.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rein-aharness", + "commit": "a58d11ce8ae9ea07baf0682c4f860caa251692b3", + "parent": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42", + "paths": [ + "registry/capabilities/capability.execution.scheduled-agent-rein.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "rein-openweights", + "commit": "a2e428a76592d79982ea3c4eba5f137a12fb44e4", + "parent": "e1fccb39b738a5381a9de6e1d799f124797798ce", + "paths": [ + "registry/capabilities/capability.execution.openweight-rein.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "repo-manager", + "commit": "97ea2489257de08911cc5da1e1b84d8e15780dc3", + "parent": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa", + "paths": [ + "registry/capabilities/capability.security.repository-secret-prevention.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "resource-control", + "commit": "ac4e1c43e6d82ecd81108f3b006454ac6aa76722", + "parent": "3604d468f86ede7d320f4d22dd4aea775306b53f", + "paths": [ + "registry/capabilities/capability.resources.security-capacity.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "reuse-surface", + "commit": "bf199707ff7ee9870472622ea73cb180b72acfe3", + "parent": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1", + "paths": [ + "registry/capabilities/capability.registry.register.md", + "registry/capabilities/capability.registry.validate.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "risk-nexus", + "commit": "c2b3a9e679acb61d76ef0f7c1a6ec8ae340e6e24", + "parent": "b877231d66e1289dc32fda07ed2c61dcb3e970dc", + "paths": [ + "registry/capabilities/capability.security.risk-register.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "role-engine", + "commit": "c9d6d0763542f632f1d9b799d63b6b85cf8eaaab", + "parent": "d231241dbfeeb541b34243f4022883aa6417a1eb", + "paths": [ + "registry/capabilities/capability.organization.role-catalog.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "runbook-tutorials", + "commit": "f0ea260895e8ad8e60f24bf64a89be063b7f8e13", + "parent": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e", + "paths": [ + "registry/capabilities/capability.infotech.runbook-tutorials.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "sand-boxer", + "commit": "7ddf92070f2fa267d79f8cad0aa07d16f0cd6410", + "parent": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d", + "paths": [ + "registry/capabilities/execution.sandbox-provision.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "sbom-nexus", + "commit": "db76194330b9502e9a1085ae25cdd27ce264ec7b", + "parent": "07e998d9abfd4e4fcc74db9e292ed22c6f407522", + "paths": [ + "registry/capabilities/capability.infotech.sbom-management.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "secrets-engine", + "commit": "6bd7129eac94131b4cf689e47cbdc9899418beb3", + "parent": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d", + "paths": [ + "registry/capabilities/capability.infotech.repo-template.md", + "registry/capabilities/capability.security.credential-lifecycle.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "security-canon", + "commit": "c31c3008a53bcff07be09d0507d4693d27b40a5a", + "parent": "1664a6def20be2759a1e575024563efd27c9f36f", + "paths": [ + "registry/capabilities/capability.security.practice-canon.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "state-hub", + "commit": "2a2ac2eb195a073633f4db0f166b927ca1877d67", + "parent": "4ffc7236735afc6223aa613262483ea911307714", + "paths": [ + "registry/capabilities/capability.statehub.workstream-coordinate.md", + "registry/capabilities/capability.statehub.progress-log.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "tenant-engine", + "commit": "79a61905957bd78d3f4c93da42d7034ad3e3c8de", + "parent": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c", + "paths": [ + "registry/capabilities/capability.identity.tenant-facts.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "the-custodian", + "commit": "e8bd394c8b79741a4bb3b1d09c8b495ca41d7c0f", + "parent": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e", + "paths": [ + "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "user-engine", + "commit": "2f20c02cad1fcdc6d9070a08ba4d5b688f79b80c", + "parent": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79", + "paths": [ + "registry/capabilities/capability.identity.user-engine.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "whitehat-security", + "commit": "42fe7a12c7d9d64142ec0e820ba4e975ffeac593", + "parent": "5587a8f6ac4b129527db819bc72832051c7fcc3b", + "paths": [ + "registry/capabilities/capability.security.adversarial-evidence.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + }, + { + "repo": "zone-engine", + "commit": "7e7e3f307ca996c373e91009ed1b9b0cbc6fcb9e", + "parent": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0", + "paths": [ + "registry/capabilities/capability.security.zone-reference.md", + "registry/indexes/capabilities.yaml" + ], + "verified_remote": true, + "isolated_publication": false + } +] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage-validation.json b/docs/assessments/netkingdom-2026-10-14/registry-stage-validation.json new file mode 100644 index 00000000..eb1055c8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage-validation.json @@ -0,0 +1,350 @@ +[ + { + "repo": "access-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "activity-core", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "agentic-resources", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "approval-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "audit-core", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "coordination-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "emergent-security", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "fin-hub", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "gate-house", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "glas-harness", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "info-tech-canon", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "informed-decision", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "issue-core", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "key-cape", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "kings-guard", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "maturity-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "net-kingdom", + "entries": 6, + "errors": [], + "warnings": [] + }, + { + "repo": "ops-bridge", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "ops-mason", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "ops-warden", + "entries": 3, + "errors": [], + "warnings": [] + }, + { + "repo": "policy-nexus", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rail-kubernetes", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-apps", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-bootstrap", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-cluster", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-enablement", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-fabric", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-forge", + "entries": 2, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-infra", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-master", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-platform", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "railiance-telemetry", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rapp-openbao", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rapp-playwright", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rapp-policy-nexus", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rapp-postgres", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rapp-telemetry", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rapp-tenant-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rapp-user-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "reef-railiance", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rein-aharness", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "rein-openweights", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "repo-manager", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "resource-control", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "reuse-surface", + "entries": 3, + "errors": [], + "warnings": [] + }, + { + "repo": "risk-nexus", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "role-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "runbook-tutorials", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "sand-boxer", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "sbom-nexus", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "secrets-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "security-canon", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "state-hub", + "entries": 2, + "errors": [], + "warnings": [] + }, + { + "repo": "tenant-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "the-custodian", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "user-engine", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "whitehat-security", + "entries": 1, + "errors": [], + "warnings": [] + }, + { + "repo": "zone-engine", + "entries": 1, + "errors": [], + "warnings": [] + } +] diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md new file mode 100644 index 00000000..c98d0d2e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/capabilities/capability.authorization.policy-evaluate.md @@ -0,0 +1,135 @@ +--- +id: capability.authorization.policy-evaluate +name: Policy evaluation and decision evidence +summary: Check, batch, list-allowed, explain, binding, lifetime and decision records. +owner: access-engine +status: draft +domain: helix_forge +tags: +- authorization +- policy +- flex-auth +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D6 + confidence: medium + rationale: flex-auth INTENT defines policy-as-code boundary and enterprise growth + path. + availability: + current: A4 + target: A5 + confidence: low + rationale: 'Source interface assessed 2026-10-14: Check, batch, list-allowed, + explain, binding, lifetime and decision records. Availability describes the + delivery form, not production acceptance. One PDP owner with per-consumer deployments; + signed envelope production and consumer adoption are distinct.' +external_evidence: + completeness: + level: C2 + name: Partial + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - policy-as-code intent documented + broken_expectations: + - not yet indexed from flex-auth native registry + out_of_scope_expectations: + - identity proofing + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - early implementation phase +discovery: + intent: Check, batch, list-allowed, explain, binding, lifetime and decision records + includes: + - Check, batch, list-allowed, explain, binding, lifetime and decision records + excludes: + - One PDP owner with per-consumer deployments; signed envelope production and consumer + adoption are distinct + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A4 + target_level: A5 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - HTTP API + - source +relations: + depends_on: + - capability.identity.subject-resolution + related_to: + - capability.feature-control.evaluate + - capability.security.approval-lifecycle + - capability.iam.key-cape + - capability.identity.tenant-facts + - capability.security.zone-reference + - capability.security.maturity-claims +consumer_guidance: + recommended_for: + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - One PDP owner with per-consumer deployments; signed envelope production and consumer + adoption are distinct + known_limitations: + - One PDP owner with per-consumer deployments; signed envelope production and consumer + adoption are distinct + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A2 + to: A4 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +evidence: + documentation: + - SCOPE.md + - README.md +--- + +# Policy evaluation and decision evidence + +Check, batch, list-allowed, explain, binding, lifetime and decision records. + +## Reuse boundary + +One PDP owner with per-consumer deployments; signed envelope production and consumer adoption are distinct. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..ba6c2d13 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/access-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.authorization.policy-evaluate + name: Policy evaluation and decision evidence + summary: Check, batch, list-allowed, explain, binding, lifetime and decision records. + domain: helix_forge + status: draft + owner: access-engine + tags: + - authorization + - policy + - flex-auth + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.authorization.policy-evaluate.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/capabilities/capability.activity.event-coordinate.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/capabilities/capability.activity.event-coordinate.md new file mode 100644 index 00000000..0aa462dc --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/capabilities/capability.activity.event-coordinate.md @@ -0,0 +1,122 @@ +--- +id: capability.activity.event-coordinate +name: Durable automation and bounded operations +summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime + sinks. +owner: activity-core +status: draft +domain: helix_forge +tags: +- activity +- coordination +- automation +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: activity-core INTENT defines org-wide event response boundary. + availability: + current: A4 + target: A4 + confidence: low + rationale: 'Source interface assessed 2026-10-14: Temporal/NATS/webhook/manual + trigger, validated definitions and evidence/runtime sinks. Availability describes + the delivery form, not production acceptance. Not a general shell executor; + first unassisted security-flow cadence acceptance remains open.' +external_evidence: + completeness: + level: C1 + name: Fragmentary + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - problem and boundary documented in INTENT + broken_expectations: + - no registry-native automation artifacts indexed yet + out_of_scope_expectations: + - owning domain-specific business logic + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: [] +discovery: + intent: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime + sinks + includes: + - Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime + sinks + excludes: + - Not a general shell executor; first unassisted security-flow cadence acceptance + remains open + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - HTTP API + - source +relations: + depends_on: [] + related_to: + - capability.statehub.workstream-coordinate + - capability.audit.event-retain + - capability.security.iam-tooling-suite +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Developer builds and publishes through controlled source, dependency and runner + paths + not_recommended_for: + - Not a general shell executor; first unassisted security-flow cadence acceptance + remains open + known_limitations: + - Not a general shell executor; first unassisted security-flow cadence acceptance + remains open + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A1 + to: A4 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +evidence: + documentation: + - SCOPE.md + - README.md +--- + +# Durable automation and bounded operations + +Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks. + +## Reuse boundary + +Not a general shell executor; first unassisted security-flow cadence acceptance remains open. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U12: Developer builds and publishes through controlled source, dependency and runner paths + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..4c549761 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/activity-core/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.activity.event-coordinate + name: Durable automation and bounded operations + summary: Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime + sinks. + domain: helix_forge + status: draft + owner: activity-core + tags: + - activity + - coordination + - automation + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.activity.event-coordinate.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/capabilities/capability.agents.performance-learning.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/capabilities/capability.agents.performance-learning.md new file mode 100644 index 00000000..be286a9a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/capabilities/capability.agents.performance-learning.md @@ -0,0 +1,93 @@ +--- +id: capability.agents.performance-learning +owner: agentic-resources +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Capture sessions, curate patterns, + distribute lessons and measure outcomes. Availability describes the delivery + form, not production acceptance. Workforce assignments and broader authority + contracts remain proposed.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Agent performance learning +summary: Capture sessions, curate patterns, distribute lessons and measure outcomes. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Capture sessions, curate patterns, distribute lessons and measure outcomes + includes: + - Capture sessions, curate patterns, distribute lessons and measure outcomes + excludes: + - Workforce assignments and broader authority contracts remain proposed + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.execution.profile-harness + - capability.activity.event-coordinate + - capability.finance.security-budget-evidence +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - Workforce assignments and broader authority contracts remain proposed + known_limitations: + - Workforce assignments and broader authority contracts remain proposed + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Agent performance learning + +Capture sessions, curate patterns, distribute lessons and measure outcomes. + +## Reuse boundary + +Workforce assignments and broader authority contracts remain proposed. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..a13c88b7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/agentic-resources/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.agents.performance-learning + name: Agent performance learning + summary: Capture sessions, curate patterns, distribute lessons and measure outcomes. + domain: infotech + status: draft + owner: agentic-resources + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.performance-learning.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/capabilities/capability.security.approval-lifecycle.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/capabilities/capability.security.approval-lifecycle.md new file mode 100644 index 00000000..a279f1f9 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/capabilities/capability.security.approval-lifecycle.md @@ -0,0 +1,112 @@ +--- +id: capability.security.approval-lifecycle +owner: approval-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Authenticated issue, claim, + revoke, supersede and atomic consume API with outbox. Availability describes + the delivery form, not production acceptance. Deployed schema v5 and source + v6 differ; named PEP and issuer acceptance remain open.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Bound approval lifecycle +summary: Authenticated issue, claim, revoke, supersede and atomic consume API with + outbox. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Authenticated issue, claim, revoke, supersede and atomic consume API with + outbox + includes: + - Authenticated issue, claim, revoke, supersede and atomic consume API with outbox + excludes: + - Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain + open + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + - approval_engine/api.py + - docs/production-dependencies.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.authorization.policy-evaluate + - capability.iam.key-cape + - capability.security.credential-lifecycle + - capability.audit.event-retain +evidence: + documentation: + - SCOPE.md + - approval_engine/api.py + - docs/production-dependencies.md +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain + open + known_limitations: + - Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain + open + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Bound approval lifecycle + +Authenticated issue, claim, revoke, supersede and atomic consume API with outbox. + +## Reuse boundary + +Deployed schema v5 and source v6 differ; named PEP and issuer acceptance remain open. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [approval_engine/api.py](../../approval_engine/api.py) +- [docs/production-dependencies.md](../../docs/production-dependencies.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..802f8692 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/approval-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.approval-lifecycle + name: Bound approval lifecycle + summary: Authenticated issue, claim, revoke, supersede and atomic consume API with + outbox. + domain: infotech + status: draft + owner: approval-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.approval-lifecycle.md + consumption_modes: + - HTTP API + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/capabilities/capability.audit.event-retain.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/capabilities/capability.audit.event-retain.md new file mode 100644 index 00000000..3bb5ef66 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/capabilities/capability.audit.event-retain.md @@ -0,0 +1,115 @@ +--- +id: capability.audit.event-retain +owner: audit-core +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Tenant-aware event ingestion, + chain integrity, heartbeat and reconciliation. Availability describes the delivery + form, not production acceptance. Custody after arrival does not prove source + completeness; freshness bounds integrity assertions.' +external_evidence: + completeness: + level: C3 + name: Substantial + confidence: medium + basis: live_receiver_and_restore_walk + satisfied_expectations: + - HTTP ingest through the backend contract + - append-only Postgres custody on platform-pg + - recovery cited to the live platform data.backup provision + broken_expectations: + - data.archive sink not provided + out_of_scope_expectations: + - application business audit semantics ownership + - booked-cost origination + reliability: + level: R2 + confidence: medium + basis: failure_matrix_and_restore_walk + known_reliability_risks: + - single replica +name: Independent audit custody +summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation + includes: + - Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation + excludes: + - Custody after arrival does not prove source completeness; freshness bounds integrity + assertions + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + - docs/stream-completeness.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.security.approval-lifecycle + - capability.identity.tenant-facts + - capability.security.posture-assessment + - capability.observability.security-signals +evidence: + documentation: + - SCOPE.md + - docs/stream-completeness.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Operator recovers identity, custody or data with independently held recovery material + not_recommended_for: + - Custody after arrival does not prove source completeness; freshness bounds integrity + assertions + known_limitations: + - Custody after arrival does not prove source completeness; freshness bounds integrity + assertions + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Independent audit custody + +Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. + +## Reuse boundary + +Custody after arrival does not prove source completeness; freshness bounds integrity assertions. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/stream-completeness.md](../../docs/stream-completeness.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..6248a85f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/audit-core/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +capabilities: +- id: capability.audit.event-retain + name: Independent audit custody + summary: Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation. + domain: infotech + status: draft + owner: audit-core + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C3 / R2 + path: registry/capabilities/capability.audit.event-retain.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/capabilities/capability.coordination.cross-owner-work.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/capabilities/capability.coordination.cross-owner-work.md new file mode 100644 index 00000000..018f787f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/capabilities/capability.coordination.cross-owner-work.md @@ -0,0 +1,91 @@ +--- +id: capability.coordination.cross-owner-work +owner: coordination-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Observation, lease, wake-up, + checkpoint and receipt contracts/runtime. Availability describes the delivery + form, not production acceptance. Coordinates owners without replacing their + execution or security authority.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Cross-owner coordination lifecycle +summary: Observation, lease, wake-up, checkpoint and receipt contracts/runtime. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Observation, lease, wake-up, checkpoint and receipt contracts/runtime + includes: + - Observation, lease, wake-up, checkpoint and receipt contracts/runtime + excludes: + - Coordinates owners without replacing their execution or security authority + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - spec/cross-owner-wait-mode-v0.1.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - spec/cross-owner-wait-mode-v0.1.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Coordinates owners without replacing their execution or security authority + known_limitations: + - Coordinates owners without replacing their execution or security authority + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Cross-owner coordination lifecycle + +Observation, lease, wake-up, checkpoint and receipt contracts/runtime. + +## Reuse boundary + +Coordinates owners without replacing their execution or security authority. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [spec/cross-owner-wait-mode-v0.1.md](../../spec/cross-owner-wait-mode-v0.1.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..b65764d7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/coordination-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.coordination.cross-owner-work + name: Cross-owner coordination lifecycle + summary: Observation, lease, wake-up, checkpoint and receipt contracts/runtime. + domain: infotech + status: draft + owner: coordination-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.coordination.cross-owner-work.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/capabilities/capability.security.agent-knowledge.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/capabilities/capability.security.agent-knowledge.md new file mode 100644 index 00000000..86d56b46 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/capabilities/capability.security.agent-knowledge.md @@ -0,0 +1,103 @@ +--- +id: capability.security.agent-knowledge +owner: emergent-security +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Versioned source-pinned cards, + read-only CLI, provider adapters and sealed exports. Availability describes + the delivery form, not production acceptance. Current start card withheld for + source drift; orientation never grants authority.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Verified security orientation for agents +summary: Versioned source-pinned cards, read-only CLI, provider adapters and sealed + exports. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Versioned source-pinned cards, read-only CLI, provider adapters and sealed + exports + includes: + - Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports + excludes: + - Current start card withheld for source drift; orientation never grants authority + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - knowledge/cards/start.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + - capability.security.doctrine-review + - capability.execution.profile-harness +evidence: + documentation: + - SCOPE.md + - knowledge/cards/start.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Agent executes an attributable bounded task and supplies supervision evidence + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Current start card withheld for source drift; orientation never grants authority + known_limitations: + - Current start card withheld for source drift; orientation never grants authority + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Verified security orientation for agents + +Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports. + +## Reuse boundary + +Current start card withheld for source drift; orientation never grants authority. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U11: Agent executes an attributable bounded task and supplies supervision evidence +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [knowledge/cards/start.md](../../knowledge/cards/start.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..e4333686 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/emergent-security/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.agent-knowledge + name: Verified security orientation for agents + summary: Versioned source-pinned cards, read-only CLI, provider adapters and sealed + exports. + domain: infotech + status: draft + owner: emergent-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.agent-knowledge.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/capabilities/capability.finance.security-budget-evidence.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/capabilities/capability.finance.security-budget-evidence.md new file mode 100644 index 00000000..fec8857f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/capabilities/capability.finance.security-budget-evidence.md @@ -0,0 +1,92 @@ +--- +id: capability.finance.security-budget-evidence +owner: fin-hub +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Budget, commitment, spend attribution + and planning-evidence consumption. Availability describes the delivery form, + not production acceptance. No verified concurrent runtime EUR risk/cost enforcement + for agents.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Budget and cost evidence for security operations +summary: Budget, commitment, spend attribution and planning-evidence consumption. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Budget, commitment, spend attribution and planning-evidence consumption + includes: + - Budget, commitment, spend attribution and planning-evidence consumption + excludes: + - No verified concurrent runtime EUR risk/cost enforcement for agents + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.resources.security-capacity + - capability.agents.performance-learning +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - No verified concurrent runtime EUR risk/cost enforcement for agents + known_limitations: + - No verified concurrent runtime EUR risk/cost enforcement for agents + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Budget and cost evidence for security operations + +Budget, commitment, spend attribution and planning-evidence consumption. + +## Reuse boundary + +No verified concurrent runtime EUR risk/cost enforcement for agents. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..3e9bc5c3 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/fin-hub/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.finance.security-budget-evidence + name: Budget and cost evidence for security operations + summary: Budget, commitment, spend attribution and planning-evidence consumption. + domain: infotech + status: draft + owner: fin-hub + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.finance.security-budget-evidence.md + consumption_modes: + - HTTP API + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/capabilities/capability.security.doctrine-review.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/capabilities/capability.security.doctrine-review.md new file mode 100644 index 00000000..564ef16f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/capabilities/capability.security.doctrine-review.md @@ -0,0 +1,100 @@ +--- +id: capability.security.doctrine-review +owner: gate-house +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Layer rules, authority context, + ASM criteria and interpretations. Availability describes the delivery form, + not production acceptance. Staff judgment; no runtime PDP, credential issuer + or automatic enforcement.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security doctrine and architecture review +summary: Layer rules, authority context, ASM criteria and interpretations. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Layer rules, authority context, ASM criteria and interpretations + includes: + - Layer rules, authority context, ASM criteria and interpretations + excludes: + - Staff judgment; no runtime PDP, credential issuer or automatic enforcement + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + - INTENT.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - INTENT.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Staff judgment; no runtime PDP, credential issuer or automatic enforcement + known_limitations: + - Staff judgment; no runtime PDP, credential issuer or automatic enforcement + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security doctrine and architecture review + +Layer rules, authority context, ASM criteria and interpretations. + +## Reuse boundary + +Staff judgment; no runtime PDP, credential issuer or automatic enforcement. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [INTENT.md](../../INTENT.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..f762126f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/gate-house/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.doctrine-review + name: Security doctrine and architecture review + summary: Layer rules, authority context, ASM criteria and interpretations. + domain: infotech + status: draft + owner: gate-house + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.doctrine-review.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/capabilities/capability.execution.profile-harness.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/capabilities/capability.execution.profile-harness.md new file mode 100644 index 00000000..7f458ad2 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/capabilities/capability.execution.profile-harness.md @@ -0,0 +1,91 @@ +--- +id: capability.execution.profile-harness +owner: glas-harness +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A3 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Typed execution requests, profile/rein + resolution, sandbox and cleanup orchestration. Availability describes the delivery + form, not production acceptance. No ready profile asserted by SCOPE; Custodian + native isolation remains open.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Profile-bound agent execution lifecycle +summary: Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration + includes: + - Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration + excludes: + - No ready profile asserted by SCOPE; Custodian native isolation remains open + use_cases: + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A3 + target_level: A3 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - library + - CLI +relations: + related_to: + - capability.execution.sandbox-provision + - capability.execution.scheduled-agent-rein + - capability.execution.openweight-rein +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - No ready profile asserted by SCOPE; Custodian native isolation remains open + known_limitations: + - No ready profile asserted by SCOPE; Custodian native isolation remains open + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Profile-bound agent execution lifecycle + +Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration. + +## Reuse boundary + +No ready profile asserted by SCOPE; Custodian native isolation remains open. + +## Supported use cases + +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..fa1e483a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/glas-harness/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.execution.profile-harness + name: Profile-bound agent execution lifecycle + summary: Typed execution requests, profile/rein resolution, sandbox and cleanup + orchestration. + domain: infotech + status: draft + owner: glas-harness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.execution.profile-harness.md + consumption_modes: + - library + - CLI diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md new file mode 100644 index 00000000..5aa513ea --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/capabilities/capability.infotech.canon-service.md @@ -0,0 +1,124 @@ +--- +id: capability.infotech.canon-service +name: Shared semantic contracts and validation +summary: Markdown canon with library, CLI and read-only API. +owner: info-tech-canon +status: draft +domain: infotech +tags: +- canon +- infospace +- service +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D2 + target: D4 + confidence: medium + rationale: README documents a working CLI surface (inspect, artifacts, models, + standards, review-kit, alignment-template, validate, graph) over one concrete + infospace under infospace/. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Markdown canon with library, + CLI and read-only API. Availability describes the delivery form, not production + acceptance. Mixed seed/candidate maturity; validation is not owner runtime conformance.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - CLI commands for inspect/artifacts/models/standards/review-kit/alignment-template/validate/graph + - read-only local HTTP API + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - depends on infospace-bench for artifact loading/checks/graph summaries; only + one concrete infospace implemented so far +discovery: + intent: Markdown canon with library, CLI and read-only API + includes: + - Markdown canon with library, CLI and read-only API + excludes: + - Mixed seed/candidate maturity; validation is not owner runtime conformance + assumptions: [] + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: [] +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + target_artifacts: [] + consumption_modes: + - HTTP API + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Consumer emits security events and reconciles independently retained evidence + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Mixed seed/candidate maturity; validation is not owner runtime conformance + known_limitations: + - Mixed seed/candidate maturity; validation is not owner runtime conformance + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A2 + to: A4 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# Shared semantic contracts and validation + +Markdown canon with library, CLI and read-only API. + +## Reuse boundary + +Mixed seed/candidate maturity; validation is not owner runtime conformance. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U08: Consumer emits security events and reconciles independently retained evidence +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..9b5087e0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/info-tech-canon/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.infotech.canon-service + name: Shared semantic contracts and validation + summary: Markdown canon with library, CLI and read-only API. + domain: infotech + status: draft + owner: info-tech-canon + tags: + - canon + - infospace + - service + - security + - netkingdom + - framework-reuse + vector: D2 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.canon-service.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/capabilities/capability.security.human-decision-workspace.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/capabilities/capability.security.human-decision-workspace.md new file mode 100644 index 00000000..8cb7a28c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/capabilities/capability.security.human-decision-workspace.md @@ -0,0 +1,106 @@ +--- +id: capability.security.human-decision-workspace +owner: informed-decision +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Headless lifecycle and browser + workspace with exact native approval references. Availability describes the + delivery form, not production acceptance. Initial audience is bounded; Approval + Engine owns approval state, Access Engine decides.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Human security decision presentation and disposition +summary: Headless lifecycle and browser workspace with exact native approval references. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Headless lifecycle and browser workspace with exact native approval references + includes: + - Headless lifecycle and browser workspace with exact native approval references + excludes: + - Initial audience is bounded; Approval Engine owns approval state, Access Engine + decides + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.security.approval-lifecycle + - capability.authorization.policy-evaluate + - capability.statehub.workstream-coordinate +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Initial audience is bounded; Approval Engine owns approval state, Access Engine + decides + known_limitations: + - Initial audience is bounded; Approval Engine owns approval state, Access Engine + decides + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Human security decision presentation and disposition + +Headless lifecycle and browser workspace with exact native approval references. + +## Reuse boundary + +Initial audience is bounded; Approval Engine owns approval state, Access Engine decides. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..0459684a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/informed-decision/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.human-decision-workspace + name: Human security decision presentation and disposition + summary: Headless lifecycle and browser workspace with exact native approval references. + domain: infotech + status: draft + owner: informed-decision + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.security.human-decision-workspace.md + consumption_modes: + - HTTP API + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/capabilities/capability.infotech.issue-tracking.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/capabilities/capability.infotech.issue-tracking.md new file mode 100644 index 00000000..ee452b1c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/capabilities/capability.infotech.issue-tracking.md @@ -0,0 +1,110 @@ +--- +id: capability.infotech.issue-tracking +name: External issue tracker connector +summary: CLI and Python adapters for external issue systems. +owner: issue-core +status: draft +domain: infotech +tags: +- issue-tracking +- connector +- work-record +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: INTENT.md, SCOPE.md, CAPABILITY-issue-tracking.yaml, mapping design, + boundary-sync policy, AGENT_INTEGRATION.md. + availability: + current: A2 + target: A3 + confidence: high + rationale: 'Source interface assessed 2026-10-14: CLI and Python adapters for + external issue systems. Availability describes the delivery form, not production + acceptance. Internal work originates in owner files; external projection is + optional.' +external_evidence: + completeness: + level: C2 + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - Forgejo + local SQLite backends + - CLI with JSON output; project/map commands + - work_record_uuid optional on TaskSpec + - credential handling via env vars (FORGEJO_TOKEN preferred; GITEA_API_TOKEN deprecated + alias; ISSUE_CORE_API_KEY) + broken_expectations: [] + out_of_scope_expectations: + - Fleet task origin / intake promotion (work-record canon) + - Default IssueSink for internal findings (activity-core) + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - manual backend configuration (auto-detect planned) + - no built-in issue locking beyond assignee+state + - inward boundary sync not shipped +discovery: + intent: CLI and Python adapters for external issue systems + includes: + - CLI and Python adapters for external issue systems + excludes: + - Internal work originates in owner files; external projection is optional + assumptions: [] + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - README.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.activity.event-coordinate + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Internal work originates in owner files; external projection is optional + known_limitations: + - Internal work originates in owner files; external projection is optional + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# External issue tracker connector + +CLI and Python adapters for external issue systems. + +## Reuse boundary + +Internal work originates in owner files; external projection is optional. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..682f0567 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/issue-core/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.infotech.issue-tracking + name: External issue tracker connector + summary: CLI and Python adapters for external issue systems. + domain: infotech + status: draft + owner: issue-core + tags: + - issue-tracking + - connector + - work-record + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.infotech.issue-tracking.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/capabilities/capability.iam.key-cape.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/capabilities/capability.iam.key-cape.md new file mode 100644 index 00000000..59cc40e2 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/capabilities/capability.iam.key-cape.md @@ -0,0 +1,138 @@ +--- +id: capability.iam.key-cape +name: OIDC identity and assurance +summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. +owner: key-cape +status: draft +domain: infotech +tags: +- iam +- oidc +- netkingdom +- security +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: README documents a versioned canonical contract (net-kingdom canon/standards/iam-profile_v0.2.md), + explicit lightweight-vs-expanded (Keycloak) migration story, and a completed + implementation status (all 23 workplan tasks, 21 green test packages). + availability: + current: A4 + target: A4 + confidence: high + rationale: 'Source interface assessed 2026-10-14: OIDC code with PKCE, service + tokens, JWKS, MFA and caller CLI. Availability describes the delivery form, + not production acceptance. Current stack is Authelia, LLDAP and privacyIDEA; + service secrets remain static and recovery proof has open gates.' +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - full v0.1 implementation per its own workplan (23/23 tasks) + - 21 test packages, all green + - documented lightweight-to-expanded (Keycloak) migration path + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - maturity claims rely on the repo's own workplan completion record, not independently + re-verified in this sweep +discovery: + intent: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI + includes: + - OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI + excludes: + - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static + and recovery proof has open gates + assumptions: [] + use_cases: + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + research_memos: [] +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + - README.md + target_artifacts: [] + consumption_modes: + - HTTP API + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.identity.user-engine + - capability.identity.tenant-facts + - capability.authorization.policy-evaluate +evidence: + documentation: + - SCOPE.md + - README.md + tests: + - .gitea/workflows/ + - .forgejo/workflows/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Human signs in with MFA and manages account or factor recovery + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator recovers identity, custody or data with independently held recovery material + not_recommended_for: + - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static + and recovery proof has open gates + known_limitations: + - Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static + and recovery proof has open gates + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A2 + to: A4 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# OIDC identity and assurance + +OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. + +## Reuse boundary + +Current stack is Authelia, LLDAP and privacyIDEA; service secrets remain static and recovery proof has open gates. + +## Supported use cases + +- U02: Human signs in with MFA and manages account or factor recovery +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..0718f521 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/key-cape/registry/indexes/capabilities.yaml @@ -0,0 +1,21 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.iam.key-cape + name: OIDC identity and assurance + summary: OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI. + domain: infotech + status: draft + owner: key-cape + tags: + - iam + - oidc + - netkingdom + - security + - framework-reuse + vector: D4 / A4 / C2 / R1 + path: registry/capabilities/capability.iam.key-cape.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/capabilities/capability.security.posture-assessment.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/capabilities/capability.security.posture-assessment.md new file mode 100644 index 00000000..d2facd1c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/capabilities/capability.security.posture-assessment.md @@ -0,0 +1,102 @@ +--- +id: capability.security.posture-assessment +owner: kings-guard +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Normalized observation evaluator, + cadence checks and secret-use snapshot adapter. Availability describes the delivery + form, not production acceptance. Bounded reference pilot; containment proposals + only; deployed-stream admission remains open.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security posture assessment and response proposals +summary: Normalized observation evaluator, cadence checks and secret-use snapshot + adapter. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Normalized observation evaluator, cadence checks and secret-use snapshot + adapter + includes: + - Normalized observation evaluator, cadence checks and secret-use snapshot adapter + excludes: + - Bounded reference pilot; containment proposals only; deployed-stream admission + remains open + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - docs/SecretUseSnapshotAdmission.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.maturity-claims + - capability.audit.event-retain + - capability.security.risk-register + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - docs/SecretUseSnapshotAdmission.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Bounded reference pilot; containment proposals only; deployed-stream admission + remains open + known_limitations: + - Bounded reference pilot; containment proposals only; deployed-stream admission + remains open + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security posture assessment and response proposals + +Normalized observation evaluator, cadence checks and secret-use snapshot adapter. + +## Reuse boundary + +Bounded reference pilot; containment proposals only; deployed-stream admission remains open. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/SecretUseSnapshotAdmission.md](../../docs/SecretUseSnapshotAdmission.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..8cd80d38 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/kings-guard/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.posture-assessment + name: Security posture assessment and response proposals + summary: Normalized observation evaluator, cadence checks and secret-use snapshot + adapter. + domain: infotech + status: draft + owner: kings-guard + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-assessment.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/capabilities/capability.security.maturity-claims.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/capabilities/capability.security.maturity-claims.md new file mode 100644 index 00000000..ce86465f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/capabilities/capability.security.maturity-claims.md @@ -0,0 +1,101 @@ +--- +id: capability.security.maturity-claims +owner: maturity-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: SQLite library and CLI for ladders, + evidence expiry, compute, explain and stance inventory. Availability describes + the delivery form, not production acceptance. No production deployment claimed; + levels supply facts and cannot authorize actions.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Evidence-based maturity claims and gap register +summary: SQLite library and CLI for ladders, evidence expiry, compute, explain and + stance inventory. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: SQLite library and CLI for ladders, evidence expiry, compute, explain and + stance inventory + includes: + - SQLite library and CLI for ladders, evidence expiry, compute, explain and stance + inventory + excludes: + - No production deployment claimed; levels supply facts and cannot authorize actions + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - docs/claim-contract.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.doctrine-review + - capability.authorization.policy-evaluate + - capability.security.posture-assessment +evidence: + documentation: + - SCOPE.md + - docs/claim-contract.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - No production deployment claimed; levels supply facts and cannot authorize actions + known_limitations: + - No production deployment claimed; levels supply facts and cannot authorize actions + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Evidence-based maturity claims and gap register + +SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory. + +## Reuse boundary + +No production deployment claimed; levels supply facts and cannot authorize actions. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/claim-contract.md](../../docs/claim-contract.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..6c46b9ea --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/maturity-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.maturity-claims + name: Evidence-based maturity claims and gap register + summary: SQLite library and CLI for ladders, evidence expiry, compute, explain and + stance inventory. + domain: infotech + status: draft + owner: maturity-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.maturity-claims.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.bootstrap-recovery.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.bootstrap-recovery.md new file mode 100644 index 00000000..ee6f65f3 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.bootstrap-recovery.md @@ -0,0 +1,100 @@ +--- +id: capability.security.bootstrap-recovery +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Local identity, bootstrap console, + encrypted custody handoff and caller tools. Availability describes the delivery + form, not production acceptance. Source repairs and disposable native fixtures + do not prove estate root isolation or recovery.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Guarded bootstrap and recovery preparation +summary: Local identity, bootstrap console, encrypted custody handoff and caller tools. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Local identity, bootstrap console, encrypted custody handoff and caller + tools + includes: + - Local identity, bootstrap console, encrypted custody handoff and caller tools + excludes: + - Source repairs and disposable native fixtures do not prove estate root isolation + or recovery + use_cases: + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/security-bootstrap-console/README.md + - tools/custody-record/README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/security-bootstrap-console/README.md + - tools/custody-record/README.md +consumer_guidance: + recommended_for: + - Operator recovers identity, custody or data with independently held recovery material + not_recommended_for: + - Source repairs and disposable native fixtures do not prove estate root isolation + or recovery + known_limitations: + - Source repairs and disposable native fixtures do not prove estate root isolation + or recovery + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Guarded bootstrap and recovery preparation + +Local identity, bootstrap console, encrypted custody handoff and caller tools. + +## Reuse boundary + +Source repairs and disposable native fixtures do not prove estate root isolation or recovery. + +## Supported use cases + +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [tools/security-bootstrap-console/README.md](../../tools/security-bootstrap-console/README.md) +- [tools/custody-record/README.md](../../tools/custody-record/README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.case-contracts.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.case-contracts.md new file mode 100644 index 00000000..85c58983 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.case-contracts.md @@ -0,0 +1,110 @@ +--- +id: capability.security.case-contracts +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Versioned types, cases and schema + validation. Availability describes the delivery form, not production acceptance. + Type acknowledgment, case acceptance, structural materialization and native + execution are distinct.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security case types and instance validation +summary: Versioned types, cases and schema validation. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Versioned types, cases and schema validation + includes: + - Versioned types, cases and schema validation + excludes: + - Type acknowledgment, case acceptance, structural materialization and native execution + are distinct + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/security-case-types/README.md + - canon/standards/security-case-types_v0.1.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/security-case-types/README.md + - canon/standards/security-case-types_v0.1.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Type acknowledgment, case acceptance, structural materialization and native execution + are distinct + known_limitations: + - Type acknowledgment, case acceptance, structural materialization and native execution + are distinct + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security case types and instance validation + +Versioned types, cases and schema validation. + +## Reuse boundary + +Type acknowledgment, case acceptance, structural materialization and native execution are distinct. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [tools/security-case-types/README.md](../../tools/security-case-types/README.md) +- [canon/standards/security-case-types_v0.1.md](../../canon/standards/security-case-types_v0.1.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.emission-profile.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.emission-profile.md new file mode 100644 index 00000000..2766f8c8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.emission-profile.md @@ -0,0 +1,97 @@ +--- +id: capability.security.emission-profile +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Security profile over generic + emission contracts and validator. Availability describes the delivery form, + not production acceptance. Profile adoption and source completeness require + owner-native evidence.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security emission cadence validation +summary: Security profile over generic emission contracts and validator. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Security profile over generic emission contracts and validator + includes: + - Security profile over generic emission contracts and validator + excludes: + - Profile adoption and source completeness require owner-native evidence + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/emission-cadence-profile/README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/emission-cadence-profile/README.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Profile adoption and source completeness require owner-native evidence + known_limitations: + - Profile adoption and source completeness require owner-native evidence + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security emission cadence validation + +Security profile over generic emission contracts and validator. + +## Reuse boundary + +Profile adoption and source completeness require owner-native evidence. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [tools/emission-cadence-profile/README.md](../../tools/emission-cadence-profile/README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md new file mode 100644 index 00000000..ab95d6fc --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.iam-tooling-suite.md @@ -0,0 +1,133 @@ +--- +id: capability.security.iam-tooling-suite +name: NetKingdom security architecture and conformance tooling +summary: Versioned IAM, layer, tenancy and credential contracts plus validators. +owner: net-kingdom +status: draft +domain: infotech +tags: +- security +- iam +- kubernetes +- conformance +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: SCOPE plus docs/secrets-engine-security-infrastructure-boundary.md + describe an explicit integration boundary with OpenBao, flex-auth, user-engine, + ops-warden, ops-bridge, info-tech-canon, and State Hub; canon/standards/ holds + versioned IAM v0.3, playbook capability, scenario composition, tenancy, zone, + and boundary standards that provider repos implement against. + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Versioned IAM, layer, tenancy + and credential contracts plus validators. Availability describes the delivery + form, not production acceptance. Mixed accepted and proposed standards; framework + integration remains incomplete.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - versioned canon standards already implemented by a sibling repo (key-cape) + - documented, runnable conformance, posture, composition, and bootstrap tools + under tools/ + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - no top-level packaging; each tool under tools/ has its own runtime dependencies, + no unified install path yet +discovery: + intent: Versioned IAM, layer, tenancy and credential contracts plus validators + includes: + - Versioned IAM, layer, tenancy and credential contracts plus validators + excludes: + - Mixed accepted and proposed standards; framework integration remains incomplete + assumptions: [] + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + - SECURITY-COMPANION.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register +evidence: + documentation: + - SCOPE.md + - SECURITY-COMPANION.md + tests: + - tools/iam-profile-conformance (pytest fixtures) + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Human signs in with MFA and manages account or factor recovery + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Mixed accepted and proposed standards; framework integration remains incomplete + known_limitations: + - Mixed accepted and proposed standards; framework integration remains incomplete + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# NetKingdom security architecture and conformance tooling + +Versioned IAM, layer, tenancy and credential contracts plus validators. + +## Reuse boundary + +Mixed accepted and proposed standards; framework integration remains incomplete. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U02: Human signs in with MFA and manages account or factor recovery +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [SECURITY-COMPANION.md](../../SECURITY-COMPANION.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.posture-feedback.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.posture-feedback.md new file mode 100644 index 00000000..134d6c67 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.posture-feedback.md @@ -0,0 +1,101 @@ +--- +id: capability.security.posture-feedback +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CLI evaluates evidence age and + posture into owner-routed findings. Availability describes the delivery form, + not production acceptance. Proposal only; no policy changes or remediation execution.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Deterministic posture feedback +summary: CLI evaluates evidence age and posture into owner-routed findings. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CLI evaluates evidence age and posture into owner-routed findings + includes: + - CLI evaluates evidence age and posture into owner-routed findings + excludes: + - Proposal only; no policy changes or remediation execution + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/posture-feedback/README.md + - tools/posture-feedback/posture_feedback.py + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/posture-feedback/README.md + - tools/posture-feedback/posture_feedback.py +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Proposal only; no policy changes or remediation execution + known_limitations: + - Proposal only; no policy changes or remediation execution + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Deterministic posture feedback + +CLI evaluates evidence age and posture into owner-routed findings. + +## Reuse boundary + +Proposal only; no policy changes or remediation execution. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [tools/posture-feedback/README.md](../../tools/posture-feedback/README.md) +- [tools/posture-feedback/posture_feedback.py](../../tools/posture-feedback/posture_feedback.py) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.scenario-compose.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.scenario-compose.md new file mode 100644 index 00000000..769cd3f9 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/capabilities/capability.security.scenario-compose.md @@ -0,0 +1,101 @@ +--- +id: capability.security.scenario-compose +owner: net-kingdom +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CLI selects pinned providers + and orders trust transitions. Availability describes the delivery form, not + production acceptance. Plan only; execution.permitted is always false.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Deterministic security scenario composition +summary: CLI selects pinned providers and orders trust transitions. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CLI selects pinned providers and orders trust transitions + includes: + - CLI selects pinned providers and orders trust transitions + excludes: + - Plan only; execution.permitted is always false + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - tools/security-scenario-composer/README.md + - tools/security-scenario-composer/security_scenario_composer.py + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.practice-canon + - capability.security.doctrine-review + - capability.iam.key-cape + - capability.authorization.policy-evaluate + - capability.registry.register + specializes: + - capability.security.iam-tooling-suite +evidence: + documentation: + - tools/security-scenario-composer/README.md + - tools/security-scenario-composer/security_scenario_composer.py +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Plan only; execution.permitted is always false + known_limitations: + - Plan only; execution.permitted is always false + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Deterministic security scenario composition + +CLI selects pinned providers and orders trust transitions. + +## Reuse boundary + +Plan only; execution.permitted is always false. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [tools/security-scenario-composer/README.md](../../tools/security-scenario-composer/README.md) +- [tools/security-scenario-composer/security_scenario_composer.py](../../tools/security-scenario-composer/security_scenario_composer.py) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..507b2d61 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/net-kingdom/registry/indexes/capabilities.yaml @@ -0,0 +1,98 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.security.iam-tooling-suite + name: NetKingdom security architecture and conformance tooling + summary: Versioned IAM, layer, tenancy and credential contracts plus validators. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - iam + - kubernetes + - conformance + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.security.iam-tooling-suite.md + consumption_modes: + - CLI + - source +- id: capability.security.scenario-compose + name: Deterministic security scenario composition + summary: CLI selects pinned providers and orders trust transitions. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.scenario-compose.md + consumption_modes: + - CLI + - source +- id: capability.security.posture-feedback + name: Deterministic posture feedback + summary: CLI evaluates evidence age and posture into owner-routed findings. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.posture-feedback.md + consumption_modes: + - CLI + - source +- id: capability.security.case-contracts + name: Security case types and instance validation + summary: Versioned types, cases and schema validation. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-contracts.md + consumption_modes: + - CLI + - source +- id: capability.security.bootstrap-recovery + name: Guarded bootstrap and recovery preparation + summary: Local identity, bootstrap console, encrypted custody handoff and caller + tools. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.bootstrap-recovery.md + consumption_modes: + - CLI + - source +- id: capability.security.emission-profile + name: Security emission cadence validation + summary: Security profile over generic emission contracts and validator. + domain: infotech + status: draft + owner: net-kingdom + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.emission-profile.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md new file mode 100644 index 00000000..b4457be8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/capabilities/capability.ops.tunnel-bridge.md @@ -0,0 +1,111 @@ +--- +id: capability.ops.tunnel-bridge +name: SSH tunnel lifecycle +summary: Named tunnels, reconnect, health and TTL-aware cert_command. +owner: ops-bridge +status: draft +domain: infotech +tags: +- ssh +- tunnel +- ops +- connectivity +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: README.txt documents named tunnels, auto-reconnect with exponential + backoff, HTTP health checks, and structured JSON audit events per tunnel; this + is also the tool underlying reuse-surface's own `/bridge` skill. + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Named tunnels, reconnect, health + and TTL-aware cert_command. Availability describes the delivery form, not production + acceptance. Private transport does not authenticate applications or decide access.' +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - auto-reconnecting named SSH reverse tunnels + - HTTP health checks confirming forwarded service reachability, not just SSH liveness + - structured audit event log per tunnel + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - operational tool with real production usage but no independent load/failure + testing recorded in this sweep +discovery: + intent: Named tunnels, reconnect, health and TTL-aware cert_command + includes: + - Named tunnels, reconnect, health and TTL-aware cert_command + excludes: + - Private transport does not authenticate applications or decide access + assumptions: [] + use_cases: + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Private transport does not authenticate applications or decide access + known_limitations: + - Private transport does not authenticate applications or decide access + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# SSH tunnel lifecycle + +Named tunnels, reconnect, health and TTL-aware cert_command. + +## Reuse boundary + +Private transport does not authenticate applications or decide access. + +## Supported use cases + +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..b15d1ac7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-bridge/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.ops.tunnel-bridge + name: SSH tunnel lifecycle + summary: Named tunnels, reconnect, health and TTL-aware cert_command. + domain: infotech + status: draft + owner: ops-bridge + tags: + - ssh + - tunnel + - ops + - connectivity + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.ops.tunnel-bridge.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/capabilities/capability.security.structure-construction.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/capabilities/capability.security.structure-construction.md new file mode 100644 index 00000000..09834982 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/capabilities/capability.security.structure-construction.md @@ -0,0 +1,103 @@ +--- +id: capability.security.structure-construction +owner: ops-mason +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Digest-bound OpenBao AppRole + and Kubernetes-auth plans and guarded apply. Availability describes the delivery + form, not production acceptance. Founder plan gate is an explicit exception; + not full PDP conformance.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Reviewed security structure construction +summary: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply + includes: + - Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply + excludes: + - Founder plan gate is an explicit exception; not full PDP conformance + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - docs/construction-plan-format.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.credential-lifecycle + - capability.security.iam-tooling-suite + - capability.railiance.platform-services +evidence: + documentation: + - SCOPE.md + - docs/construction-plan-format.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Founder plan gate is an explicit exception; not full PDP conformance + known_limitations: + - Founder plan gate is an explicit exception; not full PDP conformance + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Reviewed security structure construction + +Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply. + +## Reuse boundary + +Founder plan gate is an explicit exception; not full PDP conformance. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/construction-plan-format.md](../../docs/construction-plan-format.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..99ea4658 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-mason/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.structure-construction + name: Reviewed security structure construction + summary: Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply. + domain: infotech + status: draft + owner: ops-mason + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.structure-construction.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.access-routing.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.access-routing.md new file mode 100644 index 00000000..dbab2a00 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.access-routing.md @@ -0,0 +1,104 @@ +--- +id: capability.security.access-routing +owner: ops-warden +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A3 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: warden route and access catalog; + exact lane conduit and secret-exec routing. Availability describes the delivery + form, not production acceptance. Routing grants no authority; interim delegates + and attended high-risk lanes persist.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Credential routing and contained access +summary: warden route and access catalog; exact lane conduit and secret-exec routing. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: warden route and access catalog; exact lane conduit and secret-exec routing + includes: + - warden route and access catalog; exact lane conduit and secret-exec routing + excludes: + - Routing grants no authority; interim delegates and attended high-risk lanes persist + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A3 + target_level: A3 + current_artifacts: + - SCOPE.md + - wiki/CredentialRouting.md + consumption_modes: + - library + - CLI +relations: + related_to: + - capability.security.credential-lifecycle + - capability.authorization.policy-evaluate + - capability.ops.tunnel-bridge + - capability.security.structure-construction +evidence: + documentation: + - SCOPE.md + - wiki/CredentialRouting.md +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Routing grants no authority; interim delegates and attended high-risk lanes persist + known_limitations: + - Routing grants no authority; interim delegates and attended high-risk lanes persist + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Credential routing and contained access + +warden route and access catalog; exact lane conduit and secret-exec routing. + +## Reuse boundary + +Routing grants no authority; interim delegates and attended high-risk lanes persist. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [wiki/CredentialRouting.md](../../wiki/CredentialRouting.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.case-follow-through.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.case-follow-through.md new file mode 100644 index 00000000..1268c238 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.case-follow-through.md @@ -0,0 +1,104 @@ +--- +id: capability.security.case-follow-through +owner: ops-warden +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: KnownSecurityCase route, plan + and operational receipts. Availability describes the delivery form, not production + acceptance. Execution requires accepted structure and exact owner contracts; + case closure is not automatic.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security case operational follow-through +summary: KnownSecurityCase route, plan and operational receipts. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: KnownSecurityCase route, plan and operational receipts + includes: + - KnownSecurityCase route, plan and operational receipts + excludes: + - Execution requires accepted structure and exact owner contracts; case closure + is not automatic + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - workplans/WARDEN-WP-0044-security-case-follow-through.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.credential-lifecycle + - capability.authorization.policy-evaluate + - capability.ops.tunnel-bridge + - capability.security.structure-construction +evidence: + documentation: + - workplans/WARDEN-WP-0044-security-case-follow-through.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Execution requires accepted structure and exact owner contracts; case closure + is not automatic + known_limitations: + - Execution requires accepted structure and exact owner contracts; case closure + is not automatic + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security case operational follow-through + +KnownSecurityCase route, plan and operational receipts. + +## Reuse boundary + +Execution requires accepted structure and exact owner contracts; case closure is not automatic. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [workplans/WARDEN-WP-0044-security-case-follow-through.md](../../workplans/WARDEN-WP-0044-security-case-follow-through.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md new file mode 100644 index 00000000..91e05c85 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/capabilities/capability.security.ssh-certificate-issuance.md @@ -0,0 +1,138 @@ +--- +id: capability.security.ssh-certificate-issuance +name: Decision-bound SSH certificates +summary: warden sign with local and OpenBao backends and adm/agt/atm actors. +owner: ops-warden +status: draft +domain: helix_forge +tags: +- ssh +- certificate +- ca +- ops-warden +- openbao +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: 'SCOPE, AccessManagementDirective alignment, config runbooks, and cert_command + contract are documented; production OpenBao integration is documented but engine + deployment lives in railiance-platform. A machine-readable routing catalog (registry/routing/catalog.yaml) + and wiki/AccessRouting.md make the "issue SSH, route the rest" boundary discoverable. + + ' + availability: + current: A3 + target: A5 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: warden sign with local and OpenBao + backends and adm/agt/atm actors. Availability describes the delivery form, not + production acceptance. Direct Tooling contact is a declared gap; certificate + reachability is not target authorization.' +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - local and OpenBao/Vault-compatible signing backends + - TTL policy enforcement per actor type + - principals inventory and cert-side scorecard + - signatures audit log and stale-cert cleanup + - cert_command stdout contract for ops-bridge + broken_expectations: + - host-side principal deployment not owned here + - OpenBao SSH engine mount not deployed from this repo + out_of_scope_expectations: + - long-lived API key custody + - tunnel lifecycle management + - Vault/OpenBao cluster operations + reliability: + level: R2 + name: Tolerable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - production signing depends on OpenBao availability and token policy + - local backend requires protected CA key handling by operators +discovery: + intent: warden sign with local and OpenBao backends and adm/agt/atm actors + includes: + - warden sign with local and OpenBao backends and adm/agt/atm actors + excludes: + - Direct Tooling contact is a declared gap; certificate reachability is not target + authorization + assumptions: + - callers supply actor public keys; humans self-issue admin keys + - production platform uses OpenBao with Vault-compatible SSH engine API + use_cases: + - ops-bridge tunnel cert_command + - Inter-Hub bootstrap short-lived agent access + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' + research_memos: + - ops-warden/SCOPE.md + - ops-warden/wiki/CertCommandInterface.md + - ops-warden/wiki/OpsWardenConfig.md + - ops-warden/wiki/AccessRouting.md +availability: + current_level: A3 + target_level: A5 + current_artifacts: + - SCOPE.md + - README.md + target_artifacts: + - packaged ops-warden release with documented OpenBao role bootstrap + - '`warden route` lookup CLI over the pointer catalog (WARDEN-WP-0011)' + consumption_modes: + - library + - CLI +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.credential-lifecycle + - capability.authorization.policy-evaluate + - capability.ops.tunnel-bridge + - capability.security.structure-construction +consumer_guidance: + recommended_for: + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + not_recommended_for: + - Direct Tooling contact is a declared gap; certificate reachability is not target + authorization + known_limitations: + - Direct Tooling contact is a declared gap; certificate reachability is not target + authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +evidence: + documentation: + - SCOPE.md + - README.md +--- + +# Decision-bound SSH certificates + +warden sign with local and OpenBao backends and adm/agt/atm actors. + +## Reuse boundary + +Direct Tooling contact is a declared gap; certificate reachability is not target authorization. + +## Supported use cases + +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..7f4d6496 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/ops-warden/registry/indexes/capabilities.yaml @@ -0,0 +1,54 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.security.ssh-certificate-issuance + name: Decision-bound SSH certificates + summary: warden sign with local and OpenBao backends and adm/agt/atm actors. + domain: helix_forge + status: draft + owner: ops-warden + tags: + - ssh + - certificate + - ca + - ops-warden + - openbao + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R2 + path: registry/capabilities/capability.security.ssh-certificate-issuance.md + consumption_modes: + - library + - CLI +- id: capability.security.access-routing + name: Credential routing and contained access + summary: warden route and access catalog; exact lane conduit and secret-exec routing. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C1 / R0 + path: registry/capabilities/capability.security.access-routing.md + consumption_modes: + - library + - CLI +- id: capability.security.case-follow-through + name: Security case operational follow-through + summary: KnownSecurityCase route, plan and operational receipts. + domain: infotech + status: draft + owner: ops-warden + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.case-follow-through.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/capabilities/capability.security.policy-publication.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/capabilities/capability.security.policy-publication.md new file mode 100644 index 00000000..cba9831a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/capabilities/capability.security.policy-publication.md @@ -0,0 +1,103 @@ +--- +id: capability.security.policy-publication +owner: policy-nexus +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Generated immutable publication, + source currency and stable policy URLs. Availability describes the delivery + form, not production acceptance. Publication does not ratify policy or enforce + it.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Policy publication with source provenance +summary: Generated immutable publication, source currency and stable policy URLs. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Generated immutable publication, source currency and stable policy URLs + includes: + - Generated immutable publication, source currency and stable policy URLs + excludes: + - Publication does not ratify policy or enforce it + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - README.md + - docs/publication-contract.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + - capability.security.practice-canon + - capability.security.risk-register +evidence: + documentation: + - README.md + - docs/publication-contract.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Publication does not ratify policy or enforce it + known_limitations: + - Publication does not ratify policy or enforce it + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Policy publication with source provenance + +Generated immutable publication, source currency and stable policy URLs. + +## Reuse boundary + +Publication does not ratify policy or enforce it. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [README.md](../../README.md) +- [docs/publication-contract.md](../../docs/publication-contract.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..bb52c8cc --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/policy-nexus/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.policy-publication + name: Policy publication with source provenance + summary: Generated immutable publication, source currency and stable policy URLs. + domain: infotech + status: draft + owner: policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.policy-publication.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/capabilities/capability.railiance.kubernetes-rail.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/capabilities/capability.railiance.kubernetes-rail.md new file mode 100644 index 00000000..1e09015c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/capabilities/capability.railiance.kubernetes-rail.md @@ -0,0 +1,93 @@ +--- +id: capability.railiance.kubernetes-rail +owner: rail-kubernetes +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Workload declaration, rollout, + observe, promote and rollback surfaces. Availability describes the delivery + form, not production acceptance. Compatibility extraction remains; not cluster + or application-domain ownership.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Generic Kubernetes workload lifecycle +summary: Workload declaration, rollout, observe, promote and rollback surfaces. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Workload declaration, rollout, observe, promote and rollback surfaces + includes: + - Workload declaration, rollout, observe, promote and rollback surfaces + excludes: + - Compatibility extraction remains; not cluster or application-domain ownership + use_cases: + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Compatibility extraction remains; not cluster or application-domain ownership + known_limitations: + - Compatibility extraction remains; not cluster or application-domain ownership + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Generic Kubernetes workload lifecycle + +Workload declaration, rollout, observe, promote and rollback surfaces. + +## Reuse boundary + +Compatibility extraction remains; not cluster or application-domain ownership. + +## Supported use cases + +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..739c5ffe --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rail-kubernetes/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.kubernetes-rail + name: Generic Kubernetes workload lifecycle + summary: Workload declaration, rollout, observe, promote and rollback surfaces. + domain: infotech + status: draft + owner: rail-kubernetes + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.kubernetes-rail.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md new file mode 100644 index 00000000..063141ca --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/capabilities/capability.railiance.workload-deployment-tooling.md @@ -0,0 +1,118 @@ +--- +id: capability.railiance.workload-deployment-tooling +name: Workload release configuration and guards +summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback. +owner: railiance-apps +status: draft +domain: financials +tags: +- railiance +- kubernetes +- helm +- deployment +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: SCOPE.md places this repo precisely in the Railiance OAS Stack layering + (S5), scoped to application Helm releases, workload manifests, and operator + runbooks for user-facing services such as vergabe-teilnahme. + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Helm/manifests, exact image + pins, application runbooks and rollout/rollback. Availability describes the + delivery form, not production acceptance. Release settings depend on underlying + platform and workload owners.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - Helm charts and Kubernetes manifests for application workloads + - smoke-test and dry-run check scripts, including a forgejo-smoke.sh already ahead + of the platform-wide Forgejo transition + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - no top-level packaging; tooling is a collection of shell scripts under tools/ +discovery: + intent: Helm/manifests, exact image pins, application runbooks and rollout/rollback + includes: + - Helm/manifests, exact image pins, application runbooks and rollout/rollback + excludes: + - Release settings depend on underlying platform and workload owners + assumptions: [] + use_cases: + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + tests: + - tools/forgejo-smoke.sh + - tools/inter-hub-smoke.sh + - tools/k8s-server-dry-run.sh + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Developer builds and publishes through controlled source, dependency and runner + paths + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Release settings depend on underlying platform and workload owners + known_limitations: + - Release settings depend on underlying platform and workload owners + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# Workload release configuration and guards + +Helm/manifests, exact image pins, application runbooks and rollout/rollback. + +## Reuse boundary + +Release settings depend on underlying platform and workload owners. + +## Supported use cases + +- U12: Developer builds and publishes through controlled source, dependency and runner paths +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..a311af53 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-apps/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.workload-deployment-tooling + name: Workload release configuration and guards + summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback. + domain: financials + status: draft + owner: railiance-apps + tags: + - railiance + - kubernetes + - helm + - deployment + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R1 + path: registry/capabilities/capability.railiance.workload-deployment-tooling.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/capabilities/capability.railiance.bootstrap-sequencing.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/capabilities/capability.railiance.bootstrap-sequencing.md new file mode 100644 index 00000000..cb34eeb4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/capabilities/capability.railiance.bootstrap-sequencing.md @@ -0,0 +1,90 @@ +--- +id: capability.railiance.bootstrap-sequencing +owner: railiance-bootstrap +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Bare-VM to estate sequence and + handoff contract. Availability describes the delivery form, not production acceptance. + End-to-end unattended rebuild is not established.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Bootstrap sequencing contracts +summary: Bare-VM to estate sequence and handoff contract. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Bare-VM to estate sequence and handoff contract + includes: + - Bare-VM to estate sequence and handoff contract + excludes: + - End-to-end unattended rebuild is not established + use_cases: + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Operator recovers identity, custody or data with independently held recovery material + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - End-to-end unattended rebuild is not established + known_limitations: + - End-to-end unattended rebuild is not established + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Bootstrap sequencing contracts + +Bare-VM to estate sequence and handoff contract. + +## Reuse boundary + +End-to-end unattended rebuild is not established. + +## Supported use cases + +- U10: Operator recovers identity, custody or data with independently held recovery material +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..10349759 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-bootstrap/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.bootstrap-sequencing + name: Bootstrap sequencing contracts + summary: Bare-VM to estate sequence and handoff contract. + domain: infotech + status: draft + owner: railiance-bootstrap + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.bootstrap-sequencing.md + consumption_modes: + - informational diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md new file mode 100644 index 00000000..6b7a5c06 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/capabilities/capability.railiance.cluster-bootstrap.md @@ -0,0 +1,116 @@ +--- +id: capability.railiance.cluster-bootstrap +name: Kubernetes runtime and cluster controls +summary: k3s, ingress, CNI, operators and kubeconfig/runtime checks. +owner: railiance-cluster +status: draft +domain: financials +tags: +- railiance +- kubernetes +- iac +- bootstrap +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: README documents the 'Rails for Ops' convention-over-configuration + philosophy and a concrete quick-start (clone, from two bare servers rebuild + a full k8s environment); has .forgejo CI already in place. + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: k3s, ingress, CNI, operators + and kubeconfig/runtime checks. Availability describes the delivery form, not + production acceptance. Single-node runtime and workload recovery are distinct + from bootstrap success.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - documented quick-start from two bare servers to a running Kubernetes environment + - bootstrap/harden ansible playbooks + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - reproducibility claims not independently re-verified (no live bootstrap run + during this sweep) +discovery: + intent: k3s, ingress, CNI, operators and kubeconfig/runtime checks + includes: + - k3s, ingress, CNI, operators and kubeconfig/runtime checks + excludes: + - Single-node runtime and workload recovery are distinct from bootstrap success + assumptions: [] + use_cases: + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + tests: + - tests/ + - .forgejo/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Single-node runtime and workload recovery are distinct from bootstrap success + known_limitations: + - Single-node runtime and workload recovery are distinct from bootstrap success + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# Kubernetes runtime and cluster controls + +k3s, ingress, CNI, operators and kubeconfig/runtime checks. + +## Reuse boundary + +Single-node runtime and workload recovery are distinct from bootstrap success. + +## Supported use cases + +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..a6161da4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-cluster/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.cluster-bootstrap + name: Kubernetes runtime and cluster controls + summary: k3s, ingress, CNI, operators and kubeconfig/runtime checks. + domain: financials + status: draft + owner: railiance-cluster + tags: + - railiance + - kubernetes + - iac + - bootstrap + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.cluster-bootstrap.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md new file mode 100644 index 00000000..d817a7c2 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/capabilities/capability.railiance.ci-enablement.md @@ -0,0 +1,116 @@ +--- +id: capability.railiance.ci-enablement +name: Developer delivery and CI templates +summary: Reusable CI workflows, build and deployment patterns. +owner: railiance-enablement +status: draft +domain: financials +tags: +- railiance +- ci-cd +- developer-enablement +- forgejo +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: SCOPE.md places this repo precisely at S4 in the Railiance OAS Stack, + explicitly scoped to reusable CI/CD templates and enablement tooling while using + (not owning) forge capabilities. + availability: + current: A2 + target: A3 + confidence: high + rationale: 'Source interface assessed 2026-10-14: Reusable CI workflows, build + and deployment patterns. Availability describes the delivery form, not production + acceptance. Templates do not prove mandatory checks or runner isolation.' +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - reusable Forgejo Actions CI/CD workflow templates already in production shape + - a repo-promotion-to-forgejo script directly usable for the platform-wide forge + transition + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - templates are workflow YAML, not a packaged/versioned artifact; consumption + is copy/reference rather than dependency-managed +discovery: + intent: Reusable CI workflows, build and deployment patterns + includes: + - Reusable CI workflows, build and deployment patterns + excludes: + - Templates do not prove mandatory checks or runner isolation + assumptions: [] + use_cases: + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + tests: + - workflows/ci-smoke.yaml + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Developer builds and publishes through controlled source, dependency and runner + paths + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Templates do not prove mandatory checks or runner isolation + known_limitations: + - Templates do not prove mandatory checks or runner isolation + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# Developer delivery and CI templates + +Reusable CI workflows, build and deployment patterns. + +## Reuse boundary + +Templates do not prove mandatory checks or runner isolation. + +## Supported use cases + +- U12: Developer builds and publishes through controlled source, dependency and runner paths +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..4aae230e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-enablement/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.ci-enablement + name: Developer delivery and CI templates + summary: Reusable CI workflows, build and deployment patterns. + domain: financials + status: draft + owner: railiance-enablement + tags: + - railiance + - ci-cd + - developer-enablement + - forgejo + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.ci-enablement.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md new file mode 100644 index 00000000..c858fd1f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/capabilities/capability.railiance.fabric-graph.md @@ -0,0 +1,128 @@ +--- +id: capability.railiance.fabric-graph +name: Infrastructure ownership and dependency graph +summary: Schemas, validation, graph queries and State Hub exports. +owner: railiance-fabric +status: draft +domain: financials +tags: +- railiance +- graph +- ownership +- discovery +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: README and SCOPE.md document the ecosystem graph model bounded by financial/operational + accountability (who pays, who is accountable), with king/lord/tenant ownership + concepts referenced in docs/FabricDiscoveryAndUpdate.md. + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Schemas, validation, graph queries + and State Hub exports. Availability describes the delivery form, not production + acceptance. Graph assertions need current owner evidence; not an enforcement + registry.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - ecosystem graph declaration loader and validator + - schemas for services/machines/repos/deployables/endpoints/ownership/dependencies/bindings + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - discovery/rebuild/update-loop architecture documented as still evolving per + docs/FabricDiscoveryAndUpdate.md +discovery: + intent: Schemas, validation, graph queries and State Hub exports + includes: + - Schemas, validation, graph queries and State Hub exports + excludes: + - Graph assertions need current owner evidence; not an enforcement registry + assumptions: [] + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Graph assertions need current owner evidence; not an enforcement registry + known_limitations: + - Graph assertions need current owner evidence; not an enforcement registry + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A1 + to: A2 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# Infrastructure ownership and dependency graph + +Schemas, validation, graph queries and State Hub exports. + +## Reuse boundary + +Graph assertions need current owner evidence; not an enforcement registry. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..b7e9b3af --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-fabric/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.fabric-graph + name: Infrastructure ownership and dependency graph + summary: Schemas, validation, graph queries and State Hub exports. + domain: financials + status: draft + owner: railiance-fabric + tags: + - railiance + - graph + - ownership + - discovery + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.fabric-graph.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md new file mode 100644 index 00000000..9221cfa8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.railiance.forge-infrastructure.md @@ -0,0 +1,124 @@ +--- +id: capability.railiance.forge-infrastructure +name: Source forge, registries and runner substrate +summary: Forgejo operation, package registries and runner lifecycle. +owner: railiance-forge +status: draft +domain: financials +tags: +- railiance +- forgejo +- forge +- ci-runner +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: README and SCOPE.md explicitly name 'current Gitea operation, future + Forgejo migration, container and package registries, Actions runner substrate, + artifact lifecycle' as the scope; status noted as 'active forge extraction' + with canonical registry operation docs already landed. + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Forgejo operation, package registries + and runner lifecycle. Availability describes the delivery form, not production + acceptance. Runner workload authority and independent verification coverage + remain open.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - scope separation from railiance-apps/railiance-enablement documented + - canonical registry operation docs and runner ownership contracts + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - repo is actively being founded/extracted; no live deploy yet by its own account + - directly relevant to REUSE-WP-0019 but hasn't migrated its own CI to .forgejo/ + yet +discovery: + intent: Forgejo operation, package registries and runner lifecycle + includes: + - Forgejo operation, package registries and runner lifecycle + excludes: + - Runner workload authority and independent verification coverage remain open + assumptions: [] + use_cases: + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + - workplans/FORGE-WP-0006-independent-secret-detection.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.repository-secret-prevention + - capability.railiance.ci-enablement + - capability.railiance.workload-deployment-tooling +evidence: + documentation: + - SCOPE.md + - workplans/FORGE-WP-0006-independent-secret-detection.md + tests: [] + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Developer builds and publishes through controlled source, dependency and runner + paths + not_recommended_for: + - Runner workload authority and independent verification coverage remain open + known_limitations: + - Runner workload authority and independent verification coverage remain open + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A1 + to: A2 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# Source forge, registries and runner substrate + +Forgejo operation, package registries and runner lifecycle. + +## Reuse boundary + +Runner workload authority and independent verification coverage remain open. + +## Supported use cases + +- U12: Developer builds and publishes through controlled source, dependency and runner paths + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [workplans/FORGE-WP-0006-independent-secret-detection.md](../../workplans/FORGE-WP-0006-independent-secret-detection.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.security.forge-secret-prevention.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.security.forge-secret-prevention.md new file mode 100644 index 00000000..7e875db9 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/capabilities/capability.security.forge-secret-prevention.md @@ -0,0 +1,96 @@ +--- +id: capability.security.forge-secret-prevention +owner: railiance-forge +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Pinned receive adapter, lifecycle + template and fail-closed scan. Availability describes the delivery form, not + production acceptance. Dated native coverage excludes one repo; import/mirror + fetch and response coverage remain separate.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Independent introduced-history secret prevention +summary: Pinned receive adapter, lifecycle template and fail-closed scan. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Pinned receive adapter, lifecycle template and fail-closed scan + includes: + - Pinned receive adapter, lifecycle template and fail-closed scan + excludes: + - Dated native coverage excludes one repo; import/mirror fetch and response coverage + remain separate + use_cases: + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - workplans/FORGE-WP-0006-independent-secret-detection.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.repository-secret-prevention + - capability.railiance.ci-enablement + - capability.railiance.workload-deployment-tooling +evidence: + documentation: + - workplans/FORGE-WP-0006-independent-secret-detection.md +consumer_guidance: + recommended_for: + - Owner inventories, rotates, revokes and detects exposure of credentials + - Developer builds and publishes through controlled source, dependency and runner + paths + not_recommended_for: + - Dated native coverage excludes one repo; import/mirror fetch and response coverage + remain separate + known_limitations: + - Dated native coverage excludes one repo; import/mirror fetch and response coverage + remain separate + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Independent introduced-history secret prevention + +Pinned receive adapter, lifecycle template and fail-closed scan. + +## Reuse boundary + +Dated native coverage excludes one repo; import/mirror fetch and response coverage remain separate. + +## Supported use cases + +- U07: Owner inventories, rotates, revokes and detects exposure of credentials +- U12: Developer builds and publishes through controlled source, dependency and runner paths + +## Evidence and integration + +- [workplans/FORGE-WP-0006-independent-secret-detection.md](../../workplans/FORGE-WP-0006-independent-secret-detection.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..51cff6e7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-forge/registry/indexes/capabilities.yaml @@ -0,0 +1,38 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.forge-infrastructure + name: Source forge, registries and runner substrate + summary: Forgejo operation, package registries and runner lifecycle. + domain: financials + status: draft + owner: railiance-forge + tags: + - railiance + - forgejo + - forge + - ci-runner + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.forge-infrastructure.md + consumption_modes: + - CLI + - source +- id: capability.security.forge-secret-prevention + name: Independent introduced-history secret prevention + summary: Pinned receive adapter, lifecycle template and fail-closed scan. + domain: infotech + status: draft + owner: railiance-forge + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.forge-secret-prevention.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md new file mode 100644 index 00000000..8e5cac8e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/capabilities/capability.railiance.infra-provisioning.md @@ -0,0 +1,123 @@ +--- +id: capability.railiance.infra-provisioning +name: Host convergence and security baseline +summary: Ansible inventory, firewall, SSH bootstrap and baseline verification. +owner: railiance-infra +status: draft +domain: financials +tags: +- railiance +- terraform +- ansible +- infrastructure +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: README documents a complete, concrete quickstart (clone, prerequisites, + SOPS/age secrets setup, provider setup, terraform apply, ansible convergence) + with a specific inventory file (`inventory/servers.yaml`) as source of truth + — an unusually complete operational README among the swept repos. + availability: + current: A2 + target: A3 + confidence: high + rationale: 'Source interface assessed 2026-10-14: Ansible inventory, firewall, + SSH bootstrap and baseline verification. Availability describes the delivery + form, not production acceptance. Current hosts differ from the retained Hetzner + provisioning path.' +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - documented end-to-end quickstart from bare cloud account to converged servers + - SOPS+age encrypted secrets with a documented key-custody model + - inventory/servers.yaml as explicit source of truth + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R1 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - reproducibility not independently re-verified via a live provisioning run in + this sweep +discovery: + intent: Ansible inventory, firewall, SSH bootstrap and baseline verification + includes: + - Ansible inventory, firewall, SSH bootstrap and baseline verification + excludes: + - Current hosts differ from the retained Hetzner provisioning path + assumptions: [] + use_cases: + - 'U06: Operator or automation obtains a bounded SSH certificate and maintains private + connectivity' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + tests: + - sbom-tools.yaml + - .forgejo/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Operator or automation obtains a bounded SSH certificate and maintains private + connectivity + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Current hosts differ from the retained Hetzner provisioning path + known_limitations: + - Current hosts differ from the retained Hetzner provisioning path + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# Host convergence and security baseline + +Ansible inventory, firewall, SSH bootstrap and baseline verification. + +## Reuse boundary + +Current hosts differ from the retained Hetzner provisioning path. + +## Supported use cases + +- U06: Operator or automation obtains a bounded SSH certificate and maintains private connectivity +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..d2aa9406 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-infra/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.infra-provisioning + name: Host convergence and security baseline + summary: Ansible inventory, firewall, SSH bootstrap and baseline verification. + domain: financials + status: draft + owner: railiance-infra + tags: + - railiance + - terraform + - ansible + - infrastructure + - security + - netkingdom + - framework-reuse + vector: D4 / A2 / C2 / R1 + path: registry/capabilities/capability.railiance.infra-provisioning.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/capabilities/capability.railiance.security-consumption-contracts.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/capabilities/capability.railiance.security-consumption-contracts.md new file mode 100644 index 00000000..d6314645 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/capabilities/capability.railiance.security-consumption-contracts.md @@ -0,0 +1,100 @@ +--- +id: capability.railiance.security-consumption-contracts +owner: railiance-master +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Rail/rapp/reef boundaries, exposure + and security consumption contracts. Availability describes the delivery form, + not production acceptance. Architecture declarations do not prove implementation + or production admission.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Platform security consumption architecture +summary: Rail/rapp/reef boundaries, exposure and security consumption contracts. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Rail/rapp/reef boundaries, exposure and security consumption contracts + includes: + - Rail/rapp/reef boundaries, exposure and security consumption contracts + excludes: + - Architecture declarations do not prove implementation or production admission + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + - docs/netkingdom-security-consumption-contract.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - docs/netkingdom-security-consumption-contract.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Architecture declarations do not prove implementation or production admission + known_limitations: + - Architecture declarations do not prove implementation or production admission + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Platform security consumption architecture + +Rail/rapp/reef boundaries, exposure and security consumption contracts. + +## Reuse boundary + +Architecture declarations do not prove implementation or production admission. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/netkingdom-security-consumption-contract.md](../../docs/netkingdom-security-consumption-contract.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..3f3b854f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-master/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.security-consumption-contracts + name: Platform security consumption architecture + summary: Rail/rapp/reef boundaries, exposure and security consumption contracts. + domain: infotech + status: draft + owner: railiance-master + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.security-consumption-contracts.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/capabilities/capability.railiance.platform-services.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/capabilities/capability.railiance.platform-services.md new file mode 100644 index 00000000..f0d04ad1 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/capabilities/capability.railiance.platform-services.md @@ -0,0 +1,135 @@ +--- +id: capability.railiance.platform-services +name: Secret custody and platform data services +summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts. +owner: railiance-platform +status: draft +domain: financials +tags: +- railiance +- platform +- secrets +- postgres +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: SCOPE.md places this repo precisely at S3 in the Railiance OAS Stack, + scoped to shared cluster services (PostgreSQL HA, Valkey, secrets, identity + integration, object storage). + availability: + current: A2 + target: A3 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: OpenBao policy/custody, consumer + grants, secret delivery and database/backup contracts. Availability describes + the delivery form, not production acceptance. Package ownership is split to + rapp repos; caches and object services are demand-led.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - OpenBao/Vault secret-management apply/verify scripting + - credential-change tooling + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - no top-level packaging; scripts/tools have no unified install path +discovery: + intent: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts + includes: + - OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts + excludes: + - Package ownership is split to rapp repos; caches and object services are demand-led + assumptions: [] + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + research_memos: [] +availability: + current_level: A2 + target_level: A3 + current_artifacts: + - SCOPE.md + - docs/openbao.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.railiance.openbao-package + - capability.railiance.postgres-isolation-recovery + - capability.iam.key-cape + - capability.security.credential-lifecycle +evidence: + documentation: + - SCOPE.md + - docs/openbao.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Owner inventories, rotates, revokes and detects exposure of credentials + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Package ownership is split to rapp repos; caches and object services are demand-led + known_limitations: + - Package ownership is split to rapp repos; caches and object services are demand-led + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: [] +--- + +# Secret custody and platform data services + +OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts. + +## Reuse boundary + +Package ownership is split to rapp repos; caches and object services are demand-led. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U07: Owner inventories, rotates, revokes and detects exposure of credentials +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/openbao.md](../../docs/openbao.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..c0c1c732 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-platform/registry/indexes/capabilities.yaml @@ -0,0 +1,24 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.railiance.platform-services + name: Secret custody and platform data services + summary: OpenBao policy/custody, consumer grants, secret delivery and database/backup + contracts. + domain: financials + status: draft + owner: railiance-platform + tags: + - railiance + - platform + - secrets + - postgres + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.platform-services.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/capabilities/capability.observability.security-signals.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/capabilities/capability.observability.security-signals.md new file mode 100644 index 00000000..b9f6196d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/capabilities/capability.observability.security-signals.md @@ -0,0 +1,99 @@ +--- +id: capability.observability.security-signals +owner: railiance-telemetry +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Signal contract, platform adapters, + report exporter and absence/alert rules. Availability describes the delivery + form, not production acceptance. Reference receiver is not a second production + plane; end-to-end delivery acceptance pending.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security-relevant telemetry contracts and adapters +summary: Signal contract, platform adapters, report exporter and absence/alert rules. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Signal contract, platform adapters, report exporter and absence/alert rules + includes: + - Signal contract, platform adapters, report exporter and absence/alert rules + excludes: + - Reference receiver is not a second production plane; end-to-end delivery acceptance + pending + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.railiance.telemetry-package + - capability.audit.event-retain + - capability.security.posture-assessment +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Reference receiver is not a second production plane; end-to-end delivery acceptance + pending + known_limitations: + - Reference receiver is not a second production plane; end-to-end delivery acceptance + pending + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security-relevant telemetry contracts and adapters + +Signal contract, platform adapters, report exporter and absence/alert rules. + +## Reuse boundary + +Reference receiver is not a second production plane; end-to-end delivery acceptance pending. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..e6177b67 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/railiance-telemetry/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.observability.security-signals + name: Security-relevant telemetry contracts and adapters + summary: Signal contract, platform adapters, report exporter and absence/alert rules. + domain: infotech + status: draft + owner: railiance-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.observability.security-signals.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/capabilities/capability.railiance.openbao-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/capabilities/capability.railiance.openbao-package.md new file mode 100644 index 00000000..a22d7b6d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/capabilities/capability.railiance.openbao-package.md @@ -0,0 +1,103 @@ +--- +id: capability.railiance.openbao-package +owner: rapp-openbao +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Helm values, package deploy/status/smoke/rollback + and custody boundary. Availability describes the delivery form, not production + acceptance. Platform owns grants/policies; retained S3 handoff and recovery + acceptance remain explicit.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Managed OpenBao deployment package +summary: Helm values, package deploy/status/smoke/rollback and custody boundary. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Helm values, package deploy/status/smoke/rollback and custody boundary + includes: + - Helm values, package deploy/status/smoke/rollback and custody boundary + excludes: + - Platform owns grants/policies; retained S3 handoff and recovery acceptance remain + explicit + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - README.md + - docs/retained-s3-handoff.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md + - docs/retained-s3-handoff.md +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Platform owns grants/policies; retained S3 handoff and recovery acceptance remain + explicit + known_limitations: + - Platform owns grants/policies; retained S3 handoff and recovery acceptance remain + explicit + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Managed OpenBao deployment package + +Helm values, package deploy/status/smoke/rollback and custody boundary. + +## Reuse boundary + +Platform owns grants/policies; retained S3 handoff and recovery acceptance remain explicit. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [README.md](../../README.md) +- [docs/retained-s3-handoff.md](../../docs/retained-s3-handoff.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..86fe387d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-openbao/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.openbao-package + name: Managed OpenBao deployment package + summary: Helm values, package deploy/status/smoke/rollback and custody boundary. + domain: infotech + status: draft + owner: rapp-openbao + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.openbao-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/capabilities/capability.railiance.browser-verification.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/capabilities/capability.railiance.browser-verification.md new file mode 100644 index 00000000..0715180a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/capabilities/capability.railiance.browser-verification.md @@ -0,0 +1,94 @@ +--- +id: capability.railiance.browser-verification +owner: rapp-playwright +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Bounded jobs, cancellation, + artifacts, origin checks and restart receipts. Availability describes the delivery + form, not production acceptance. Pilot deployed; human/agent authentication + and per-caller self-service connectivity pending.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Managed browser verification pilot +summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Bounded jobs, cancellation, artifacts, origin checks and restart receipts + includes: + - Bounded jobs, cancellation, artifacts, origin checks and restart receipts + excludes: + - Pilot deployed; human/agent authentication and per-caller self-service connectivity + pending + use_cases: + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Human signs in with MFA and manages account or factor recovery + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Pilot deployed; human/agent authentication and per-caller self-service connectivity + pending + known_limitations: + - Pilot deployed; human/agent authentication and per-caller self-service connectivity + pending + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Managed browser verification pilot + +Bounded jobs, cancellation, artifacts, origin checks and restart receipts. + +## Reuse boundary + +Pilot deployed; human/agent authentication and per-caller self-service connectivity pending. + +## Supported use cases + +- U02: Human signs in with MFA and manages account or factor recovery +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..04a2fe55 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-playwright/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.browser-verification + name: Managed browser verification pilot + summary: Bounded jobs, cancellation, artifacts, origin checks and restart receipts. + domain: infotech + status: draft + owner: rapp-playwright + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.railiance.browser-verification.md + consumption_modes: + - HTTP API + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/capabilities/capability.railiance.policy-publication-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/capabilities/capability.railiance.policy-publication-package.md new file mode 100644 index 00000000..ea8a3b76 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/capabilities/capability.railiance.policy-publication-package.md @@ -0,0 +1,94 @@ +--- +id: capability.railiance.policy-publication-package +owner: rapp-policy-nexus +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Immutable image, non-root/read-only + runtime and approved TLS exposure. Availability describes the delivery form, + not production acceptance. No policy authoring or DNS/issuer administration.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Policy publication runtime package +summary: Immutable image, non-root/read-only runtime and approved TLS exposure. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Immutable image, non-root/read-only runtime and approved TLS exposure + includes: + - Immutable image, non-root/read-only runtime and approved TLS exposure + excludes: + - No policy authoring or DNS/issuer administration + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + wraps: + - capability.security.policy-publication +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - No policy authoring or DNS/issuer administration + known_limitations: + - No policy authoring or DNS/issuer administration + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Policy publication runtime package + +Immutable image, non-root/read-only runtime and approved TLS exposure. + +## Reuse boundary + +No policy authoring or DNS/issuer administration. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..02475636 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-policy-nexus/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.policy-publication-package + name: Policy publication runtime package + summary: Immutable image, non-root/read-only runtime and approved TLS exposure. + domain: infotech + status: draft + owner: rapp-policy-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.policy-publication-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/capabilities/capability.railiance.postgres-isolation-recovery.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/capabilities/capability.railiance.postgres-isolation-recovery.md new file mode 100644 index 00000000..77a143bd --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/capabilities/capability.railiance.postgres-isolation-recovery.md @@ -0,0 +1,99 @@ +--- +id: capability.railiance.postgres-isolation-recovery +owner: rapp-postgres +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CNPG cells, per-consumer roles, + negative isolation tests and backup/restore procedures. Availability describes + the delivery form, not production acceptance. Host-loss proof and consumer schemas + stay with their owners.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Database isolation and recovery package +summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures + includes: + - CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures + excludes: + - Host-loss proof and consumer schemas stay with their owners + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Host-loss proof and consumer schemas stay with their owners + known_limitations: + - Host-loss proof and consumer schemas stay with their owners + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Database isolation and recovery package + +CNPG cells, per-consumer roles, negative isolation tests and backup/restore procedures. + +## Reuse boundary + +Host-loss proof and consumer schemas stay with their owners. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..399dc435 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-postgres/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.postgres-isolation-recovery + name: Database isolation and recovery package + summary: CNPG cells, per-consumer roles, negative isolation tests and backup/restore + procedures. + domain: infotech + status: draft + owner: rapp-postgres + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.postgres-isolation-recovery.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/capabilities/capability.railiance.telemetry-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/capabilities/capability.railiance.telemetry-package.md new file mode 100644 index 00000000..ccd9ff65 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/capabilities/capability.railiance.telemetry-package.md @@ -0,0 +1,100 @@ +--- +id: capability.railiance.telemetry-package +owner: rapp-telemetry +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Prometheus, Alertmanager and + Grafana package with isolated restore evidence. Availability describes the delivery + form, not production acceptance. Private installation only; recurring recovery + capture and audited confirmation pending.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Private monitoring package +summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Prometheus, Alertmanager and Grafana package with isolated restore evidence + includes: + - Prometheus, Alertmanager and Grafana package with isolated restore evidence + excludes: + - Private installation only; recurring recovery capture and audited confirmation + pending + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.observability.security-signals + - capability.railiance.kubernetes-rail + - capability.railiance.substrate-bindings +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Operator recovers identity, custody or data with independently held recovery material + not_recommended_for: + - Private installation only; recurring recovery capture and audited confirmation + pending + known_limitations: + - Private installation only; recurring recovery capture and audited confirmation + pending + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Private monitoring package + +Prometheus, Alertmanager and Grafana package with isolated restore evidence. + +## Reuse boundary + +Private installation only; recurring recovery capture and audited confirmation pending. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..244ede7a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-telemetry/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.telemetry-package + name: Private monitoring package + summary: Prometheus, Alertmanager and Grafana package with isolated restore evidence. + domain: infotech + status: draft + owner: rapp-telemetry + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.telemetry-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/capabilities/capability.railiance.tenant-engine-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/capabilities/capability.railiance.tenant-engine-package.md new file mode 100644 index 00000000..99dcfd8d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/capabilities/capability.railiance.tenant-engine-package.md @@ -0,0 +1,94 @@ +--- +id: capability.railiance.tenant-engine-package +owner: rapp-tenant-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Package declaration, smoke and + rollback. Availability describes the delivery form, not production acceptance. + No tenant-domain ownership or credential values.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Tenant Engine runtime package +summary: Package declaration, smoke and rollback. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Package declaration, smoke and rollback + includes: + - Package declaration, smoke and rollback + excludes: + - No tenant-domain ownership or credential values + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + wraps: + - capability.identity.tenant-facts +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - No tenant-domain ownership or credential values + known_limitations: + - No tenant-domain ownership or credential values + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Tenant Engine runtime package + +Package declaration, smoke and rollback. + +## Reuse boundary + +No tenant-domain ownership or credential values. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..ce3a1f48 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-tenant-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.tenant-engine-package + name: Tenant Engine runtime package + summary: Package declaration, smoke and rollback. + domain: infotech + status: draft + owner: rapp-tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.tenant-engine-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/capabilities/capability.railiance.user-engine-package.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/capabilities/capability.railiance.user-engine-package.md new file mode 100644 index 00000000..24d262d7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/capabilities/capability.railiance.user-engine-package.md @@ -0,0 +1,97 @@ +--- +id: capability.railiance.user-engine-package +owner: rapp-user-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Pinned deployment, dedicated + CNPG, ExternalSecret references and rollback. Availability describes the delivery + form, not production acceptance. Domain, identity, PDP and custody authority + are separate.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: User Engine runtime package +summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback + includes: + - Pinned deployment, dedicated CNPG, ExternalSecret references and rollback + excludes: + - Domain, identity, PDP and custody authority are separate + use_cases: + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite + wraps: + - capability.identity.user-engine +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Human signs in with MFA and manages account or factor recovery + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - Domain, identity, PDP and custody authority are separate + known_limitations: + - Domain, identity, PDP and custody authority are separate + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# User Engine runtime package + +Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. + +## Reuse boundary + +Domain, identity, PDP and custody authority are separate. + +## Supported use cases + +- U02: Human signs in with MFA and manages account or factor recovery +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..8c97564e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rapp-user-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.user-engine-package + name: User Engine runtime package + summary: Pinned deployment, dedicated CNPG, ExternalSecret references and rollback. + domain: infotech + status: draft + owner: rapp-user-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.user-engine-package.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/capabilities/capability.railiance.substrate-bindings.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/capabilities/capability.railiance.substrate-bindings.md new file mode 100644 index 00000000..c7d11228 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/capabilities/capability.railiance.substrate-bindings.md @@ -0,0 +1,91 @@ +--- +id: capability.railiance.substrate-bindings +owner: reef-railiance +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Grouped home-reef identity, + topology and placement declarations. Availability describes the delivery form, + not production acceptance. Declarations are not automatic placement or authorization.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Substrate topology and bindings +summary: Grouped home-reef identity, topology and placement declarations. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Grouped home-reef identity, topology and placement declarations + includes: + - Grouped home-reef identity, topology and placement declarations + excludes: + - Declarations are not automatic placement or authorization + use_cases: + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Declarations are not automatic placement or authorization + known_limitations: + - Declarations are not automatic placement or authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Substrate topology and bindings + +Grouped home-reef identity, topology and placement declarations. + +## Reuse boundary + +Declarations are not automatic placement or authorization. + +## Supported use cases + +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..ae1f1a9b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reef-railiance/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.railiance.substrate-bindings + name: Substrate topology and bindings + summary: Grouped home-reef identity, topology and placement declarations. + domain: infotech + status: draft + owner: reef-railiance + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.railiance.substrate-bindings.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/capabilities/capability.execution.scheduled-agent-rein.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/capabilities/capability.execution.scheduled-agent-rein.md new file mode 100644 index 00000000..8b92ffb6 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/capabilities/capability.execution.scheduled-agent-rein.md @@ -0,0 +1,93 @@ +--- +id: capability.execution.scheduled-agent-rein +owner: rein-aharness +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Activity Core lease claim/heartbeat + and Glas profile execution. Availability describes the delivery form, not production + acceptance. Legacy paths are time-gated; task success is not privileged authority.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Scheduled agent intake and harness routing +summary: Activity Core lease claim/heartbeat and Glas profile execution. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Activity Core lease claim/heartbeat and Glas profile execution + includes: + - Activity Core lease claim/heartbeat and Glas profile execution + excludes: + - Legacy paths are time-gated; task success is not privileged authority + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - Legacy paths are time-gated; task success is not privileged authority + known_limitations: + - Legacy paths are time-gated; task success is not privileged authority + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Scheduled agent intake and harness routing + +Activity Core lease claim/heartbeat and Glas profile execution. + +## Reuse boundary + +Legacy paths are time-gated; task success is not privileged authority. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..1fc474b1 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-aharness/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.execution.scheduled-agent-rein + name: Scheduled agent intake and harness routing + summary: Activity Core lease claim/heartbeat and Glas profile execution. + domain: infotech + status: draft + owner: rein-aharness + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.scheduled-agent-rein.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/capabilities/capability.execution.openweight-rein.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/capabilities/capability.execution.openweight-rein.md new file mode 100644 index 00000000..919f8c6f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/capabilities/capability.execution.openweight-rein.md @@ -0,0 +1,89 @@ +--- +id: capability.execution.openweight-rein +owner: rein-openweights +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Tool loop, path guards, turn/budget + limits and verified-commit result. Availability describes the delivery form, + not production acceptance. Provider credential acquisition and runtime authority + need separate custody controls.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Bounded open-weight agent execution +summary: Tool loop, path guards, turn/budget limits and verified-commit result. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Tool loop, path guards, turn/budget limits and verified-commit result + includes: + - Tool loop, path guards, turn/budget limits and verified-commit result + excludes: + - Provider credential acquisition and runtime authority need separate custody controls + use_cases: + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - Provider credential acquisition and runtime authority need separate custody controls + known_limitations: + - Provider credential acquisition and runtime authority need separate custody controls + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Bounded open-weight agent execution + +Tool loop, path guards, turn/budget limits and verified-commit result. + +## Reuse boundary + +Provider credential acquisition and runtime authority need separate custody controls. + +## Supported use cases + +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..cf267ccb --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/rein-openweights/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.execution.openweight-rein + name: Bounded open-weight agent execution + summary: Tool loop, path guards, turn/budget limits and verified-commit result. + domain: infotech + status: draft + owner: rein-openweights + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.execution.openweight-rein.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/capabilities/capability.security.repository-secret-prevention.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/capabilities/capability.security.repository-secret-prevention.md new file mode 100644 index 00000000..678ef7bc --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/capabilities/capability.security.repository-secret-prevention.md @@ -0,0 +1,96 @@ +--- +id: capability.security.repository-secret-prevention +owner: repo-manager +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Repository observation plus + pinned staged-blob scanner and hook integration. Availability describes the + delivery form, not production acceptance. Local hooks are bypassable; coverage + is exact-checkout scoped.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Repository metadata and staged-secret prevention +summary: Repository observation plus pinned staged-blob scanner and hook integration. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Repository observation plus pinned staged-blob scanner and hook integration + includes: + - Repository observation plus pinned staged-blob scanner and hook integration + excludes: + - Local hooks are bypassable; coverage is exact-checkout scoped + use_cases: + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.railiance.forge-infrastructure + - capability.infotech.sbom-management + - capability.statehub.workstream-coordinate +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Owner inventories, rotates, revokes and detects exposure of credentials + - Developer builds and publishes through controlled source, dependency and runner + paths + not_recommended_for: + - Local hooks are bypassable; coverage is exact-checkout scoped + known_limitations: + - Local hooks are bypassable; coverage is exact-checkout scoped + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Repository metadata and staged-secret prevention + +Repository observation plus pinned staged-blob scanner and hook integration. + +## Reuse boundary + +Local hooks are bypassable; coverage is exact-checkout scoped. + +## Supported use cases + +- U07: Owner inventories, rotates, revokes and detects exposure of credentials +- U12: Developer builds and publishes through controlled source, dependency and runner paths + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..477c1751 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/repo-manager/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.repository-secret-prevention + name: Repository metadata and staged-secret prevention + summary: Repository observation plus pinned staged-blob scanner and hook integration. + domain: infotech + status: draft + owner: repo-manager + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.repository-secret-prevention.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/capabilities/capability.resources.security-capacity.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/capabilities/capability.resources.security-capacity.md new file mode 100644 index 00000000..b520e4b2 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/capabilities/capability.resources.security-capacity.md @@ -0,0 +1,100 @@ +--- +id: capability.resources.security-capacity +owner: resource-control +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Provider-neutral inventory, + procurement evidence and optimization reports. Availability describes the delivery + form, not production acceptance. No payment authority or irreversible procurement; + metrics do not prove usable runtime capacity.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Capacity and recovery resource planning +summary: Provider-neutral inventory, procurement evidence and optimization reports. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Provider-neutral inventory, procurement evidence and optimization reports + includes: + - Provider-neutral inventory, procurement evidence and optimization reports + excludes: + - No payment authority or irreversible procurement; metrics do not prove usable + runtime capacity + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U13: Platform owner deploys and rolls back a workload with explicit substrate + and custody bindings' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Operator recovers identity, custody or data with independently held recovery material + - Platform owner deploys and rolls back a workload with explicit substrate and custody + bindings + not_recommended_for: + - No payment authority or irreversible procurement; metrics do not prove usable + runtime capacity + known_limitations: + - No payment authority or irreversible procurement; metrics do not prove usable + runtime capacity + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Capacity and recovery resource planning + +Provider-neutral inventory, procurement evidence and optimization reports. + +## Reuse boundary + +No payment authority or irreversible procurement; metrics do not prove usable runtime capacity. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U10: Operator recovers identity, custody or data with independently held recovery material +- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..3f7aa93a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/resource-control/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.resources.security-capacity + name: Capacity and recovery resource planning + summary: Provider-neutral inventory, procurement evidence and optimization reports. + domain: infotech + status: draft + owner: resource-control + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.resources.security-capacity.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.infotech.headless-browser.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.infotech.headless-browser.md new file mode 100644 index 00000000..3adb61d5 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.infotech.headless-browser.md @@ -0,0 +1,334 @@ +--- +id: capability.infotech.headless-browser +name: Headless Browser Automation +summary: >- + Headless browser automation, screenshots and keyboard trials through + rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). + Published A5 local container; managed Railiance admission is pending. + Download the Python 3.10+ standalone client from + https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, + then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, + follow the local container setup in the capability card or adapt its A2 source + examples; this is an availability gap on the existing capability. + Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md. +owner: reuse-surface +status: reviewed +domain: infotech +tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer] +maturity: + discovery: + current: D3 + target: D4 + confidence: medium + rationale: > + Inspected four implemented Playwright consumers and separated optional + dependencies and plans from usage. No comprehensive alternatives benchmark. + availability: + current: A5 + target: A6 + confidence: medium + rationale: > + rapp-playwright 0.1.0 is a published immutable container with a versioned + HTTP contract and standalone Python client, independently trialled locally. + A5 describes deployable container availability, not managed operation (A6). + Railiance admission is pending. Existing A2 source adaptation remains usable; + no endpoint uptime or caller browser installation is implied. +external_evidence: + completeness: + level: C2 + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - Identifies implemented consumers, browser engines and source entry points. + - Gives a scoped default recommendation and a practical trial procedure. + - Published provider client and container have independent fixture screenshots and keyboard receipts. + broken_expectations: + - Managed admission and persistent platform endpoint are still pending. + - Consumer application acceptance remains the consuming repo's responsibility. + out_of_scope_expectations: + - Exhaustive estate dependency inventory or comparative browser benchmark. + - Browser service implementation or operation by reuse-surface. + - Mandatory estate-wide technology policy. + reliability: + level: R2 + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - Browser binaries and system libraries must match the selected Playwright version. + - Existing examples contain application-specific fixtures and assumptions. + - Local fixture receipts do not prove managed operation or arbitrary target compatibility. + - Local provider endpoints are ephemeral; check preflight for each trial. + evidence: + satisfied_signals: + - frontend-patterns navigation-history records a completed Chromium/Firefox experiment. + - rapp-playwright independent final-release trial passed 14 steps across desktop and narrow viewports. + - Independent provider evidence includes wrong-token, failed assertion and unavailable-service checks. +discovery: + intent: > + Help a worker select and reuse existing headless browser tooling instead of + independently introducing another automation stack. + includes: + - Playwright automation with headless Chromium as the default starting point. + - JavaScript UI tests, screenshots and page extraction examples. + - Python visual-check example and Firefox experiment evidence. + - Published rapp-playwright container, Python client and bounded HTTP fixture trials. + excludes: + - Browser hosting or workstation provisioning by reuse-surface. + - Credential provisioning and permission to automate external targets. + - Claims that a dependency declaration or a workplan proves executed browser usage. + assumptions: + - Source-adaptation consumers install matching browsers; provider clients need only Python 3.10+. + - Provider consumers establish an available endpoint and run preflight before a trial. + use_cases: + - Find which working repos already use a headless browser and where to start reusing it. + - Run a local UI assertion and screenshot in a target repo before adopting the tooling. +availability: + current_level: A5 + target_level: A6 + current_artifacts: + - forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 + - https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json + - ../whynot-design/playwright.config.mjs + - ../whynot-design/tests/visual/ui-kit.spec.mjs + - ../coulomb-social/scripts/test-usecase-browser.mjs + - ../core-hub/scripts/check_console_visual.py + - ../frontend-patterns/research/experiments/navigation-history/experiment.mjs + target_artifacts: + - >- + Managed Railiance deployment after platform admission, with consumer + access and live recovery/rollback evidence; not currently available. + consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container] +relations: + depends_on: [] + supports: [] + related_to: [] +evidence: + documentation: + - https://playwright.dev/docs/browsers + - ../frontend-patterns/research/experiments/navigation-history/README.md + - ../test-driver/SCOPE.md + - ../testdrive-jsui/pyproject.toml + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md + - intakes/REUSE-IN-0001-headless-browser-runnable-answer.md + tests: + - https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md + - docs/evidence/2026-10-13-browser-discovery.md + - ../whynot-design/tests/visual/ui-kit.spec.mjs + - ../coulomb-social/scripts/test-usecase-browser.mjs + - ../core-hub/scripts/check_console_visual.py + - ../frontend-patterns/research/experiments/navigation-history/result.json + consumer_feedback: + - >- + 2026-10-13 content-explorer, REUSE-IN-0001: published source examples did not + provide a verified runnable path for screenshots and keyboard interaction. + The false-new plan-check verdict is a registry discovery issue, not evidence + that a new browser stack is needed. Browser delivery belongs to the provider. +consumer_guidance: + recommended_for: + - Use Playwright with headless Chromium for a new repo's general UI automation trial. + - Reuse whynot-design for JavaScript visual tests and core-hub for Python visual checks. + - Reuse coulomb-social for JavaScript browser scripts and frontend-patterns for multi-engine experiments. + - >- + For bounded screenshot and keyboard jobs, use the published rapp-playwright + Python client against an available local provider and run preflight first. + Use the immutable container to reproduce the provider; managed Railiance + access requires admission and a working tunnel before consumption. + not_recommended_for: + - Treating this recommendation as an approved mandatory estate standard. + - Selecting test-driver as an implemented JavaScript-capable browser engine. + - Introducing Selenium or Puppeteer merely because their names match a discovery query. + known_limitations: + - This is a dated source inspection; run the target-repo trial before claiming adoption success. + - Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection. + - Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here. + - Local provider availability is verified but ephemeral; managed admission and platform operation remain pending. + - Provider fixture success does not establish consumer target reachability or application acceptance. +promotion_history: + - date: "2026-10-13" + dimension: availability + from: A2 + to: A5 + rationale: >- + Published immutable rapp-playwright 0.1.0 container, versioned client/contract + and independent local release receipts satisfy deployable-container availability. + This is not an A6 managed-platform claim. D3, C2 and R2 remain conservative + assessments pending broader target and operational evidence. + author: codex +--- + +# Headless Browser Automation + +## Recommendation + +Start with **Playwright controlling headless Chromium** for general browser +automation, UI tests, screenshots and JavaScript-rendered page extraction. +This follows implemented usage in four working repos. Playwright is the automation +library; Chromium is the browser engine. Use `@playwright/test` for a JavaScript +test suite, the `playwright` library for standalone JavaScript scripts, or Python +`playwright` when the consumer is Python. + +This is a reuse recommendation reviewed against source on **2026-10-13**, not a +mandatory estate standard or a benchmark verdict against Selenium/Puppeteer. +reuse-surface maintains this discovery record; the example repos maintain their +implementations and the upstream Playwright project maintains the library. + +## Service provider and delivery status + +**rapp-playwright 0.1.0 is published and verified as a local container provider.** +The current vector is **D3 / A5 / C2 / R2**. A5 means a deployable container under +[the maturity standard](../../specs/CapabilityMaturityStandard.md); managed +platform operation is A6 and remains **pending Railiance admission**. Source +examples remain available at A2. No browser is installed on the caller's machine +by discovery or by running the Python client. + +`rapp-playwright` owns the browser service; `railiance-platform` owns managed +lifecycle admission. `reuse-surface` owns this record, discovery, consumption +guidance and evidence assessment. The +[content-explorer intake](../../intakes/REUSE-IN-0001-headless-browser-runnable-answer.md) +concerns registry relevance and availability clarity; CONTENT-WP-0000-T04 +acceptance remains with the consumer. + +### Verified client path + +Only Python 3.10+ is needed by the consumer. Download the single revision-pinned +client into a working directory; a sibling checkout is not required: + +```sh +curl -fL --output rapp_playwright.py https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py +python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight +python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01 +``` + +Use a fresh output directory for each run. Port **18083** was verified on this +workstation on **2026-10-13**; it is an ephemeral local provider, not a permanent +or remotely reachable endpoint. Preflight must report `available: true`, API 1, +service 0.1.0, Playwright **1.64.0**, Chromium **156.0.8078.4**, and the expected +release/location. Connection failure means the provider or tunnel is unavailable, +not that another browser capability is needed. Use the local setup below or the +source-adaptation fallback. Repeat `--url` on later status/download commands. + +The fixture trial checks Tab focus, Enter activation and the counter assertion +across **1280×800** and **390×844** viewports, then downloads screenshots and a +receipt. It does not inspect or accept the consumer's own UI. `run.json` is a +private run handle and must not be published. For `trial`/`run`, exit 0 means +passed, 2 means UI assertion failed, and 3 means infrastructure/setup or another +unsuccessful result; `status` exit 0 only means retrieval succeeded. + +### Reproduce the local provider + +The published release targets **linux/amd64**. With Docker and image pull access, +start the immutable container in one terminal, then point the client at port +**18081** in another: + +```sh +docker run --rm --name rapp-playwright-local --read-only \ + --tmpfs /tmp:rw,size=512m --shm-size=256m --memory=1g --cpus=1 \ + --cap-drop ALL --security-opt no-new-privileges \ + --mount type=volume,src=rapp-playwright-local-data,dst=/data \ + -p 127.0.0.1:18081:8080 -e HOST=0.0.0.0 \ + -e EXECUTION_LOCATION=workstation-container \ + -e RELEASE_ID=sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 \ + forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 +python3 rapp_playwright.py --url http://127.0.0.1:18081 preflight +python3 rapp_playwright.py --url http://127.0.0.1:18081 trial --out trial-local-01 +``` + +This is the provider's documented local setup with the published digest pinned; +it was not redeployed by this registry review. Existing independent final-release +receipts and the fresh discovery trial use the same digest. The default fixture +requires no external target grant. The provider supports trusted/synthetic pages, +not hostile-page or mutually untrusted tenant execution. + +### Conditional managed path + +Only **after platform admission, deployment and caller access are confirmed**: + +```sh +kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1 +# In another terminal, while the tunnel remains running: +python3 rapp_playwright.py preflight +python3 rapp_playwright.py trial --out trial-managed-01 +``` + +No managed deployment or successful managed invocation is claimed here. A remote +browser's localhost belongs to the provider. Consumer applications need a +provider-reachable, explicitly allowed origin; the browser API tunnel does not +forward a workstation app. See the provider contract before running a target +scenario. + +### Pinned delivery evidence + +All provider links below are pinned to published commit +`8831a05aeba5ce588f3b395ade676dde2a151c5d`: + +- [Consumer contract](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md). +- [Release manifest](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json) + and [publication/pull evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md). +- [Independent consumer evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md), + including final-release screenshots, keyboard assertions, wrong-token rejection, + UI failure and unavailable-service results. These are retained provider-side + reports; this review separately verified the fixture path. +- [Fresh registry review and trial](../../docs/evidence/2026-10-13-browser-discovery.md). + +## Existing implementations + +Paths in frontmatter are relative to the reuse-surface repository root. The links +below work with sibling checkouts. The cited files were clean at these revisions. + +| Repo and inspected revision | What is implemented | Reuse starting point | +| --- | --- | --- | +| whynot-design — `a79a4d803e9aed13f66d072bf409b6f86000f01f` | Playwright Test, explicitly headless Chromium, screenshot comparisons | [Configuration](../../../whynot-design/playwright.config.mjs), [visual tests](../../../whynot-design/tests/visual/ui-kit.spec.mjs), [dependency/scripts](../../../whynot-design/package.json) | +| coulomb-social — `5c32757b987ab1610cdb46a808d56c75f569f581` | JavaScript Playwright scripts launching headless Chromium for browser tests and extraction | [Use-case test](../../../coulomb-social/scripts/test-usecase-browser.mjs), [script dependency](../../../coulomb-social/scripts/package.json) | +| core-hub — `a69ad325271485afe284a6db85673dfa30d9d4ad` | Python synchronous Playwright visual checks launching Chromium with the default headless mode | [Visual-check script](../../../core-hub/scripts/check_console_visual.py), [development dependency](../../../core-hub/pyproject.toml) | +| frontend-patterns — `047a6a2d314ff5a9d2a87d5bc987d7d84835f682` | Playwright experiments using Chromium and Firefox, with retained execution receipts | [Runner](../../../frontend-patterns/research/experiments/navigation-history/experiment.mjs), [setup and limitations](../../../frontend-patterns/research/experiments/navigation-history/README.md), [result](../../../frontend-patterns/research/experiments/navigation-history/result.json) | + +These are source/retained-receipt observations, not newly executed test results. +The frontend-patterns example uses an explicit Chromium binary override; do not +copy its workstation paths as a portable browser installation recipe. + +## Alternatives and misleading matches + +- **Selenium:** [testdrive-jsui's optional development dependencies](../../../testdrive-jsui/pyproject.toml) + declare it at `701341d7fa520f860245e28eb16d44b767fd116b`. A declaration alone + does not establish an implemented or passing browser workflow. +- **test-driver:** [SCOPE.md](../../../test-driver/SCOPE.md) at + `c3ad06e598057862cf500cbd46c7c8b6f83885ed` explicitly excludes a browser engine, + JavaScript execution, screenshots and DOM timing. Historical Playwright plans + are not an available implementation. +- **Puppeteer:** no verified implementation was found in this inspection. This + is not a claim that every working repo has been exhaustively searched. +- **Firefox/WebKit:** Playwright supports both upstream. Firefox has retained + experiment evidence here; WebKit has no verified local example in this record. + +## Source-adaptation fallback for the consuming worker + +1. Query this checkout with `python3 -m reuse_surface.cli query --keyword browser` + from the reuse-surface root, then open this entry. If the CLI is installed, + `reuse-surface query --keyword browser` is equivalent. + `plan-check --intent "headless browser" --no-llm` ranks this entry first. + Its reuse verdict describes relevance; provider preflight determines current + runtime availability. Use source adaptation when the provider path is unsuitable. +2. Pick the example matching the target repo's language and task. Inspect its + fixture/server assumptions before adapting the smallest useful test or script. +3. Use the target repo's package manager and lockfile. Select a compatible + Playwright version and install its matching Chromium binary. For an installed + Node dependency, use `npx playwright install chromium`; for an installed Python + dependency, use `python -m playwright install chromium` in its environment. + Follow the upstream [browser/system-dependency instructions](https://playwright.dev/docs/browsers) + if system libraries are missing. No common estate version is established here. +4. Against a local fixture or the target repo's local development server, launch + headless Chromium, load one page, assert one meaningful rendered element or + interaction, save a screenshot if relevant, and close the browser. Exercise + a JavaScript-driven change if JavaScript rendering is the reason for adoption. +5. Report the consumer repo, reference example, package/browser versions, exact + command, assertion outcome, artifact paths and any setup failure. The trial + remains unverified until this evidence exists; installation alone is not success. + +The hosted service reads published repository indexes. A local edit does not +by itself make this entry available at `reuse.coulomb.social`; use the local query +above for an unpublished trial and verify the hosted entry after publication. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.register.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.register.md new file mode 100644 index 00000000..f873c59d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.register.md @@ -0,0 +1,198 @@ +--- +id: capability.registry.register +name: Capability registry and federation +summary: Owner Markdown entries, indexes, federation hub and planning queries. +owner: reuse-surface +status: draft +domain: helix_forge +tags: +- registry +- governance +- meta +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: 'Core use case UC-RS-001 is documented in specs/UseCaseCatalog.md and + the registry model is bounded in INTENT.md, but concrete promotion workflows + are not yet grounded in registry artifacts. + + ' + availability: + current: A3 + target: A5 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Owner Markdown entries, indexes, + federation hub and planning queries. Availability describes the delivery form, + not production acceptance. Discovery is not readiness; empty and stale entries + need evidence-led maintenance.' +external_evidence: + completeness: + level: C2 + name: Partial + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - capability IDs can be assigned in registry entries + - maturity vectors can be recorded at registration time + - CLI validate, query, and export support registry workflows + - promotion history can be recorded in entries + - federation repo registration via hosted hub API and hub CLI + broken_expectations: + - no automated duplicate detection yet + out_of_scope_expectations: + - hosting registered capabilities + - enforcing implementation architecture + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - index drift still possible if authors skip validate + - CLI requires local venv install + - sibling repos cannot register until indexes publish raw URLs + evidence: + satisfied_signals: + - CI validate with fail-on-warnings on every push + - hub register/list/federated smoke on production reuse.coulomb.social + - pytest coverage for hub API and federation compose paths +discovery: + intent: Owner Markdown entries, indexes, federation hub and planning queries + includes: + - Owner Markdown entries, indexes, federation hub and planning queries + excludes: + - Discovery is not readiness; empty and stale entries need evidence-led maintenance + assumptions: + - unregistered capabilities are invisible for registry-driven reuse + - low-maturity entries are acceptable when evidence gaps are explicit + use_cases: + - UC-RS-001 + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: + - specs/UseCaseCatalog.md + - specs/ProductRequirementsDocument.md +availability: + current_level: A3 + target_level: A5 + current_artifacts: + - docs/RegistryFederation.md + - specs/CapabilityMaturityStandard.md + target_artifacts: + - packaged container release with documented SLO + consumption_modes: + - library + - CLI +relations: + depends_on: [] + supports: + - capability.feature-control.evaluate + - capability.identity.vocabulary-canonicalize + related_to: + - capability.registry.validate + - capability.security.iam-tooling-suite +evidence: + documentation: + - docs/RegistryFederation.md + - specs/CapabilityMaturityStandard.md + tests: + - tests/test_hub.py + - tests/test_hub_sync.py + - .forgejo/workflows/ci.yml + consumer_feedback: + - 'reuse-surface dogfood (REUSE-WP-0011): production hub registration and /v1/federated + compose succeeded on Railiance01 without write-path regressions after WP-0011 + deploy. + + ' + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Discovery is not readiness; empty and stale entries need evidence-led maintenance + known_limitations: + - Discovery is not readiness; empty and stale entries need evidence-led maintenance + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-06-14' + dimension: discovery + from: D0 + to: D1 + rationale: Added name, summary, and registry-first intent from INTENT.md. + author: reuse-surface +- date: '2026-06-15' + dimension: discovery + from: D1 + to: D3 + rationale: Bounded scope with UC-RS-001 and MVP registry artifacts in specs/. + author: reuse-surface +- date: '2026-06-15' + dimension: availability + from: A0 + to: A3 + rationale: reuse-surface CLI shipped validate, query, and export commands. + author: reuse-surface +- date: '2026-06-15' + dimension: availability + from: A3 + to: A4 + rationale: 'Hosted federation hub live at reuse.coulomb.social; hub register/update + via HTTP API and reuse-surface hub CLI; production deploy on Railiance01. + + ' + author: reuse-surface +- date: '2026-06-16' + dimension: reliability + from: R2 + to: R3 + rationale: 'CI gates, pytest hub/federation coverage, and production hub smoke support + normal registration workflows with documented limitations. + + ' + author: reuse-surface +- date: '2026-10-14' + dimension: availability + from: A4 + to: A3 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# Capability registry and federation + +Owner Markdown entries, indexes, federation hub and planning queries. + +## Reuse boundary + +Discovery is not readiness; empty and stale entries need evidence-led maintenance. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [docs/RegistryFederation.md](../../docs/RegistryFederation.md) +- [specs/CapabilityMaturityStandard.md](../../specs/CapabilityMaturityStandard.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.validate.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.validate.md new file mode 100644 index 00000000..8231e350 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/capabilities/capability.registry.validate.md @@ -0,0 +1,134 @@ +--- +id: capability.registry.validate +name: Capability registry validation +summary: Schema, index consistency and relation checks. +owner: reuse-surface +status: draft +domain: helix_forge +tags: +- registry +- validation +- cli +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: UC-RS-023 is implemented via reuse-surface validate with schema and + drift checks. + availability: + current: A3 + target: A3 + confidence: high + rationale: 'Source interface assessed 2026-10-14: Schema, index consistency and + relation checks. Availability describes the delivery form, not production acceptance. + Schema validity alone proves neither capability behavior nor hosted freshness.' +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - schema validation for entry front matter + - index drift detection + - optional relation integrity checks + broken_expectations: [] + out_of_scope_expectations: + - runtime validation of registered capability implementations + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - requires local venv install + - relation warnings require explicit --relations flag + evidence: + satisfied_signals: + - validate --relations --fail-on-warnings in CI + - tests/test_registry.py schema and drift coverage +discovery: + intent: Schema, index consistency and relation checks + includes: + - Schema, index consistency and relation checks + excludes: + - Schema validity alone proves neither capability behavior nor hosted freshness + use_cases: + - UC-RS-023 + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: + - specs/UseCaseCatalog.md +availability: + current_level: A3 + target_level: A3 + current_artifacts: + - docs/RegistryFederation.md + - schemas/capability.schema.yaml + consumption_modes: + - library + - CLI +relations: + depends_on: + - capability.registry.register + supports: [] + related_to: + - capability.registry.register + - capability.security.iam-tooling-suite +evidence: + documentation: + - docs/RegistryFederation.md + - schemas/capability.schema.yaml + tests: + - tests/test_registry.py + consumer_feedback: + - 'reuse-surface CI: registry changes fail when schema validation or relation checks + warn with --fail-on-warnings, giving agents a dependable pre-merge gate. + + ' +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Schema validity alone proves neither capability behavior nor hosted freshness + known_limitations: + - Schema validity alone proves neither capability behavior nor hosted freshness + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-06-16' + dimension: reliability + from: R2 + to: R3 + rationale: CI fail-on-warnings and pytest registry coverage support dependable validation. + author: reuse-surface +--- + +# Capability registry validation + +Schema, index consistency and relation checks. + +## Reuse boundary + +Schema validity alone proves neither capability behavior nor hosted freshness. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [docs/RegistryFederation.md](../../docs/RegistryFederation.md) +- [schemas/capability.schema.yaml](../../schemas/capability.schema.yaml) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..fecdaac8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/reuse-surface/registry/indexes/capabilities.yaml @@ -0,0 +1,78 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.infotech.headless-browser + name: Headless Browser Automation + summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright + 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; + managed Railiance admission is pending. Download the Python 3.10+ standalone client + from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py + and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then + `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` + with a fresh output directory. This endpoint was verified locally on 2026-10-13 + and is ephemeral; it installs no browser for the caller. If unreachable, follow + the local container setup in the capability card or adapt its A2 source examples; + this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.' + vector: D3 / A5 / C2 / R2 + domain: infotech + status: reviewed + owner: reuse-surface + path: registry/capabilities/capability.infotech.headless-browser.md + tags: + - headless + - browser + - automation + - playwright + - chromium + - testing + - screenshots + - extraction + - firefox + - webkit + - selenium + - puppeteer + consumption_modes: + - informational + - source adaptation + - JavaScript library + - Python library + - cli + - service API + - container +- id: capability.registry.register + name: Capability registry and federation + summary: Owner Markdown entries, indexes, federation hub and planning queries. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - governance + - meta + - security + - netkingdom + - framework-reuse + vector: D3 / A3 / C2 / R3 + path: registry/capabilities/capability.registry.register.md + consumption_modes: + - library + - CLI +- id: capability.registry.validate + name: Capability registry validation + summary: Schema, index consistency and relation checks. + domain: helix_forge + status: draft + owner: reuse-surface + tags: + - registry + - validation + - cli + - security + - netkingdom + - framework-reuse + vector: D4 / A3 / C3 / R3 + path: registry/capabilities/capability.registry.validate.md + consumption_modes: + - library + - CLI diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/capabilities/capability.security.risk-register.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/capabilities/capability.security.risk-register.md new file mode 100644 index 00000000..81cd4222 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/capabilities/capability.security.risk-register.md @@ -0,0 +1,93 @@ +--- +id: capability.security.risk-register +owner: risk-nexus +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Markdown findings and Python + review, verification and due-work reports. Availability describes the delivery + form, not production acceptance. Judgment remains human or agent; no live EUR + risk gate or autonomous response.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security risk and exception review register +summary: Markdown findings and Python review, verification and due-work reports. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Markdown findings and Python review, verification and due-work reports + includes: + - Markdown findings and Python review, verification and due-work reports + excludes: + - Judgment remains human or agent; no live EUR risk gate or autonomous response + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Judgment remains human or agent; no live EUR risk gate or autonomous response + known_limitations: + - Judgment remains human or agent; no live EUR risk gate or autonomous response + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security risk and exception review register + +Markdown findings and Python review, verification and due-work reports. + +## Reuse boundary + +Judgment remains human or agent; no live EUR risk gate or autonomous response. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..685047ea --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/risk-nexus/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.risk-register + name: Security risk and exception review register + summary: Markdown findings and Python review, verification and due-work reports. + domain: infotech + status: draft + owner: risk-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.risk-register.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/capabilities/capability.organization.role-catalog.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/capabilities/capability.organization.role-catalog.md new file mode 100644 index 00000000..0d36f975 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/capabilities/capability.organization.role-catalog.md @@ -0,0 +1,92 @@ +--- +id: capability.organization.role-catalog +owner: role-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Versioned documentation catalog. + Availability describes the delivery form, not production acceptance. Not IAM + roles, assignments or runtime authorization.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Organizational role definitions +summary: Versioned documentation catalog. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Versioned documentation catalog + includes: + - Versioned documentation catalog + excludes: + - Not IAM roles, assignments or runtime authorization + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - README.md + - INTENT.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md + - INTENT.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Agent executes an attributable bounded task and supplies supervision evidence + not_recommended_for: + - Not IAM roles, assignments or runtime authorization + known_limitations: + - Not IAM roles, assignments or runtime authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Organizational role definitions + +Versioned documentation catalog. + +## Reuse boundary + +Not IAM roles, assignments or runtime authorization. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U11: Agent executes an attributable bounded task and supplies supervision evidence + +## Evidence and integration + +- [README.md](../../README.md) +- [INTENT.md](../../INTENT.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..c0136178 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/role-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.organization.role-catalog + name: Organizational role definitions + summary: Versioned documentation catalog. + domain: infotech + status: draft + owner: role-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.organization.role-catalog.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md new file mode 100644 index 00000000..2e2be670 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/capabilities/capability.infotech.runbook-tutorials.md @@ -0,0 +1,100 @@ +--- +id: capability.infotech.runbook-tutorials +owner: runbook-tutorials +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Pack schema, loader, local UI/CLI, + gates, verification and rollback evidence. Availability describes the delivery + form, not production acceptance. Owner supplies procedures; UI progress is not + runtime approval.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Guided administrative runbooks +summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence + includes: + - Pack schema, loader, local UI/CLI, gates, verification and rollback evidence + excludes: + - Owner supplies procedures; UI progress is not runtime approval + use_cases: + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - docs/pack-spec.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - docs/pack-spec.md +consumer_guidance: + recommended_for: + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Operator recovers identity, custody or data with independently held recovery material + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Owner supplies procedures; UI progress is not runtime approval + known_limitations: + - Owner supplies procedures; UI progress is not runtime approval + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Guided administrative runbooks + +Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. + +## Reuse boundary + +Owner supplies procedures; UI progress is not runtime approval. + +## Supported use cases + +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U10: Operator recovers identity, custody or data with independently held recovery material +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [docs/pack-spec.md](../../docs/pack-spec.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..432ceaed --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/runbook-tutorials/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +capabilities: +- id: capability.infotech.runbook-tutorials + name: Guided administrative runbooks + summary: Pack schema, loader, local UI/CLI, gates, verification and rollback evidence. + domain: infotech + status: draft + owner: runbook-tutorials + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.infotech.runbook-tutorials.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/capabilities/execution.sandbox-provision.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/capabilities/execution.sandbox-provision.md new file mode 100644 index 00000000..807fb7be --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/capabilities/execution.sandbox-provision.md @@ -0,0 +1,115 @@ +--- +id: capability.execution.sandbox-provision +name: Sandbox establishment and lifecycle +summary: Profiles, extensions, provision, checkpoints, TTL teardown and telemetry. +owner: sand-boxer +status: draft +domain: infotech +tags: +- sandbox +- isolation +- provision +- e2e +- agentic +- execution +- profile +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D5 + target: D6 + confidence: high + rationale: 'Charter (INTENT.md), meta-framework spec, extension SDK, integration + docs, and research synthesis. Capability indexed in registry/. + + ' + availability: + current: A5 + target: A5 + confidence: high + rationale: 'Source interface assessed 2026-10-14: Profiles, extensions, provision, + checkpoints, TTL teardown and telemetry. Availability describes the delivery + form, not production acceptance. Backend-specific guarantees; a created sandbox + alone proves no credential isolation.' +external_evidence: + completeness: + level: C5 + name: Mature + confidence: high + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - profile-based create/destroy/snapshot/restore via CLI + - TTL extend and expire/reap (SAND-WP-0009) + - E2B and Modal cloud adapters with BYOK (SAND-WP-0010) + - State Hub lifecycle events on transitions + - wise-validator and the-custodian migration arc complete + - extension SDK with compose-ssh, vm-packer attach, saas-stub, e2b, modal + broken_expectations: + - sandboxer01 dedicated host not live (CoulombCore interim) + out_of_scope_expectations: + - agent harness and tool orchestration (glas-harness) + - e2e test semantics (wise-validator) + reliability: + level: R0 + confidence: low + basis: No longitudinal reliability assessment available. +discovery: + intent: Profiles, extensions, provision, checkpoints, TTL teardown and telemetry + includes: + - Profiles, extensions, provision, checkpoints, TTL teardown and telemetry + excludes: + - Backend-specific guarantees; a created sandbox alone proves no credential isolation + use_cases: + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A5 + target_level: A5 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - containerized service + - CLI +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Agent executes an attributable bounded task and supplies supervision evidence + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Backend-specific guarantees; a created sandbox alone proves no credential isolation + known_limitations: + - Backend-specific guarantees; a created sandbox alone proves no credential isolation + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Sandbox establishment and lifecycle + +Profiles, extensions, provision, checkpoints, TTL teardown and telemetry. + +## Reuse boundary + +Backend-specific guarantees; a created sandbox alone proves no credential isolation. + +## Supported use cases + +- U11: Agent executes an attributable bounded task and supplies supervision evidence +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..ecffd1c8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/sand-boxer/registry/indexes/capabilities.yaml @@ -0,0 +1,26 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +capabilities: +- id: capability.execution.sandbox-provision + name: Sandbox establishment and lifecycle + summary: Profiles, extensions, provision, checkpoints, TTL teardown and telemetry. + domain: infotech + status: draft + owner: sand-boxer + tags: + - sandbox + - isolation + - provision + - e2e + - agentic + - execution + - profile + - security + - netkingdom + - framework-reuse + vector: D5 / A5 / C5 / R0 + path: registry/capabilities/execution.sandbox-provision.md + consumption_modes: + - containerized service + - CLI diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md new file mode 100644 index 00000000..cc363854 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/capabilities/capability.infotech.sbom-management.md @@ -0,0 +1,96 @@ +--- +id: capability.infotech.sbom-management +owner: sbom-nexus +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Controlled archive ingest, immutable + snapshots, freshness and license review. Availability describes the delivery + form, not production acceptance. SBOM and license evidence do not prove vulnerability + exploitability or artifact trust.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Dependency provenance and SBOM evidence +summary: Controlled archive ingest, immutable snapshots, freshness and license review. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Controlled archive ingest, immutable snapshots, freshness and license review + includes: + - Controlled archive ingest, immutable snapshots, freshness and license review + excludes: + - SBOM and license evidence do not prove vulnerability exploitability or artifact + trust + use_cases: + - 'U12: Developer builds and publishes through controlled source, dependency and + runner paths' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - README.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md +consumer_guidance: + recommended_for: + - Developer builds and publishes through controlled source, dependency and runner + paths + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - SBOM and license evidence do not prove vulnerability exploitability or artifact + trust + known_limitations: + - SBOM and license evidence do not prove vulnerability exploitability or artifact + trust + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Dependency provenance and SBOM evidence + +Controlled archive ingest, immutable snapshots, freshness and license review. + +## Reuse boundary + +SBOM and license evidence do not prove vulnerability exploitability or artifact trust. + +## Supported use cases + +- U12: Developer builds and publishes through controlled source, dependency and runner paths +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..d38f3ef3 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/sbom-nexus/registry/indexes/capabilities.yaml @@ -0,0 +1,21 @@ +schema: reuse-surface.capability-index.v1 +repo: sbom-nexus +capabilities: +- id: capability.infotech.sbom-management + name: Dependency provenance and SBOM evidence + summary: Controlled archive ingest, immutable snapshots, freshness and license review. + domain: infotech + status: draft + owner: sbom-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.infotech.sbom-management.md + consumption_modes: + - HTTP API + - source +updated: '2026-10-14' +version: 1 +domain: infotech diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/capabilities/capability.security.credential-lifecycle.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/capabilities/capability.security.credential-lifecycle.md new file mode 100644 index 00000000..b9c52326 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/capabilities/capability.security.credential-lifecycle.md @@ -0,0 +1,108 @@ +--- +id: capability.security.credential-lifecycle +owner: secrets-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: CLI catalog, plan, exact OpenBao + metadata apply, provisioning, verification, delivery and revoke. Availability + describes the delivery form, not production acceptance. Production protected + execution and independently anchored PDP authentication remain incomplete.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Cataloged credential lifecycle +summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke + includes: + - CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery + and revoke + excludes: + - Production protected execution and independently anchored PDP authentication remain + incomplete + use_cases: + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' + - 'U05: Operator provisions and delivers a scoped workload credential through the + approved owner lane' + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - src/secrets_engine/decision_check.py + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.approval-lifecycle + - capability.authorization.policy-evaluate + - capability.railiance.platform-services + - capability.security.ssh-certificate-issuance +evidence: + documentation: + - SCOPE.md + - src/secrets_engine/decision_check.py +consumer_guidance: + recommended_for: + - Protected operation obtains and consumes exact human approval before its side + effect + - Operator provisions and delivers a scoped workload credential through the approved + owner lane + - Owner inventories, rotates, revokes and detects exposure of credentials + not_recommended_for: + - Production protected execution and independently anchored PDP authentication remain + incomplete + known_limitations: + - Production protected execution and independently anchored PDP authentication remain + incomplete + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Cataloged credential lifecycle + +CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke. + +## Reuse boundary + +Production protected execution and independently anchored PDP authentication remain incomplete. + +## Supported use cases + +- U04: Protected operation obtains and consumes exact human approval before its side effect +- U05: Operator provisions and delivers a scoped workload credential through the approved owner lane +- U07: Owner inventories, rotates, revokes and detects exposure of credentials + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [src/secrets_engine/decision_check.py](../../src/secrets_engine/decision_check.py) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..aad3b05b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/secrets-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,20 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +capabilities: +- id: capability.security.credential-lifecycle + name: Cataloged credential lifecycle + summary: CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, + delivery and revoke. + domain: infotech + status: draft + owner: secrets-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.credential-lifecycle.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/capabilities/capability.security.practice-canon.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/capabilities/capability.security.practice-canon.md new file mode 100644 index 00000000..94dd7376 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/capabilities/capability.security.practice-canon.md @@ -0,0 +1,101 @@ +--- +id: capability.security.practice-canon +owner: security-canon +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A0 + target: A0 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Versioned SEC-DSM and Mode of + Authority documents. Availability describes the delivery form, not production + acceptance. Normative practice; no runtime control or certification.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Security practice and authority vocabulary +summary: Versioned SEC-DSM and Mode of Authority documents. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Versioned SEC-DSM and Mode of Authority documents + includes: + - Versioned SEC-DSM and Mode of Authority documents + excludes: + - Normative practice; no runtime control or certification + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A0 + target_level: A0 + current_artifacts: + - SCOPE.md + - infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md + consumption_modes: + - informational +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Owner inventories, rotates, revokes and detects exposure of credentials + - Operator recovers identity, custody or data with independently held recovery material + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Normative practice; no runtime control or certification + known_limitations: + - Normative practice; no runtime control or certification + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Security practice and authority vocabulary + +Versioned SEC-DSM and Mode of Authority documents. + +## Reuse boundary + +Normative practice; no runtime control or certification. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U07: Owner inventories, rotates, revokes and detects exposure of credentials +- U10: Operator recovers identity, custody or data with independently held recovery material +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md](../../infospace/standards/devops-secrets-management/SecurityCanonDevOpsSecretsManagementStandard.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..b215aac4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/security-canon/registry/indexes/capabilities.yaml @@ -0,0 +1,18 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.practice-canon + name: Security practice and authority vocabulary + summary: Versioned SEC-DSM and Mode of Authority documents. + domain: infotech + status: draft + owner: security-canon + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A0 / C1 / R0 + path: registry/capabilities/capability.security.practice-canon.md + consumption_modes: + - informational +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.progress-log.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.progress-log.md new file mode 100644 index 00000000..0a49643b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.progress-log.md @@ -0,0 +1,118 @@ +--- +id: capability.statehub.progress-log +name: Progress and work evidence indexing +summary: REST progress and task evidence references. +owner: state-hub +status: draft +domain: helix_forge +tags: +- state-hub +- progress +- coordination +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: Progress API and agent session protocol are documented in state-hub + AGENTS.md. + availability: + current: A4 + target: A6 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: REST progress and task evidence + references. Availability describes the delivery form, not production acceptance. + Not independent security event custody.' +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - progress events attach to workstreams + - agents can log session summaries + broken_expectations: [] + out_of_scope_expectations: + - replacing git commit history + reliability: + level: R3 + name: Usable + confidence: medium + basis: consumer_quality_signals + known_reliability_risks: + - depends on hub availability and tunnel health for remote agents + evidence: + satisfied_signals: + - reuse-surface AGENTS.md session-close protocol cites POST /progress/ + - cross-repo agents log progress with workstream_id linkage +discovery: + intent: REST progress and task evidence references + includes: + - REST progress and task evidence references + excludes: + - Not independent security event custody + use_cases: + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' +availability: + current_level: A4 + target_level: A6 + current_artifacts: + - README.md + - SCOPE.md + consumption_modes: + - HTTP API + - source +relations: + depends_on: + - capability.statehub.workstream-coordinate + supports: [] + related_to: + - capability.statehub.workstream-coordinate + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md + - SCOPE.md + consumer_feedback: + - 'reuse-surface agents (REUSE-WP-0012): session-close progress posts to State Hub + succeeded for workstream fb0b6067 during federation workplan work. + + ' +consumer_guidance: + recommended_for: + - Consumer emits security events and reconciles independently retained evidence + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Not independent security event custody + known_limitations: + - Not independent security event custody + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Progress and work evidence indexing + +REST progress and task evidence references. + +## Reuse boundary + +Not independent security event custody. + +## Supported use cases + +- U08: Consumer emits security events and reconciles independently retained evidence +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [README.md](../../README.md) +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md new file mode 100644 index 00000000..2c19a22b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/capabilities/capability.statehub.workstream-coordinate.md @@ -0,0 +1,128 @@ +--- +id: capability.statehub.workstream-coordinate +name: Cross-repository work tracking +summary: File-derived workplans, tasks, dependencies, decisions and coordination views. +owner: state-hub +status: draft +domain: helix_forge +tags: +- state-hub +- coordination +- workplans +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: medium + rationale: 'State Hub intent, scope, and ADR-001 workplan conventions are documented; + concrete agent workflows are still being standardized across repos. + + ' + availability: + current: A4 + target: A6 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: File-derived workplans, tasks, + dependencies, decisions and coordination views. Availability describes the delivery + form, not production acceptance. Read/cache/index of owner work; not runtime + approval authority.' +external_evidence: + completeness: + level: C3 + name: Functional Core + confidence: medium + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - workstream and task tracking via HTTP API + - workplan file to database consistency sync + - progress event logging + broken_expectations: + - no native MCP server for all agent environments + out_of_scope_expectations: + - replacing git-backed workplan canon + - identity authority + reliability: + level: R2 + name: Tolerable + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - depends on local hub availability and operator maintenance +discovery: + intent: File-derived workplans, tasks, dependencies, decisions and coordination + views + includes: + - File-derived workplans, tasks, dependencies, decisions and coordination views + excludes: + - Read/cache/index of owner work; not runtime approval authority + assumptions: + - workplans remain authoritative in git for ADR-001 repos + use_cases: + - UC-RS-013 + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + research_memos: + - state-hub/INTENT.md +availability: + current_level: A4 + target_level: A6 + current_artifacts: + - README.md + - SCOPE.md + target_artifacts: + - state-hub/platform/state-hub-service + consumption_modes: + - HTTP API + - source +relations: + depends_on: + - capability.infotech.hub-core-library + supports: + - capability.registry.register + - capability.infotech.core-hub + related_to: + - capability.statehub.progress-log + - capability.infotech.hub-core-library + - capability.infotech.core-hub + - capability.security.iam-tooling-suite +evidence: + documentation: + - README.md + - SCOPE.md + tests: [] + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + not_recommended_for: + - Read/cache/index of owner work; not runtime approval authority + known_limitations: + - Read/cache/index of owner work; not runtime approval authority + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Cross-repository work tracking + +File-derived workplans, tasks, dependencies, decisions and coordination views. + +## Reuse boundary + +Read/cache/index of owner work; not runtime approval authority. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes + +## Evidence and integration + +- [README.md](../../README.md) +- [SCOPE.md](../../SCOPE.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..7c5f65e7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/state-hub/registry/indexes/capabilities.yaml @@ -0,0 +1,41 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.statehub.progress-log + name: Progress and work evidence indexing + summary: REST progress and task evidence references. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - progress + - coordination + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R3 + path: registry/capabilities/capability.statehub.progress-log.md + consumption_modes: + - HTTP API + - source +- id: capability.statehub.workstream-coordinate + name: Cross-repository work tracking + summary: File-derived workplans, tasks, dependencies, decisions and coordination + views. + domain: helix_forge + status: draft + owner: state-hub + tags: + - state-hub + - coordination + - workplans + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C3 / R2 + path: registry/capabilities/capability.statehub.workstream-coordinate.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/capabilities/capability.identity.tenant-facts.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/capabilities/capability.identity.tenant-facts.md new file mode 100644 index 00000000..84387ab3 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/capabilities/capability.identity.tenant-facts.md @@ -0,0 +1,99 @@ +--- +id: capability.identity.tenant-facts +owner: tenant-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Cache-read, live-lookup and + write APIs; PostgreSQL lifecycle store. Availability describes the delivery + form, not production acceptance. Tenant ceilings may narrow platform authority; + external audit sender acceptance remains separate.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Tenant lifecycle and guardrail facts +summary: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store + includes: + - Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store + excludes: + - Tenant ceilings may narrow platform authority; external audit sender acceptance + remains separate + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U04: Protected operation obtains and consumes exact human approval before its + side effect' +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - HTTP API + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Protected operation obtains and consumes exact human approval before its side + effect + not_recommended_for: + - Tenant ceilings may narrow platform authority; external audit sender acceptance + remains separate + known_limitations: + - Tenant ceilings may narrow platform authority; external audit sender acceptance + remains separate + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Tenant lifecycle and guardrail facts + +Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store. + +## Reuse boundary + +Tenant ceilings may narrow platform authority; external audit sender acceptance remains separate. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U04: Protected operation obtains and consumes exact human approval before its side effect + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..21b6333b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/tenant-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +capabilities: +- id: capability.identity.tenant-facts + name: Tenant lifecycle and guardrail facts + summary: Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store. + domain: infotech + status: draft + owner: tenant-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A4 / C1 / R0 + path: registry/capabilities/capability.identity.tenant-facts.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md new file mode 100644 index 00000000..3c0f8961 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/capabilities/capability.agents.custodian-runtime-tooling.md @@ -0,0 +1,128 @@ +--- +id: capability.agents.custodian-runtime-tooling +name: Generic agent runtime and repository tooling +summary: Agent runtime modules and repository classification tooling. +owner: the-custodian +status: draft +domain: custodian +tags: +- agents +- runtime +- classification +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D2 + target: D4 + confidence: medium + rationale: This repo's README and canon content are marked confidential/proprietary; + this entry deliberately scopes to the generic, non-proprietary tooling surface + only (runtime/ agent framework, tools/ classification scripts), which is separately + reusable and does not disclose canon/memory contents. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Agent runtime modules and repository + classification tooling. Availability describes the delivery form, not production + acceptance. Only generic tooling is reusable; confidential canon and session + memory are excluded.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - standalone agent-runtime package under runtime/ with its own tests + - repo-classification batch/review/validate/push scripts used across the workstation + roster + - a patch-forgejo-remote-urls.sh script directly relevant to REUSE-WP-0019 + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - repo root is confidential/proprietary (NDA); this entry's scope is deliberately + narrow and must not be widened to canon/memory contents without explicit review +discovery: + intent: Agent runtime modules and repository classification tooling + includes: + - Agent runtime modules and repository classification tooling + excludes: + - Only generic tooling is reusable; confidential canon and session memory are excluded + assumptions: [] + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' + research_memos: [] +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - runtime/README.md + target_artifacts: [] + consumption_modes: + - CLI + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - runtime/README.md + tests: + - runtime/tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Agent executes an attributable bounded task and supplies supervision evidence + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Only generic tooling is reusable; confidential canon and session memory are excluded + known_limitations: + - Only generic tooling is reusable; confidential canon and session memory are excluded + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A1 + to: A2 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# Generic agent runtime and repository tooling + +Agent runtime modules and repository classification tooling. + +## Reuse boundary + +Only generic tooling is reusable; confidential canon and session memory are excluded. + +## Supported use cases + +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U11: Agent executes an attributable bounded task and supplies supervision evidence +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [runtime/README.md](../../runtime/README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..bb5b80eb --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/the-custodian/registry/indexes/capabilities.yaml @@ -0,0 +1,22 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.agents.custodian-runtime-tooling + name: Generic agent runtime and repository tooling + summary: Agent runtime modules and repository classification tooling. + domain: custodian + status: draft + owner: the-custodian + tags: + - agents + - runtime + - classification + - security + - netkingdom + - framework-reuse + vector: D2 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.custodian-runtime-tooling.md + consumption_modes: + - CLI + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/capabilities/capability.identity.user-engine.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/capabilities/capability.identity.user-engine.md new file mode 100644 index 00000000..0306dabd --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/capabilities/capability.identity.user-engine.md @@ -0,0 +1,134 @@ +--- +id: capability.identity.user-engine +name: User lifecycle and account journeys +summary: Accounts, identity links, membership, MFA and recovery portal, advisory catalog. +owner: user-engine +status: draft +domain: communication +tags: +- identity +- user-management +- multi-tenant +- security +- netkingdom +- framework-reuse +maturity: + discovery: + current: D4 + target: D5 + confidence: high + rationale: 'Unusually large documentation set for its size: docs/development.md, + configuration.md, contracts.md, canon-mapping.md, canon-interface-card.yaml, + family-dataspace-onboarding.md, registration-identity-and-factor-model.md, prepared-accounts-and-entitlement-claims.md, + hats-realms-services-assets-access-profiles.md, onboarding-journeys-and-welcome-protocols.md, + and more — scope and contracts are thoroughly documented.' + availability: + current: A4 + target: A4 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Accounts, identity links, membership, + MFA and recovery portal, advisory catalog. Availability describes the delivery + form, not production acceptance. Application readback is advisory; applications + must enforce their own authorization.' +external_evidence: + completeness: + level: C2 + confidence: low + basis: scope_vs_intent_and_consumer_expectations + satisfied_expectations: + - registration/identity/factor model documented + - entitlement claims and access-profile model (hats/realms/services/assets) documented + - canon mapping and interface card present + broken_expectations: [] + out_of_scope_expectations: [] + reliability: + level: R0 + confidence: low + basis: consumer_quality_signals + known_reliability_risks: + - breadth of documented scope not independently verified against implementation + completeness in this sweep +discovery: + intent: Accounts, identity links, membership, MFA and recovery portal, advisory + catalog + includes: + - Accounts, identity links, membership, MFA and recovery portal, advisory catalog + excludes: + - Application readback is advisory; applications must enforce their own authorization + assumptions: [] + use_cases: + - 'U02: Human signs in with MFA and manages account or factor recovery' + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + research_memos: [] +availability: + current_level: A4 + target_level: A4 + current_artifacts: + - SCOPE.md + - README.md + target_artifacts: [] + consumption_modes: + - HTTP API + - source +relations: + depends_on: [] + supports: [] + related_to: + - capability.iam.key-cape + - capability.identity.tenant-facts + - capability.authorization.policy-evaluate + - capability.audit.event-retain +evidence: + documentation: + - SCOPE.md + - README.md + tests: + - tests/ + consumer_feedback: [] + bug_reports: [] + incidents: [] +consumer_guidance: + recommended_for: + - Human signs in with MFA and manages account or factor recovery + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Operator recovers identity, custody or data with independently held recovery material + not_recommended_for: + - Application readback is advisory; applications must enforce their own authorization + known_limitations: + - Application readback is advisory; applications must enforce their own authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A1 + to: A4 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex +--- + +# User lifecycle and account journeys + +Accounts, identity links, membership, MFA and recovery portal, advisory catalog. + +## Reuse boundary + +Application readback is advisory; applications must enforce their own authorization. + +## Supported use cases + +- U02: Human signs in with MFA and manages account or factor recovery +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U10: Operator recovers identity, custody or data with independently held recovery material + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..6e000fd6 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/user-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,23 @@ +version: 1 +updated: '2026-10-14' +domain: helix_forge +capabilities: +- id: capability.identity.user-engine + name: User lifecycle and account journeys + summary: Accounts, identity links, membership, MFA and recovery portal, advisory + catalog. + domain: communication + status: draft + owner: user-engine + tags: + - identity + - user-management + - multi-tenant + - security + - netkingdom + - framework-reuse + vector: D4 / A4 / C2 / R0 + path: registry/capabilities/capability.identity.user-engine.md + consumption_modes: + - HTTP API + - source diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/capabilities/capability.security.adversarial-evidence.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/capabilities/capability.security.adversarial-evidence.md new file mode 100644 index 00000000..bfc83cd4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/capabilities/capability.security.adversarial-evidence.md @@ -0,0 +1,104 @@ +--- +id: capability.security.adversarial-evidence +owner: whitehat-security +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Offline ASM and tenancy calibrations + and engagement admission. Availability describes the delivery form, not production + acceptance. Live probes require a complete engagement; no blanket target authorization.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Authorized adversarial evidence harness +summary: Offline ASM and tenancy calibrations and engagement admission. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Offline ASM and tenancy calibrations and engagement admission + includes: + - Offline ASM and tenancy calibrations and engagement admission + excludes: + - Live probes require a complete engagement; no blanket target authorization + use_cases: + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U08: Consumer emits security events and reconciles independently retained evidence' + - 'U10: Operator recovers identity, custody or data with independently held recovery + material' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.doctrine-review + - capability.audit.event-retain + - capability.security.approval-lifecycle +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Consumer emits security events and reconciles independently retained evidence + - Operator recovers identity, custody or data with independently held recovery material + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - Live probes require a complete engagement; no blanket target authorization + known_limitations: + - Live probes require a complete engagement; no blanket target authorization + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Authorized adversarial evidence harness + +Offline ASM and tenancy calibrations and engagement admission. + +## Reuse boundary + +Live probes require a complete engagement; no blanket target authorization. + +## Supported use cases + +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U08: Consumer emits security events and reconciles independently retained evidence +- U10: Operator recovers identity, custody or data with independently held recovery material +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..237eddde --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/whitehat-security/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.adversarial-evidence + name: Authorized adversarial evidence harness + summary: Offline ASM and tenancy calibrations and engagement admission. + domain: infotech + status: draft + owner: whitehat-security + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.adversarial-evidence.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/capabilities/capability.security.zone-reference.md b/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/capabilities/capability.security.zone-reference.md new file mode 100644 index 00000000..efb43f2e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/capabilities/capability.security.zone-reference.md @@ -0,0 +1,100 @@ +--- +id: capability.security.zone-reference +owner: zone-engine +status: draft +domain: infotech +maturity: + discovery: + current: D3 + target: D5 + confidence: medium + rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations + are documented; no exhaustive or generalized maturity claim. + availability: + current: A2 + target: A2 + confidence: medium + rationale: 'Source interface assessed 2026-10-14: Offline resolution, exception + and lineage checks. Availability describes the delivery form, not production + acceptance. No live zone engine, PDP or protected side effects.' +external_evidence: + completeness: + level: C1 + confidence: low + basis: Source artifacts establish a bounded capability; no independent consumer-completeness + assessment in this review. + reliability: + level: R0 + confidence: low + basis: No longitudinal consumer reliability measurement established by this review. +name: Zone membership reference conformance +summary: Offline resolution, exception and lineage checks. +tags: +- security +- netkingdom +- framework-reuse +discovery: + intent: Offline resolution, exception and lineage checks + includes: + - Offline resolution, exception and lineage checks + excludes: + - No live zone engine, PDP or protected side effects + use_cases: + - 'U01: Architect composes a security deployment from explicit owner contracts and + case types' + - 'U03: Application combines identity, tenant and resource facts and enforces a + bound decision' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' +availability: + current_level: A2 + target_level: A2 + current_artifacts: + - SCOPE.md + - README.md + consumption_modes: + - CLI + - source +relations: + related_to: + - capability.security.iam-tooling-suite +evidence: + documentation: + - SCOPE.md + - README.md +consumer_guidance: + recommended_for: + - Architect composes a security deployment from explicit owner contracts and case + types + - Application combines identity, tenant and resource facts and enforces a bound + decision + - Framework adopter validates and reuses selected contracts, tools and reference + compositions + not_recommended_for: + - No live zone engine, PDP or protected side effects + known_limitations: + - No live zone engine, PDP or protected side effects + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +--- + +# Zone membership reference conformance + +Offline resolution, exception and lineage checks. + +## Reuse boundary + +No live zone engine, PDP or protected side effects. + +## Supported use cases + +- U01: Architect composes a security deployment from explicit owner contracts and case types +- U03: Application combines identity, tenant and resource facts and enforces a bound decision +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions + +## Evidence and integration + +- [SCOPE.md](../../SCOPE.md) +- [README.md](../../README.md) + +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml new file mode 100644 index 00000000..df20b8e4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/registry-stage/zone-engine/registry/indexes/capabilities.yaml @@ -0,0 +1,19 @@ +version: 1 +domain: infotech +capabilities: +- id: capability.security.zone-reference + name: Zone membership reference conformance + summary: Offline resolution, exception and lineage checks. + domain: infotech + status: draft + owner: zone-engine + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.security.zone-reference.md + consumption_modes: + - CLI + - source +updated: '2026-10-14' diff --git a/docs/assessments/netkingdom-2026-10-14/review-integrity.json b/docs/assessments/netkingdom-2026-10-14/review-integrity.json new file mode 100644 index 00000000..848a68fc --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/review-integrity.json @@ -0,0 +1,10 @@ +{ + "source_hash_drift": [], + "broken_report_links": [], + "scope_repos": 60, + "reviewed_capabilities": 70, + "inspected_nonproviders": [ + "rapp-secrets-engine", + "rapp-forgejo" + ] +} diff --git a/docs/assessments/netkingdom-2026-10-14/source-test-receipt.json b/docs/assessments/netkingdom-2026-10-14/source-test-receipt.json new file mode 100644 index 00000000..e24e7e7b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/source-test-receipt.json @@ -0,0 +1,30 @@ +{ + "as_of": "2026-10-14", + "netkingdom_scenario_and_posture_tests": { + "passed": 23, + "command": "PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q -p no:cacheprovider tools/security-scenario-composer/tests tools/posture-feedback/tests" + }, + "rapp_user_engine_make_check": { + "passed": 11 + }, + "rapp_policy_nexus_make_check": { + "passed": 9, + "helm_lint": "pass" + }, + "preparation_failures": [ + "NetKingdom .venv interpreter absent; system pytest succeeded.", + "Custodian has no make check target; actual owner make check targets succeeded." + ], + "scope": "Local source and package checks; no live target operation.", + "rapp_telemetry_make_check": { + "result": "pass", + "rendered_resources": 93, + "pinned_chart_cache": "hash verified by package check", + "deployed": false + }, + "rapp_telemetry_family_check": { + "result": "failed", + "reason": "rapp-forgejo has no declarations/rapp.yaml", + "classification": "pre-existing estate declaration gap; registry metadata changes do not address it" + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/apply_registry.py b/docs/assessments/netkingdom-2026-10-14/supplement/apply_registry.py new file mode 100644 index 00000000..d8ad3e01 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/apply_registry.py @@ -0,0 +1,20 @@ +"""Apply only the hash-pinned, reviewed metadata patch; never stage or commit.""" +from pathlib import Path +import hashlib,json +OUT=Path(__file__).resolve().parent;BASE=Path('/home/worsch') +changes=json.loads((OUT/'registry-changes.json').read_text()) +# Check the entire patch before the first write. Do not overwrite concurrent edits. +for c in changes: + p=BASE/c['repo']/c['path'];actual=hashlib.sha256(p.read_bytes()).hexdigest() if p.exists() else None + if actual!=c['before_sha256']:raise SystemExit('Concurrent change: '+str(p)) + if c['operation']=='write': + stage=OUT/'registry-stage'/c['repo']/c['path'] + if hashlib.sha256(stage.read_bytes()).hexdigest()!=c['after_sha256']:raise SystemExit('Staged digest differs: '+str(stage)) +for c in changes: + p=BASE/c['repo']/c['path'] + if p.exists(): + backup=OUT/'registry-before'/c['repo']/c['path'];backup.parent.mkdir(parents=True,exist_ok=True);backup.write_bytes(p.read_bytes()) + if c['operation']=='delete':p.unlink() + else:p.parent.mkdir(parents=True,exist_ok=True);p.write_bytes((OUT/'registry-stage'/c['repo']/c['path']).read_bytes()) +(OUT/'registry-application.json').write_text(json.dumps({'applied':len(changes),'repositories':len({c['repo'] for c in changes}),'verified_sha256':True,'git_staging_or_commits':False},indent=2)+'\n') +print('Applied',len(changes),'reviewed metadata edits') diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/build_inventory.py b/docs/assessments/netkingdom-2026-10-14/supplement/build_inventory.py new file mode 100644 index 00000000..1a2214ef --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/build_inventory.py @@ -0,0 +1,32 @@ +"""Build the review's explicit capability denominator and staged registry patch.""" +from pathlib import Path +import hashlib, json, subprocess, yaml +BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent +# repo | id suffix | capability | availability | operational estimate (1..5) | surface | limitation | use cases | artifacts +DATA=''' +rail-knative|railiance.knative-rail|Knative workload lifecycle|A2|3|Derived rail for activation, revisions, traffic, scaling and rollback|Inherits Kubernetes common contract; verified readiness is not production approval|U09 U13 U14|SCOPE.md;README.md;declarations/rail.yaml +rapp-sbom-nexus|railiance.sbom-runtime-package|Private SBOM runtime and dynamic database delivery|A2|3|Immutable deployment, private network policy, dynamic database leases and migration/rollback|Product owns schema and ingestion; database and backup authority remain with platform owners|U07 U12 U13|SCOPE.md;README.md +''' +rows=[] +for line in DATA.strip().splitlines(): + repo,suffix,name,a,op,surface,limit,ucs,arts=line.split('|') + rows.append(dict(repo=repo,id='capability.'+suffix,name=name,availability=a,operational_estimate=int(op),surface=surface,limitation=limit,use_cases=ucs.split(),artifacts=arts.split(';'))) +# Source and current registry evidence, content hashes only (never credentials). +repos={} +for repo in sorted({r['repo'] for r in rows}): + root=BASE/repo + def git(*args): + p=subprocess.run(['git','-C',str(root),*args],capture_output=True,text=True);return p.stdout.strip() + ix=root/'registry/indexes/capabilities.yaml' + index=yaml.safe_load(ix.read_text()) if ix.exists() else {} + sources=sorted(set(['INTENT.md','SCOPE.md','README.md']+[a for r in rows if r['repo']==repo for a in r['artifacts']])) + hashes={p:'sha256:'+hashlib.sha256((root/p).read_bytes()).hexdigest() for p in sources if (root/p).is_file()} + missing=[p for r in rows if r['repo']==repo for p in r['artifacts'] if not (root/p).is_file()] + repos[repo]={'head':git('rev-parse','HEAD'),'branch':git('branch','--show-current'),'dirty_paths':git('status','--short').splitlines(),'source_sha256':hashes,'missing_review_artifacts':missing,'existing_index':index} + for r in [x for x in rows if x['repo']==repo]: + old=next((c for c in (index or {}).get('capabilities',[]) if c.get('id')==r['id']),None) + r['existing_entry_path']=old.get('path') if old else None + r['prior_vector']=old.get('vector') if old else None + r['vector']='D3 / '+r['availability']+' / C1 / R0' +(OUT/'inventory.json').write_text(json.dumps({'as_of':'2026-10-14','capabilities':rows,'repositories':repos},indent=2)+'\n') +print(json.dumps({'repos':len(repos),'capabilities':len(rows),'existing':sum(bool(r['existing_entry_path']) for r in rows),'missing_artifacts':{k:v['missing_review_artifacts'] for k,v in repos.items() if v['missing_review_artifacts']}},indent=2)) diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/federated-staged.yaml b/docs/assessments/netkingdom-2026-10-14/supplement/federated-staged.yaml new file mode 100644 index 00000000..1b88c24c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/federated-staged.yaml @@ -0,0 +1,47 @@ +version: 1 +updated: '2026-10-14' +domain: infotech +collision_policy: warn +sources: +- repo: rail-knative + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml +- repo: rapp-sbom-nexus + count: 1 + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml +capabilities: +- id: capability.railiance.knative-rail + name: Knative workload lifecycle + summary: Derived rail for activation, revisions, traffic, scaling and rollback. + domain: infotech + status: draft + owner: rail-knative + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.knative-rail.md + consumption_modes: + - CLI + - source + source_repo: rail-knative + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml +- id: capability.railiance.sbom-runtime-package + name: Private SBOM runtime and dynamic database delivery + summary: Immutable deployment, private network policy, dynamic database leases and + migration/rollback. + domain: infotech + status: draft + owner: rapp-sbom-nexus + tags: + - security + - netkingdom + - framework-reuse + vector: D3 / A2 / C1 / R0 + path: registry/capabilities/capability.railiance.sbom-runtime-package.md + consumption_modes: + - CLI + - source + source_repo: rapp-sbom-nexus + source_index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/federation-staged.yaml b/docs/assessments/netkingdom-2026-10-14/supplement/federation-staged.yaml new file mode 100644 index 00000000..bc38c15d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/federation-staged.yaml @@ -0,0 +1,12 @@ +version: 1 +domain: infotech +collision_policy: warn +sources: +- repo: rail-knative + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml + enabled: true + required: true +- repo: rapp-sbom-nexus + index: /home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml + enabled: true + required: true diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-federated.json b/docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-federated.json new file mode 100644 index 00000000..659dac17 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-federated.json @@ -0,0 +1,1929 @@ +{ + "version": 1, + "updated": "2026-10-14", + "domain": "helix_forge", + "collision_policy": "warn", + "sources": [ + { + "repo": "access-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/access-engine.yaml" + }, + { + "repo": "activity-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/activity-core.yaml" + }, + { + "repo": "agentic-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/agentic-resources.yaml" + }, + { + "repo": "artifact-store", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/artifact-store.yaml" + }, + { + "repo": "audit-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/audit-core.yaml" + }, + { + "repo": "can-you-assist", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/can-you-assist.yaml" + }, + { + "repo": "citation-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-engine.yaml" + }, + { + "repo": "citation-evidence", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-evidence.yaml" + }, + { + "repo": "citation-work", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-work.yaml" + }, + { + "repo": "commerce-canon", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/commerce-canon.yaml" + }, + { + "repo": "config-atlas", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/config-atlas.yaml" + }, + { + "repo": "coordination-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/coordination-engine.yaml" + }, + { + "repo": "core-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/core-hub.yaml" + }, + { + "repo": "domain-tree", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/domain-tree.yaml" + }, + { + "repo": "email-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/email-connect.yaml" + }, + { + "repo": "evidence-anchor", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-anchor.yaml" + }, + { + "repo": "evidence-binder", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-binder.yaml" + }, + { + "repo": "evidence-source", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-source.yaml" + }, + { + "repo": "feature-control", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/feature-control.yaml" + }, + { + "repo": "guide-board", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/guide-board.yaml" + }, + { + "repo": "helix-forge", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/helix-forge.yaml" + }, + { + "repo": "hub-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/hub-core.yaml" + }, + { + "repo": "human-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/human-resources.yaml" + }, + { + "repo": "ihp-railiance-probe", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ihp-railiance-probe.yaml" + }, + { + "repo": "info-tech-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/info-tech-canon.yaml" + }, + { + "repo": "infospace-bench", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/infospace-bench.yaml" + }, + { + "repo": "issue-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/issue-core.yaml" + }, + { + "repo": "kaizen-agentic", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kaizen-agentic.yaml" + }, + { + "repo": "key-cape", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/key-cape.yaml" + }, + { + "repo": "kontextual-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kontextual-engine.yaml" + }, + { + "repo": "llm-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/llm-connect.yaml" + }, + { + "repo": "markitect-filter", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-filter.yaml" + }, + { + "repo": "markitect-main", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-main.yaml" + }, + { + "repo": "markitect-quarkdown", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-quarkdown.yaml" + }, + { + "repo": "markitect-tool", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-tool.yaml" + }, + { + "repo": "net-kingdom", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/net-kingdom.yaml" + }, + { + "repo": "open-cmis-tck", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-cmis-tck.yaml" + }, + { + "repo": "open-reuse", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-reuse.yaml" + }, + { + "repo": "ops-bridge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-bridge.yaml" + }, + { + "repo": "ops-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-hub.yaml" + }, + { + "repo": "ops-warden", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-warden.yaml" + }, + { + "repo": "phase-memory", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/phase-memory.yaml" + }, + { + "repo": "railiance-apps", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-apps.yaml" + }, + { + "repo": "railiance-cluster", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-cluster.yaml" + }, + { + "repo": "railiance-enablement", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-enablement.yaml" + }, + { + "repo": "railiance-fabric", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-fabric.yaml" + }, + { + "repo": "railiance-forge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-forge.yaml" + }, + { + "repo": "railiance-infra", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-infra.yaml" + }, + { + "repo": "railiance-platform", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-platform.yaml" + }, + { + "repo": "repo-scoping", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-scoping.yaml" + }, + { + "repo": "repo-seed", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-seed.yaml" + }, + { + "repo": "reuse-surface", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reuse-surface.yaml" + }, + { + "repo": "shard-wiki", + "count": 8, + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/shard-wiki.yaml" + }, + { + "repo": "state-hub", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/state-hub.yaml" + }, + { + "repo": "tegwick-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tegwick-control.yaml" + }, + { + "repo": "the-custodian", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/the-custodian.yaml" + }, + { + "repo": "user-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/user-engine.yaml" + }, + { + "repo": "vantage-point", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vantage-point.yaml" + }, + { + "repo": "vergabe-teilnahme", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "repo": "whynot-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-control.yaml" + }, + { + "repo": "whynot-design", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-design.yaml" + } + ], + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Durable automation and bounded operations", + "summary": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "tags": [ + "activity", + "coordination", + "automation", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "activity-core", + "source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/activity-core.yaml" + }, + { + "id": "capability.agents.cli-assistant", + "name": "Console-Native LLM Assistant (cya)", + "summary": "Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "can-you-assist", + "path": "registry/capabilities/capability.agents.cli-assistant.md", + "tags": [ + "cli", + "assistant", + "llm", + "safety" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "can-you-assist", + "source_url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/can-you-assist.yaml" + }, + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Custodian Runtime And Repo-Classification Tooling", + "summary": "Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos.", + "vector": "D2 / A1 / C1 / R0", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "tags": [ + "agents", + "runtime", + "classification" + ], + "consumption_modes": [ + "library import (runtime/)", + "cli (tools/ scripts)" + ], + "source_repo": "the-custodian", + "source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/the-custodian.yaml" + }, + { + "id": "capability.agents.kaizen-framework", + "name": "Kaizen Agentic Framework", + "summary": "AI agency framework providing 20 deployable agent instruction sets, project memory, metrics, role and engagement contracts, and scheduled preparation for governed execution.", + "vector": "D3 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "kaizen-agentic", + "path": "registry/capabilities/capability.agents.kaizen-framework.md", + "tags": [ + "agents", + "memory", + "coordination", + "metrics", + "scheduling", + "engagements" + ], + "consumption_modes": [ + "cli", + "library import", + "file contracts" + ], + "source_repo": "kaizen-agentic", + "source_url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kaizen-agentic.yaml" + }, + { + "id": "capability.agents.llm-connector", + "name": "Pluggable LLM Adapter Library (llm-connect)", + "summary": "Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers.", + "vector": "D3 / A2 / C2 / R1", + "domain": "agents", + "status": "draft", + "owner": "llm-connect", + "path": "registry/capabilities/capability.agents.llm-connector.md", + "tags": [ + "llm", + "adapter", + "provider-neutral" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "llm-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/llm-connect.yaml" + }, + { + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "summary": "Capture sessions, curate patterns, distribute lessons and measure outcomes.", + "domain": "infotech", + "status": "draft", + "owner": "agentic-resources", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.performance-learning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "agentic-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/agentic-resources.yaml" + }, + { + "id": "capability.agents.repo-scoping-service", + "name": "Repository Scoping Service", + "summary": "Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "repo-scoping", + "path": "registry/capabilities/capability.agents.repo-scoping-service.md", + "tags": [ + "classification", + "scoping", + "registry" + ], + "consumption_modes": [ + "http api", + "library import", + "ui" + ], + "source_repo": "repo-scoping", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-scoping.yaml" + }, + { + "id": "capability.audit.event-retain", + "name": "Independent audit custody", + "summary": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.", + "domain": "infotech", + "status": "draft", + "owner": "audit-core", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C3 / R2", + "path": "registry/capabilities/capability.audit.event-retain.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "audit-core", + "source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/audit-core.yaml" + }, + { + "id": "capability.authorization.policy-evaluate", + "name": "Policy evaluation and decision evidence", + "summary": "Check, batch, list-allowed, explain, binding, lifetime and decision records.", + "domain": "helix_forge", + "status": "draft", + "owner": "access-engine", + "tags": [ + "authorization", + "policy", + "flex-auth", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "access-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/access-engine.yaml" + }, + { + "id": "capability.cmis.tck", + "name": "OpenCMIS Conformance-Preparation Extension", + "summary": "CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "open-cmis-tck", + "path": "registry/capabilities/capability.cmis.tck.md", + "tags": [ + "cmis", + "compliance", + "guide-board-extension" + ], + "consumption_modes": [ + "library import (guide-board extension)" + ], + "source_repo": "open-cmis-tck", + "source_url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-cmis-tck.yaml" + }, + { + "id": "capability.communication.compliance-evidence-framework", + "name": "Certification And Compliance Evidence Framework", + "summary": "Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture.", + "vector": "D2 / A2 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "guide-board", + "path": "registry/capabilities/capability.communication.compliance-evidence-framework.md", + "tags": [ + "compliance", + "certification", + "evidence", + "extensions" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "guide-board", + "source_url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/guide-board.yaml" + }, + { + "id": "capability.communication.context-engine", + "name": "Kontextual Engine (Knowledge Operations Runtime)", + "summary": "Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge.", + "vector": "D4 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "kontextual-engine", + "path": "registry/capabilities/capability.communication.context-engine.md", + "tags": [ + "knowledge", + "context", + "runtime" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "kontextual-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kontextual-engine.yaml" + }, + { + "id": "capability.communication.infospace-workspace", + "name": "Infospace Workspace And Evaluation Bench", + "summary": "Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main.", + "vector": "D3 / A1 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "infospace-bench", + "path": "registry/capabilities/capability.communication.infospace-workspace.md", + "tags": [ + "infospace", + "knowledge", + "evaluation" + ], + "consumption_modes": [ + "cli", + "library import (consumed by info-tech-canon)" + ], + "source_repo": "infospace-bench", + "source_url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/infospace-bench.yaml" + }, + { + "id": "capability.communication.markitect-legacy-platform", + "name": "MarkiTect Legacy Platform", + "summary": "Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-main", + "path": "registry/capabilities/capability.communication.markitect-legacy-platform.md", + "tags": [ + "markitect", + "markdown", + "legacy" + ], + "consumption_modes": [ + "application (legacy, not recommended for new integration)" + ], + "source_repo": "markitect-main", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-main.yaml" + }, + { + "id": "capability.communication.markitect-quarkdown-adapter", + "name": "Markitect Quarkdown Render Adapter", + "summary": "Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-quarkdown", + "path": "registry/capabilities/capability.communication.markitect-quarkdown-adapter.md", + "tags": [ + "markitect", + "quarkdown", + "adapter" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-quarkdown", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-quarkdown.yaml" + }, + { + "id": "capability.communication.markitect-source-adapters", + "name": "Markitect Source-Format Adapters", + "summary": "Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-filter", + "path": "registry/capabilities/capability.communication.markitect-source-adapters.md", + "tags": [ + "markitect", + "adapter", + "document-conversion" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-filter", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-filter.yaml" + }, + { + "id": "capability.communication.markitect-toolkit", + "name": "Markitect Markdown Toolkit And CLI", + "summary": "Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main.", + "vector": "D4 / A2 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "markitect-tool", + "path": "registry/capabilities/capability.communication.markitect-toolkit.md", + "tags": [ + "markitect", + "markdown", + "cli", + "toolkit" + ], + "consumption_modes": [ + "cli", + "library import" + ], + "source_repo": "markitect-tool", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-tool.yaml" + }, + { + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "summary": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime.", + "domain": "infotech", + "status": "draft", + "owner": "coordination-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.coordination.cross-owner-work.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "coordination-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/coordination-engine.yaml" + }, + { + "id": "capability.design.whynot-system", + "name": "Whynot Design System", + "summary": "Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters.", + "vector": "D3 / A2 / C2 / R1", + "domain": "consumer", + "status": "draft", + "owner": "whynot-design", + "path": "registry/capabilities/capability.design.whynot-system.md", + "tags": [ + "design-system", + "web-components", + "frontend" + ], + "consumption_modes": [ + "library import (npm)", + "cli", + "django template adapter" + ], + "source_repo": "whynot-design", + "source_url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whynot-design.yaml" + }, + { + "id": "capability.evidence.binding", + "name": "Evidence-to-Target Binding", + "summary": "Links evidence items to structured targets with relation, status, and confidence metadata, bidirectional queries, active-state coordination, and canonical engine events.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.binding.md", + "tags": [ + "evidence", + "binding", + "evidence-link", + "form-field", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React provider" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.evidence.rect-registry", + "name": "Visual-Guide Rect Registry", + "summary": "Coordinates field, evidence-card, and highlight rectangles from independent renderers so an SVG overlay can draw the active visual guide without polling.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.rect-registry.md", + "tags": [ + "rect-registry", + "visual-guide", + "overlay", + "active-state", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React component" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.feature-control.evaluate", + "name": "Feature Availability Evaluation", + "summary": "Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context.", + "vector": "D5 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.evaluate.md", + "tags": [ + "feature-control", + "evaluation", + "sdk" + ], + "consumption_modes": [ + "SDK", + "service API" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.rollout", + "name": "Feature Rollout Control", + "summary": "Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.rollout.md", + "tags": [ + "feature-control", + "rollout", + "planning" + ], + "consumption_modes": [ + "source module", + "SDK" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.visibility", + "name": "Feature Visibility Control", + "summary": "Control whether features are visible or hidden for subjects without changing entitlement or authorization.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.visibility.md", + "tags": [ + "feature-control", + "visibility" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.graph.nbgm-spec", + "name": "Network-Based Graph Model (NBGM) Specification", + "summary": "Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains.", + "vector": "D2 / A0 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "vantage-point", + "path": "registry/capabilities/capability.graph.nbgm-spec.md", + "tags": [ + "graph", + "nbgm", + "specification" + ], + "consumption_modes": [ + "informational (specification only)" + ], + "source_repo": "vantage-point", + "source_url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vantage-point.yaml" + }, + { + "id": "capability.hr.workflow-catalog", + "name": "HR Workflow Catalog", + "summary": "Markdown-first registry of HR planning workflows with an iterative assessment loop tied to INTENT phases.", + "vector": "D3 / A1 / C1 / R0", + "domain": "consumer", + "status": "draft", + "owner": "human-resources", + "path": "registry/capabilities/capability.hr.workflow-catalog.md", + "tags": [ + "hr", + "workflows", + "assessment", + "planning" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "human-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/human-resources.yaml" + }, + { + "id": "capability.iam.key-cape", + "name": "OIDC identity and assurance", + "summary": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.iam.key-cape.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "key-cape", + "source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/key-cape.yaml" + }, + { + "id": "capability.identity.subject-resolution", + "name": "Identity Subject Resolution", + "summary": "Resolve who or what is acting by mapping principals, accounts, actors, and identifiers to a stable subject model.", + "vector": "D3 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.subject-resolution.md", + "tags": [ + "identity", + "subject", + "architecture" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.identity.user-engine", + "name": "Headless Multi-Tenant User Engine", + "summary": "Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.", + "vector": "D4 / A1 / C2 / R0", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "path": "registry/capabilities/capability.identity.user-engine.md", + "tags": [ + "identity", + "user-management", + "multi-tenant" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "user-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/user-engine.yaml" + }, + { + "id": "capability.identity.vocabulary-canonicalize", + "name": "Identity Vocabulary Canonicalization", + "summary": "Define an implementation-neutral vocabulary for identity-related concepts across overlapping domains.", + "vector": "D4 / A0 / C2 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.vocabulary-canonicalize.md", + "tags": [ + "identity", + "terminology", + "research" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.infotech.artifact-store", + "name": "Artifact Registry And Storage Gateway", + "summary": "Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "artifact-store", + "path": "registry/capabilities/capability.infotech.artifact-store.md", + "tags": [ + "artifact", + "storage", + "provenance", + "registry" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "artifact-store", + "source_url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/artifact-store.yaml" + }, + { + "id": "capability.infotech.canon-service", + "name": "Shared semantic contracts and validation", + "summary": "Markdown canon with library, CLI and read-only API.", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "tags": [ + "canon", + "infospace", + "service", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "info-tech-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/info-tech-canon.yaml" + }, + { + "id": "capability.infotech.citation-engine", + "name": "Citation Evidence Domain Engine", + "summary": "Core domain model and engine services for the citation-evidence ecosystem \u2014 shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-engine", + "path": "registry/capabilities/capability.infotech.citation-engine.md", + "tags": [ + "citation", + "evidence", + "domain-model" + ], + "consumption_modes": [ + "library import (workspace link)" + ], + "source_repo": "citation-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-engine.yaml" + }, + { + "id": "capability.infotech.citation-evidence-workspace", + "name": "Citation Evidence Workspace", + "summary": "Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations \u2014 the umbrella application over the citation-evidence six-package design.", + "vector": "D4 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-evidence", + "path": "registry/capabilities/capability.infotech.citation-evidence-workspace.md", + "tags": [ + "citation", + "evidence", + "workspace" + ], + "consumption_modes": [ + "application (local dev server)" + ], + "source_repo": "citation-evidence", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-evidence.yaml" + }, + { + "id": "capability.infotech.config-surface-atlas", + "name": "Configuration Surface Atlas", + "summary": "Read-first, cross-kind map and evidence layer for configuration surfaces \u2014 what configures a system, who owns it, its scope, and where the source of truth lives.", + "vector": "D5 / A0 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "config-atlas", + "path": "registry/capabilities/capability.infotech.config-surface-atlas.md", + "tags": [ + "configuration", + "registry", + "control-plane", + "effective-config", + "evidence" + ], + "consumption_modes": [ + "informational", + "source module" + ], + "source_repo": "config-atlas", + "source_url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/config-atlas.yaml" + }, + { + "id": "capability.infotech.core-hub", + "name": "Core Hub Production Interaction Framework", + "summary": "Contract-first framework for cross-domain state, agent coordination, evidence, registries, workplans, and operator interaction surfaces.", + "vector": "D3 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "core-hub", + "path": "registry/capabilities/capability.infotech.core-hub.md", + "tags": [ + "interaction-framework", + "state-hub", + "inter-hub-successor", + "agent-coordination", + "registry", + "api" + ], + "consumption_modes": [ + "informational", + "planning", + "cli" + ], + "source_repo": "core-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/core-hub.yaml" + }, + { + "id": "capability.infotech.email-connector", + "name": "Mailbox Evidence Scanner (email-connect)", + "summary": "Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "email-connect", + "path": "registry/capabilities/capability.infotech.email-connector.md", + "tags": [ + "email", + "evidence", + "coordination" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "email-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/email-connect.yaml" + }, + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.infotech.hub-core-library", + "name": "Reusable FOS Hub Core Primitives", + "summary": "Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "hub-core", + "path": "registry/capabilities/capability.infotech.hub-core-library.md", + "tags": [ + "hub", + "fastapi", + "sqlalchemy", + "mcp" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "hub-core", + "source_url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/hub-core.yaml" + }, + { + "id": "capability.infotech.issue-tracking", + "name": "External issue tracker connector", + "summary": "CLI and Python adapters for external issue systems.", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "tags": [ + "issue-tracking", + "connector", + "work-record", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "issue-core", + "source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/issue-core.yaml" + }, + { + "id": "capability.infotech.oss-integration-continuity", + "name": "Managed Continuity For OSS Integrations", + "summary": "Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "open-reuse", + "path": "registry/capabilities/capability.infotech.oss-integration-continuity.md", + "tags": [ + "oss", + "integration", + "maintenance" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "open-reuse", + "source_url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-reuse.yaml" + }, + { + "id": "capability.infotech.pdf-evidence-ingest", + "name": "Headless PDF Evidence Ingest", + "summary": "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "evidence-source", + "path": "registry/capabilities/capability.infotech.pdf-evidence-ingest.md", + "tags": [ + "pdf", + "ingest", + "fingerprint", + "canonical-text", + "evidence" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "evidence-source", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-source.yaml" + }, + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ], + "source_repo": "repo-seed", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-seed.yaml" + }, + { + "id": "capability.memory.phase-planning", + "name": "Profile-Driven Memory Phase Planning (phase-memory)", + "summary": "Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "phase-memory", + "path": "registry/capabilities/capability.memory.phase-planning.md", + "tags": [ + "memory", + "agentic", + "planning" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "phase-memory", + "source_url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/phase-memory.yaml" + }, + { + "id": "capability.operations.ops-hub", + "name": "Operations Hub Extension Contract", + "summary": "Versioned hub-extension package and bootstrap client for operational truth, service-catalog records, readiness evidence, and migration gates.", + "vector": "D3 / A1 / C1 / R1", + "domain": "operations", + "status": "reviewed", + "owner": "ops-hub", + "path": "registry/capabilities/capability.operations.ops-hub.md", + "tags": [ + "operations", + "service-catalog", + "readiness", + "hub-extension" + ], + "consumption_modes": [ + "contract package", + "command-line bootstrap" + ], + "source_repo": "ops-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-hub.yaml" + }, + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH Reverse Tunnel Lifecycle Manager (ops-bridge)", + "summary": "CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.", + "vector": "D3 / A2 / C2 / R1", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "ops-bridge", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-bridge.yaml" + }, + { + "id": "capability.procurement.vergabe-teilnahme", + "name": "Vergabe Teilnahme (Public Procurement Participation) Application", + "summary": "Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation \u2014 Ausschreibungs- und Teilnahme-Management-System.", + "vector": "D3 / A1 / C1 / R1", + "domain": "communication", + "status": "draft", + "owner": "vergabe-teilnahme", + "path": "registry/capabilities/capability.procurement.vergabe-teilnahme.md", + "tags": [ + "procurement", + "django", + "vergabe" + ], + "consumption_modes": [ + "application (Django + Vite, local dev via docker-compose)" + ], + "source_repo": "vergabe-teilnahme", + "source_url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "id": "capability.railiance.ci-enablement", + "name": "Railiance Developer Enablement And CI/CD Templates", + "summary": "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime.", + "vector": "D3 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo" + ], + "consumption_modes": [ + "ci workflow template (copy/reference)", + "cli (promote-repo-to-forgejo.sh)" + ], + "source_repo": "railiance-enablement", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-enablement.yaml" + }, + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Railiance Cluster Runtime Bootstrap", + "summary": "Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap" + ], + "consumption_modes": [ + "cli", + "ansible playbook" + ], + "source_repo": "railiance-cluster", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-cluster.yaml" + }, + { + "id": "capability.railiance.fabric-graph", + "name": "Railiance Fabric Ecosystem Graph", + "summary": "Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery" + ], + "consumption_modes": [ + "library import", + "cli (validation)" + ], + "source_repo": "railiance-fabric", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-fabric.yaml" + }, + { + "id": "capability.railiance.forge-infrastructure", + "name": "Railiance Forge And Artifact Infrastructure", + "summary": "Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate.", + "vector": "D3 / A1 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner" + ], + "consumption_modes": [ + "cli (operator tooling)", + "documentation/runbooks" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.railiance.infra-provisioning", + "name": "RailianceHosts Infrastructure Provisioning", + "summary": "Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth.", + "vector": "D4 / A2 / C2 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure" + ], + "consumption_modes": [ + "cli (terraform/ansible)", + "gitops" + ], + "source_repo": "railiance-infra", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-infra.yaml" + }, + { + "id": "capability.railiance.platform-services", + "name": "Railiance Platform Services", + "summary": "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.", + "vector": "D3 / A2 / C1 / R0", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres" + ], + "consumption_modes": [ + "cli (shell/python scripts)" + ], + "source_repo": "railiance-platform", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-platform.yaml" + }, + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Railiance Application Workload Deployment Tooling", + "summary": "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack \u2014 application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.", + "vector": "D3 / A2 / C1 / R1", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment" + ], + "consumption_modes": [ + "cli (shell scripts)", + "helm/kubernetes deployment" + ], + "source_repo": "railiance-apps", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-apps.yaml" + }, + { + "id": "capability.registry.register", + "name": "Capability Registration", + "summary": "Register a new capability so it becomes visible for planning and implementation reuse.", + "vector": "D3 / A4 / C2 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.register.md", + "tags": [ + "registry", + "governance", + "meta" + ], + "consumption_modes": [ + "informational", + "markdown authoring", + "cli", + "service API" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.registry.validate", + "name": "Registry Entry Validation", + "summary": "Validate capability registry entries against schema, index consistency, and relation integrity.", + "vector": "D4 / A3 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.registry.validate.md", + "tags": [ + "registry", + "validation", + "cli" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom Security/IAM Tooling Suite", + "summary": "Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.", + "vector": "D3 / A2 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance" + ], + "consumption_modes": [ + "cli", + "local web ui" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.ssh-certificate-issuance", + "name": "SSH Certificate Issuance", + "summary": "Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward NetKingdom operational access routing.", + "vector": "D4 / A3 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security" + ], + "consumption_modes": [ + "CLI", + "cert_command subprocess" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.statehub.progress-log", + "name": "Work Progress Logging", + "summary": "Record progress events, decisions, and session notes against workstreams and tasks in State Hub.", + "vector": "D4 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "tags": [ + "state-hub", + "progress", + "coordination" + ], + "consumption_modes": [ + "service API" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Workstream And Task Coordination", + "summary": "Track active workstreams, tasks, progress, and consistency across domain repositories.", + "vector": "D4 / A4 / C3 / R2", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "tags": [ + "state-hub", + "coordination", + "workplans" + ], + "consumption_modes": [ + "service API", + "HTTP REST" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.wiki.adapter-contract", + "name": "Capability-Aware Shard Adapter Contract", + "summary": "A versioned backend interface where each binding declares a verified capability profile, so federation ops degrade by capability.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.adapter-contract.md", + "tags": [ + "wiki", + "adapter", + "capability", + "contract", + "conformance", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.coordination-journal", + "name": "Event-Sourced Coordination Journal", + "summary": "An append-only, totally-ordered-per-space decision log whose current state is a derived fold; git-addressable history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.coordination-journal.md", + "tags": [ + "wiki", + "event-sourcing", + "coordination", + "git", + "journal", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.derived-views", + "name": "Wiki Derived Views", + "summary": "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges, AllPages, SiteMap, and (delegate-or-derive) Search \u2014 carrying provenance.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.derived-views.md", + "tags": [ + "wiki", + "derived-views", + "backlinks", + "recentchanges", + "search", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.engine-typed-extensions", + "name": "Wiki Engine with Typed Extensions", + "summary": "A small-core wiki engine realizing a typed-extension framework that addresses all wiki use cases and lets each shard activate only the features it needs.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.engine-typed-extensions.md", + "tags": [ + "wiki", + "engine", + "typed-extensions", + "feature-activation", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.federation-models", + "name": "Selectable Federation-Model Taxonomy", + "summary": "Federation as a plural, composable coordination axis (fork+journal, VCS-replication, query-join, feed, activity-streams, engine-mirror) selected per space.", + "vector": "D4 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.federation-models.md", + "tags": [ + "wiki", + "federation", + "taxonomy", + "composable", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.overlay", + "name": "Overlay-Before-Mutation Write Path", + "summary": "Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only or limited backends be edited safely without silent remote mutation.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.overlay.md", + "tags": [ + "wiki", + "overlay", + "patch", + "write-path", + "conflict", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.page-model", + "name": "Backend-Neutral Wiki Page Model", + "summary": "A Markdown-first but stretchable page model with stable identity separate from placement and layered provenance.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.page-model.md", + "tags": [ + "wiki", + "page-model", + "identity", + "provenance", + "markdown", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.shard-orchestration", + "name": "Wiki Shard Orchestration", + "summary": "Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.shard-orchestration.md", + "tags": [ + "wiki", + "federation", + "orchestration", + "union", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + } + ], + "composed_at": "2026-10-14T04:40:09+00:00", + "stale": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-repos.json b/docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-repos.json new file mode 100644 index 00000000..a4d97f31 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/hosted-before-repos.json @@ -0,0 +1,714 @@ +{ + "count": 64, + "repos": [ + { + "repo": "access-engine", + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-09-30T18:31:15+00:00", + "updated_at": "2026-09-30T18:31:15+00:00" + }, + { + "repo": "activity-core", + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:46:54+00:00", + "updated_at": "2026-08-21T14:26:03+00:00", + "description": "" + }, + { + "repo": "agentic-resources", + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:10+00:00", + "updated_at": "2026-08-20T21:44:26+00:00" + }, + { + "repo": "artifact-store", + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:15+00:00", + "updated_at": "2026-08-20T21:44:27+00:00" + }, + { + "repo": "audit-core", + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:46:57+00:00", + "updated_at": "2026-08-20T21:44:27+00:00" + }, + { + "repo": "can-you-assist", + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:20+00:00", + "updated_at": "2026-08-20T21:44:27+00:00" + }, + { + "repo": "citation-engine", + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:25+00:00", + "updated_at": "2026-08-20T21:44:28+00:00" + }, + { + "repo": "citation-evidence", + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:30+00:00", + "updated_at": "2026-08-20T21:44:28+00:00" + }, + { + "repo": "citation-work", + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:33+00:00", + "updated_at": "2026-08-20T21:44:29+00:00" + }, + { + "repo": "commerce-canon", + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "description": "Canonical source after CFED-WP-0001-T03/T09; stable capability.identity identifiers retained.", + "registered_at": "2026-09-05T23:22:01+00:00", + "updated_at": "2026-09-05T23:22:01+00:00" + }, + { + "repo": "config-atlas", + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "infotech", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-07-06T22:41:01+00:00", + "updated_at": "2026-08-20T21:44:29+00:00" + }, + { + "repo": "coordination-engine", + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:37+00:00", + "updated_at": "2026-08-20T21:44:30+00:00" + }, + { + "repo": "core-hub", + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-07-07T10:23:58+00:00", + "updated_at": "2026-07-07T10:23:58+00:00" + }, + { + "repo": "domain-tree", + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:50:41+00:00", + "updated_at": "2026-08-20T21:44:30+00:00" + }, + { + "repo": "email-connect", + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:20+00:00", + "updated_at": "2026-08-20T21:44:30+00:00" + }, + { + "repo": "evidence-anchor", + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:25+00:00", + "updated_at": "2026-08-20T21:44:31+00:00" + }, + { + "repo": "evidence-binder", + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:29+00:00", + "updated_at": "2026-08-21T08:31:50+00:00" + }, + { + "repo": "evidence-source", + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:34+00:00", + "updated_at": "2026-08-20T21:44:32+00:00" + }, + { + "repo": "feature-control", + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:01+00:00", + "updated_at": "2026-08-20T21:44:32+00:00" + }, + { + "repo": "flex-auth", + "url": "https://forgejo.coulomb.social/coulomb/flex-auth/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": false, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:47:00+00:00", + "updated_at": "2026-09-30T18:31:16+00:00", + "description": "Superseded by access-engine (repo rename, FLEX-WP-0020). Kept disabled for audit." + }, + { + "repo": "guide-board", + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:39+00:00", + "updated_at": "2026-08-20T21:44:33+00:00" + }, + { + "repo": "helix-forge", + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:43+00:00", + "updated_at": "2026-08-20T21:44:33+00:00" + }, + { + "repo": "hub-core", + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:04:51+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "human-resources", + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:52:48+00:00", + "updated_at": "2026-08-20T21:44:34+00:00" + }, + { + "repo": "identity-canon", + "url": "https://forgejo.coulomb.social/coulomb/identity-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": false, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:02+00:00", + "updated_at": "2026-09-05T23:22:01+00:00", + "description": "Retired source registration after repository rename; replaced by commerce-canon under CFED-WP-0001-T09. Kept for history." + }, + { + "repo": "ihp-railiance-probe", + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:42+00:00", + "updated_at": "2026-08-20T21:44:34+00:00" + }, + { + "repo": "info-tech-canon", + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:45+00:00", + "updated_at": "2026-08-20T21:44:35+00:00" + }, + { + "repo": "infospace-bench", + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:49+00:00", + "updated_at": "2026-08-20T21:44:35+00:00" + }, + { + "repo": "inter-hub", + "url": "https://gitea.coulomb.social/coulomb/inter-hub/raw/main/registry/indexes/capabilities.yaml", + "enabled": false, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:18+00:00", + "updated_at": "2026-07-07T10:26:41+00:00" + }, + { + "repo": "issue-core", + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:54+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "kaizen-agentic", + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:53:57+00:00", + "updated_at": "2026-08-20T21:44:36+00:00" + }, + { + "repo": "key-cape", + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:00+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "kontextual-engine", + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:04+00:00", + "updated_at": "2026-08-20T21:44:36+00:00" + }, + { + "repo": "llm-connect", + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:07+00:00", + "updated_at": "2026-08-20T21:44:37+00:00" + }, + { + "repo": "markitect-filter", + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:09+00:00", + "updated_at": "2026-08-20T21:44:37+00:00" + }, + { + "repo": "markitect-main", + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:54:13+00:00", + "updated_at": "2026-08-20T21:44:37+00:00" + }, + { + "repo": "markitect-quarkdown", + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:36+00:00", + "updated_at": "2026-08-20T21:44:38+00:00" + }, + { + "repo": "markitect-tool", + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:42+00:00", + "updated_at": "2026-08-20T21:44:38+00:00" + }, + { + "repo": "net-kingdom", + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:46+00:00", + "updated_at": "2026-08-20T21:44:39+00:00" + }, + { + "repo": "open-cmis-tck", + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:51+00:00", + "updated_at": "2026-08-20T21:44:39+00:00" + }, + { + "repo": "open-reuse", + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:56+00:00", + "updated_at": "2026-08-20T21:44:39+00:00" + }, + { + "repo": "ops-bridge", + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:55:59+00:00", + "updated_at": "2026-08-20T21:44:40+00:00" + }, + { + "repo": "ops-hub", + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:04+00:00", + "updated_at": "2026-08-20T21:44:40+00:00" + }, + { + "repo": "ops-warden", + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:09+00:00", + "updated_at": "2026-08-20T21:44:41+00:00" + }, + { + "repo": "phase-memory", + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:13+00:00", + "updated_at": "2026-08-20T21:44:41+00:00" + }, + { + "repo": "railiance-apps", + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:56:16+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-cluster", + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:57:59+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-enablement", + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:03+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-fabric", + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:30+00:00", + "updated_at": "2026-08-20T21:44:42+00:00" + }, + { + "repo": "railiance-forge", + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:06+00:00", + "updated_at": "2026-08-20T21:44:42+00:00" + }, + { + "repo": "railiance-infra", + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:09+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "railiance-platform", + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:46+00:00", + "updated_at": "2026-07-07T12:42:19+00:00" + }, + { + "repo": "repo-scoping", + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:52+00:00", + "updated_at": "2026-08-20T21:44:42+00:00" + }, + { + "repo": "repo-seed", + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:58:57+00:00", + "updated_at": "2026-08-20T21:44:43+00:00" + }, + { + "repo": "reuse-surface", + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "description": "Capability registry for helix_forge", + "registered_at": "2026-06-15T08:24:18+00:00", + "updated_at": "2026-08-20T21:44:43+00:00" + }, + { + "repo": "shard-wiki", + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:03+00:00", + "updated_at": "2026-08-20T21:44:44+00:00" + }, + { + "repo": "state-hub", + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:35:00+00:00", + "updated_at": "2026-07-07T16:09:42+00:00" + }, + { + "repo": "tegwick-control", + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:00+00:00", + "updated_at": "2026-08-20T21:44:44+00:00" + }, + { + "repo": "the-custodian", + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-15T23:59:04+00:00", + "updated_at": "2026-08-20T21:44:45+00:00" + }, + { + "repo": "user-engine", + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:02:46+00:00", + "updated_at": "2026-08-20T21:44:45+00:00" + }, + { + "repo": "vantage-point", + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:02:51+00:00", + "updated_at": "2026-08-20T21:44:46+00:00" + }, + { + "repo": "vergabe-teilnahme", + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:02:56+00:00", + "updated_at": "2026-08-20T21:44:46+00:00" + }, + { + "repo": "whynot-control", + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:03:00+00:00", + "updated_at": "2026-08-20T21:44:46+00:00" + }, + { + "repo": "whynot-design", + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "enabled": true, + "required": false, + "domain": "helix_forge", + "cache_ttl_seconds": 86400, + "auth_header": "Authorization", + "registered_at": "2026-06-16T00:03:03+00:00", + "updated_at": "2026-08-20T21:44:47+00:00" + } + ] +} diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/inventory.json b/docs/assessments/netkingdom-2026-10-14/supplement/inventory.json new file mode 100644 index 00000000..1c5bd0a0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/inventory.json @@ -0,0 +1,77 @@ +{ + "as_of": "2026-10-14", + "capabilities": [ + { + "repo": "rail-knative", + "id": "capability.railiance.knative-rail", + "name": "Knative workload lifecycle", + "availability": "A2", + "operational_estimate": 3, + "surface": "Derived rail for activation, revisions, traffic, scaling and rollback", + "limitation": "Inherits Kubernetes common contract; verified readiness is not production approval", + "use_cases": [ + "U09", + "U13", + "U14" + ], + "artifacts": [ + "SCOPE.md", + "README.md", + "declarations/rail.yaml" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.knative-rail.md" + }, + { + "repo": "rapp-sbom-nexus", + "id": "capability.railiance.sbom-runtime-package", + "name": "Private SBOM runtime and dynamic database delivery", + "availability": "A2", + "operational_estimate": 3, + "surface": "Immutable deployment, private network policy, dynamic database leases and migration/rollback", + "limitation": "Product owns schema and ingestion; database and backup authority remain with platform owners", + "use_cases": [ + "U07", + "U12", + "U13" + ], + "artifacts": [ + "SCOPE.md", + "README.md" + ], + "existing_entry_path": null, + "prior_vector": null, + "vector": "D3 / A2 / C1 / R0", + "entry_path": "registry/capabilities/capability.railiance.sbom-runtime-package.md" + } + ], + "repositories": { + "rail-knative": { + "head": "cd38dba3653e7fc85d3b2d3a074811b9a7216f25", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:8df1e3a222f32462b682d7a2e655913051d289303e899e71eb2f43fa1ef1aa7c", + "README.md": "sha256:6e8384a5753332735e9947884e7a52721d4145bb91a1061ca8c4ac63fb7ac4ec", + "SCOPE.md": "sha256:d5c9f0433a25825ce2b77f6caef8bc20dba303b07596233904975226e33e3d87", + "declarations/rail.yaml": "sha256:4a33c43a098657acbd7d43f1790473e22363be744b19c2d3fb035da205d204db" + }, + "missing_review_artifacts": [], + "existing_index": {} + }, + "rapp-sbom-nexus": { + "head": "1566bcf69fc0757db5efc67f78b14af10d944c1b", + "branch": "main", + "dirty_paths": [], + "source_sha256": { + "INTENT.md": "sha256:15cb4502390da82fab13acdfd75b393b0fceb76183811080f097c768e0c2a417", + "README.md": "sha256:1fd7e5f69efdba122b57508e17dc001f623fb80a3f5ac0de093fbbea8ad07a76", + "SCOPE.md": "sha256:a20b2c4492a6ff54986e79d40836e7633a4b6ae578330fb87c06eb41aaf81f4d" + }, + "missing_review_artifacts": [], + "existing_index": {} + } + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/prepare_registry.py b/docs/assessments/netkingdom-2026-10-14/supplement/prepare_registry.py new file mode 100644 index 00000000..97872b7b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/supplement/prepare_registry.py @@ -0,0 +1,124 @@ +"""Prepare exact registry edits for review. Does not mutate owner repositories.""" +from pathlib import Path +import json, hashlib, sys, copy +import yaml +sys.path.insert(0,'/home/worsch/reuse-surface') +from reuse_surface.registry import parse_front_matter,entry_vector +from reuse_surface.cli import _run_validate +BASE=Path('/home/worsch'); OUT=Path(__file__).resolve().parent; STAGE=OUT/'registry-stage' +data=json.loads((OUT/'inventory.json').read_text()); rows=data['capabilities'] +CASES={ +'U01':'Architect composes a security deployment from explicit owner contracts and case types', +'U02':'Human signs in with MFA and manages account or factor recovery', +'U03':'Application combines identity, tenant and resource facts and enforces a bound decision', +'U04':'Protected operation obtains and consumes exact human approval before its side effect', +'U05':'Operator provisions and delivers a scoped workload credential through the approved owner lane', +'U06':'Operator or automation obtains a bounded SSH certificate and maintains private connectivity', +'U07':'Owner inventories, rotates, revokes and detects exposure of credentials', +'U08':'Consumer emits security events and reconciles independently retained evidence', +'U09':'Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes', +'U10':'Operator recovers identity, custody or data with independently held recovery material', +'U11':'Agent executes an attributable bounded task and supplies supervision evidence', +'U12':'Developer builds and publishes through controlled source, dependency and runner paths', +'U13':'Platform owner deploys and rolls back a workload with explicit substrate and custody bindings', +'U14':'Framework adopter validates and reuses selected contracts, tools and reference compositions', +} +# Adjacencies express interfaces, not a claim that every edge is natively admitted. +NEIGHBORS={ +'net-kingdom':['security-canon','gate-house','key-cape','access-engine','reuse-surface'], +'key-cape':['user-engine','tenant-engine','access-engine'], +'user-engine':['key-cape','tenant-engine','access-engine','audit-core'], +'access-engine':['approval-engine','key-cape','tenant-engine','zone-engine','maturity-engine'], +'approval-engine':['access-engine','key-cape','secrets-engine','audit-core'], +'secrets-engine':['approval-engine','access-engine','railiance-platform','ops-warden'], +'ops-warden':['secrets-engine','access-engine','ops-bridge','ops-mason'], +'ops-mason':['secrets-engine','net-kingdom','railiance-platform'], +'audit-core':['approval-engine','tenant-engine','kings-guard','railiance-telemetry'], +'kings-guard':['maturity-engine','audit-core','risk-nexus','net-kingdom'], +'maturity-engine':['gate-house','access-engine','kings-guard'], +'whitehat-security':['gate-house','audit-core','approval-engine'], +'emergent-security':['net-kingdom','gate-house','glas-harness'], +'informed-decision':['approval-engine','access-engine','state-hub'], +'policy-nexus':['net-kingdom','security-canon','risk-nexus'], +'glas-harness':['sand-boxer','rein-aharness','rein-openweights'], +'agentic-resources':['glas-harness','activity-core','fin-hub'], +'repo-manager':['railiance-forge','sbom-nexus','state-hub'], +'railiance-forge':['repo-manager','railiance-enablement','railiance-apps'], +'railiance-platform':['rapp-openbao','rapp-postgres','key-cape','secrets-engine'], +'railiance-telemetry':['rapp-telemetry','audit-core','kings-guard'], +'rapp-telemetry':['railiance-telemetry','rail-kubernetes','reef-railiance'], +'fin-hub':['resource-control','agentic-resources'], +'rail-knative':['rail-kubernetes','reef-railiance'], +'rapp-sbom-nexus':['sbom-nexus','rapp-postgres','railiance-platform'], +} +primary={r["repo"]:r["id"] for r in json.loads((OUT.parent/"inventory.json").read_text())["capabilities"]} +for r in rows: primary.setdefault(r['repo'],r['id']) +changes=[]; validation=[] +def stage(repo,rel,content): + dst=STAGE/repo/rel;dst.parent.mkdir(parents=True,exist_ok=True); dst.write_text(content) + src=BASE/repo/rel + if src.exists(): + baseline=OUT/'registry-before'/repo/rel;baseline.parent.mkdir(parents=True,exist_ok=True);baseline.write_bytes(src.read_bytes()) + if not src.exists() or src.read_bytes()!=dst.read_bytes(): + changes.append({'repo':repo,'path':rel,'before_sha256':hashlib.sha256(src.read_bytes()).hexdigest() if src.exists() else None,'after_sha256':hashlib.sha256(dst.read_bytes()).hexdigest(),'operation':'write'}) +for repo,rv in data['repositories'].items(): + root=BASE/repo; rs=[r for r in rows if r['repo']==repo] + ix=copy.deepcopy(rv['existing_index'] or {'version':1,'domain':'infotech','capabilities':[]}) + marker=root/'registry/NO_CAPABILITIES.md' + if marker.exists(): changes.append({'repo':repo,'path':'registry/NO_CAPABILITIES.md','before_sha256':hashlib.sha256(marker.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'}) + ix['updated']='2026-10-14';ix.setdefault('version',1);ix.setdefault('domain','infotech') + # Include unchanged sibling entries in staged validation without rewriting them. + for p in (root/'registry/capabilities').glob('*.md'): + if repo=='secrets-engine' and parse_front_matter(p).get('id')=='capability.infotech.repo-template': + changes.append({'repo':repo,'path':str(p.relative_to(root)),'before_sha256':hashlib.sha256(p.read_bytes()).hexdigest(),'after_sha256':None,'operation':'delete'}) + ix['capabilities']=[c for c in ix['capabilities'] if c['id']!='capability.infotech.repo-template'];continue + dst=STAGE/repo/p.relative_to(root);dst.parent.mkdir(parents=True,exist_ok=True);dst.write_bytes(p.read_bytes()) + for r in rs: + rel=r['existing_entry_path'] or f"registry/capabilities/{r['id']}.md" + try: old=parse_front_matter(root/rel) if (root/rel).exists() else {} + except (ValueError,yaml.YAMLError): + try: old=yaml.safe_load((root/rel).read_text()[4:]) + except yaml.YAMLError: old={} + valid_old='maturity' in old and 'external_evidence' in old + fm=copy.deepcopy(old) if valid_old else {'id':r['id'],'owner':repo,'status':'draft','domain':'infotech','maturity':{'discovery':{'current':'D3','target':'D5','confidence':'medium'},'availability':{'current':r['availability'],'target':r['availability'],'confidence':'medium'}},'external_evidence':{'completeness':{'level':'C1','confidence':'low','basis':'Source artifacts establish a bounded capability; no independent consumer-completeness assessment in this review.'},'reliability':{'level':'R0','confidence':'low','basis':'No longitudinal consumer reliability measurement established by this review.'}}} + fm.pop('consumption_modes',None) + fm.update(name=r['name'],summary=r['surface']+'.',owner=repo) + fm['tags']=list(dict.fromkeys(fm.get('tags',[])+['security','netkingdom','framework-reuse'])) + if old.get('external_evidence'): + for key in ['completeness','reliability']: + if key in old['external_evidence']: fm['external_evidence'][key]=old['external_evidence'][key] + fm['external_evidence'].setdefault('reliability',{'level':'R0','confidence':'low','basis':'No longitudinal reliability assessment available.'}) + previous=entry_vector(fm) + fm['maturity']['availability']['current']=r['availability'] + if int(fm['maturity']['availability'].get('target',r['availability'])[1:]) '+target) +# Walk dependency edges across all reviewed entries; symmetric related_to is valid. +visited=set();stack=[] +def visit(cap): + if cap in stack:errors.append('Dependency cycle '+' -> '.join(stack+[cap]));return + if cap in visited:return + stack.append(cap) + for target in entries.get(cap,{}).get('relations',{}).get('depends_on',[]):visit(target) + stack.pop();visited.add(cap) +for cap in expected:visit(cap) +manifest={'version':1,'domain':'infotech','collision_policy':'warn','sources':sources} +federated,warnings=compose_federated_index(manifest);errors.extend(warnings) +counts=collections.Counter(c['id'] for c in federated['capabilities']) +for cap in expected: + if counts[cap]!=1:errors.append(f'{cap}: federated count {counts[cap]}') +label='local' if a.live_local else 'staged' +(OUT/f'federation-{label}.yaml').write_text(yaml.safe_dump(manifest,sort_keys=False)) +(OUT/f'federated-{label}.yaml').write_text(yaml.safe_dump(federated,sort_keys=False)) +receipt={'scope':label,'repositories':len(checks),'reviewed_capabilities':len(expected),'federated_capabilities':len(federated['capabilities']),'matched_exactly_once':sum(counts[k]==1 for k in expected),'checks':checks,'errors':errors,'proof_boundary':'Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof.'} +(OUT/f'verification-{label}.json').write_text(json.dumps(receipt,indent=2)+'\n') +print(json.dumps({k:v for k,v in receipt.items() if k!='checks'},indent=2));sys.exit(bool(errors)) diff --git a/docs/assessments/netkingdom-2026-10-14/use-cases.json b/docs/assessments/netkingdom-2026-10-14/use-cases.json new file mode 100644 index 00000000..2f3c3dad --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/use-cases.json @@ -0,0 +1,16 @@ +{ + "U01": "Architect composes a security deployment from explicit owner contracts and case types", + "U02": "Human signs in with MFA and manages account or factor recovery", + "U03": "Application combines identity, tenant and resource facts and enforces a bound decision", + "U04": "Protected operation obtains and consumes exact human approval before its side effect", + "U05": "Operator provisions and delivers a scoped workload credential through the approved owner lane", + "U06": "Operator or automation obtains a bounded SSH certificate and maintains private connectivity", + "U07": "Owner inventories, rotates, revokes and detects exposure of credentials", + "U08": "Consumer emits security events and reconciles independently retained evidence", + "U09": "Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes", + "U10": "Operator recovers identity, custody or data with independently held recovery material", + "U11": "Agent executes an attributable bounded task and supplies supervision evidence", + "U12": "Developer builds and publishes through controlled source, dependency and runner paths", + "U13": "Platform owner deploys and rolls back a workload with explicit substrate and custody bindings", + "U14": "Framework adopter validates and reuses selected contracts, tools and reference compositions" +} diff --git a/docs/assessments/netkingdom-2026-10-14/verification-local.json b/docs/assessments/netkingdom-2026-10-14/verification-local.json new file mode 100644 index 00000000..13e788f3 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/verification-local.json @@ -0,0 +1,371 @@ +{ + "scope": "local", + "repositories": 60, + "reviewed_capabilities": 70, + "federated_capabilities": 71, + "matched_exactly_once": 70, + "checks": [ + { + "repo": "access-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "activity-core", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "agentic-resources", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "approval-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "audit-core", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "coordination-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "emergent-security", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "fin-hub", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "gate-house", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "glas-harness", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "info-tech-canon", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "informed-decision", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "issue-core", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "key-cape", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "kings-guard", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "maturity-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "net-kingdom", + "entry_count": 6, + "errors": 0, + "warnings": 0 + }, + { + "repo": "ops-bridge", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "ops-mason", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "ops-warden", + "entry_count": 3, + "errors": 0, + "warnings": 0 + }, + { + "repo": "policy-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rail-kubernetes", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-apps", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-bootstrap", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-cluster", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-enablement", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-fabric", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-forge", + "entry_count": 2, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-infra", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-master", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-platform", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-telemetry", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-openbao", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-playwright", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-policy-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-postgres", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-telemetry", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-tenant-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-user-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "reef-railiance", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rein-aharness", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rein-openweights", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "repo-manager", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "resource-control", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "reuse-surface", + "entry_count": 3, + "errors": 0, + "warnings": 0 + }, + { + "repo": "risk-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "role-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "runbook-tutorials", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "sand-boxer", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "sbom-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "secrets-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "security-canon", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "state-hub", + "entry_count": 2, + "errors": 0, + "warnings": 0 + }, + { + "repo": "tenant-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "the-custodian", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "user-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "whitehat-security", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "zone-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rail-knative", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-sbom-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + } + ], + "errors": [], + "proof_boundary": "Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof." +} diff --git a/docs/assessments/netkingdom-2026-10-14/verification-staged.json b/docs/assessments/netkingdom-2026-10-14/verification-staged.json new file mode 100644 index 00000000..d1acd8ae --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/verification-staged.json @@ -0,0 +1,359 @@ +{ + "scope": "staged", + "repositories": 58, + "reviewed_capabilities": 68, + "federated_capabilities": 69, + "matched_exactly_once": 68, + "checks": [ + { + "repo": "access-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "activity-core", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "agentic-resources", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "approval-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "audit-core", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "coordination-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "emergent-security", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "fin-hub", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "gate-house", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "glas-harness", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "info-tech-canon", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "informed-decision", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "issue-core", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "key-cape", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "kings-guard", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "maturity-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "net-kingdom", + "entry_count": 6, + "errors": 0, + "warnings": 0 + }, + { + "repo": "ops-bridge", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "ops-mason", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "ops-warden", + "entry_count": 3, + "errors": 0, + "warnings": 0 + }, + { + "repo": "policy-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rail-kubernetes", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-apps", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-bootstrap", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-cluster", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-enablement", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-fabric", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-forge", + "entry_count": 2, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-infra", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-master", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-platform", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "railiance-telemetry", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-openbao", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-playwright", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-policy-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-postgres", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-telemetry", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-tenant-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rapp-user-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "reef-railiance", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rein-aharness", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "rein-openweights", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "repo-manager", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "resource-control", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "reuse-surface", + "entry_count": 3, + "errors": 0, + "warnings": 0 + }, + { + "repo": "risk-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "role-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "runbook-tutorials", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "sand-boxer", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "sbom-nexus", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "secrets-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "security-canon", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "state-hub", + "entry_count": 2, + "errors": 0, + "warnings": 0 + }, + { + "repo": "tenant-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "the-custodian", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "user-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "whitehat-security", + "entry_count": 1, + "errors": 0, + "warnings": 0 + }, + { + "repo": "zone-engine", + "entry_count": 1, + "errors": 0, + "warnings": 0 + } + ], + "errors": [], + "proof_boundary": "Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof." +} diff --git a/docs/assessments/netkingdom-2026-10-14/verify_publication.py b/docs/assessments/netkingdom-2026-10-14/verify_publication.py new file mode 100644 index 00000000..ad61719c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/verify_publication.py @@ -0,0 +1,33 @@ +from pathlib import Path +import concurrent.futures,hashlib,json,urllib.request,urllib.error +OUT=Path(__file__).resolve().parent;data=json.loads((OUT/'full-inventory.json').read_text()) +publications=json.loads((OUT/'registry-publication.json').read_text())+json.loads((OUT/'supplement/registry-publication.json').read_text()) +commits={r['repo']:r['commit'] for r in publications if r.get('verified_remote')} +class NoRedirect(urllib.request.HTTPRedirectHandler): + def redirect_request(self,*args,**kwargs):return None +def check(n): + out={'repo':n,'files':[],'errors':[]} + if n not in commits:out['errors'].append('No verified source publication');return out + paths=['registry/indexes/capabilities.yaml']+[r['entry_path'] for r in data['capabilities'] if r['repo']==n] + for path in paths: + url=f'https://forgejo.coulomb.social/coulomb/{n}/raw/commit/{commits[n]}/{path}' + try: + with urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect()).open(url,timeout=30) as response: + body=response.read(2*1024*1024+1);status=response.status + sha=hashlib.sha256(body).hexdigest();expected=hashlib.sha256((Path('/home/worsch')/n/path).read_bytes()).hexdigest() + out['files'].append({'path':path,'http':status,'sha256':sha,'matches_local':sha==expected}) + if sha!=expected:out['errors'].append('Published bytes differ: '+path) + except Exception as e:out['errors'].append(path+': '+type(e).__name__) + # Also verify the stable URL the federation will fetch, not just immutable commit URLs. + try: + path='registry/indexes/capabilities.yaml';url=f'https://forgejo.coulomb.social/coulomb/{n}/raw/branch/main/{path}' + with urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect()).open(url,timeout=30) as response:body=response.read(2*1024*1024+1) + out['stable_index_matches']=hashlib.sha256(body).hexdigest()==hashlib.sha256((Path('/home/worsch')/n/path).read_bytes()).hexdigest() + if not out['stable_index_matches']:out['errors'].append('Stable index differs') + except Exception as e:out['errors'].append('Stable URL: '+type(e).__name__) + return out +with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex:results=list(ex.map(check,data['repositories'])) +errors=[{'repo':r['repo'],'errors':r['errors']} for r in results if r['errors']] +receipt={'checked_repositories':len(results),'checked_capabilities':len(data['capabilities']),'errors':errors,'results':results} +(OUT/'published-source-verification.json').write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps({k:v for k,v in receipt.items() if k!='results'},indent=2)) +raise SystemExit(bool(errors)) diff --git a/docs/assessments/netkingdom-2026-10-14/verify_registry.py b/docs/assessments/netkingdom-2026-10-14/verify_registry.py new file mode 100644 index 00000000..7c5f6538 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/verify_registry.py @@ -0,0 +1,62 @@ +"""Verify review coverage beyond the native CLI's limited cross-repo checks.""" +import argparse, collections, hashlib, json, sys +from pathlib import Path +import yaml +sys.path.insert(0,'/home/worsch/reuse-surface') +from reuse_surface.cli import _run_validate +from reuse_surface.registry import parse_front_matter,entry_vector +from reuse_surface.federation import compose_federated_index +OUT=Path(__file__).resolve().parent +p=argparse.ArgumentParser();p.add_argument('--live-local',action='store_true');p.add_argument('--inventory',default='inventory.json');a=p.parse_args() +v=json.loads((OUT/a.inventory).read_text());root=Path('/home/worsch') if a.live_local else OUT/'registry-stage' +errors=[];entries={};sources=[];checks=[] +for n in v['repositories']: + b=root/n;e,w,paths=_run_validate(b,target=None,relations=False);errors.extend(e+w) + sources.append({'repo':n,'index':str(b/'registry/indexes/capabilities.yaml'),'enabled':True,'required':True}) + ix=yaml.safe_load((b/'registry/indexes/capabilities.yaml').read_text()) + for c in ix['capabilities']: + f=parse_front_matter(b/c['path']);entries[f['id']]=f + for k in ['id','name','summary','owner','status','domain']: + if c.get(k)!=f.get(k):errors.append(n+': index mismatch '+c['id']+' '+k) + if c.get('vector')!=entry_vector(f):errors.append(n+': vector mismatch '+c['id']) + checks.append({'repo':n,'entry_count':len(paths),'errors':len(e),'warnings':len(w)}) +expected={r['id'] for r in v['capabilities']} +for r in v['capabilities']: + f=entries.get(r['id']);b=Path('/home/worsch')/r['repo'] + if f is None: errors.append('Missing '+r['id']);continue + for artifact in r['artifacts']: + if not (b/artifact).is_file():errors.append('Missing artifact '+str(b/artifact)) + for u in r['use_cases']: + if not any(x.startswith(u+':') for x in f['discovery']['use_cases']):errors.append('Missing usecase '+r['id']+':'+u) + if f['owner']!=r['repo']:errors.append('Owner mismatch '+r['id']) + # Relations outside this review must still resolve to an actual owner entry. +for b in Path('/home/worsch').glob('*/registry/indexes/capabilities.yaml'): + try: + for c in (yaml.safe_load(b.read_text()) or {}).get('capabilities',[]): + if c.get('id') not in entries and (b.parents[2]/c.get('path','')).is_file():entries[c['id']]={'id':c['id']} + except (ValueError,TypeError,KeyError,yaml.YAMLError):pass +for cap in expected: + for kind,targets in entries[cap].get('relations',{}).items(): + if kind=='reused_by':continue + for target in targets: + if target not in entries:errors.append('Unresolved relation '+cap+' -> '+target) +# Walk dependency edges across all reviewed entries; symmetric related_to is valid. +visited=set();stack=[] +def visit(cap): + if cap in stack:errors.append('Dependency cycle '+' -> '.join(stack+[cap]));return + if cap in visited:return + stack.append(cap) + for target in entries.get(cap,{}).get('relations',{}).get('depends_on',[]):visit(target) + stack.pop();visited.add(cap) +for cap in expected:visit(cap) +manifest={'version':1,'domain':'infotech','collision_policy':'warn','sources':sources} +federated,warnings=compose_federated_index(manifest);errors.extend(warnings) +counts=collections.Counter(c['id'] for c in federated['capabilities']) +for cap in expected: + if counts[cap]!=1:errors.append(f'{cap}: federated count {counts[cap]}') +label='local' if a.live_local else 'staged' +(OUT/f'federation-{label}.yaml').write_text(yaml.safe_dump(manifest,sort_keys=False)) +(OUT/f'federated-{label}.yaml').write_text(yaml.safe_dump(federated,sort_keys=False)) +receipt={'scope':label,'repositories':len(checks),'reviewed_capabilities':len(expected),'federated_capabilities':len(federated['capabilities']),'matched_exactly_once':sum(counts[k]==1 for k in expected),'checks':checks,'errors':errors,'proof_boundary':'Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof.'} +(OUT/f'verification-{label}.json').write_text(json.dumps(receipt,indent=2)+'\n') +print(json.dumps({k:v for k,v in receipt.items() if k!='checks'},indent=2));sys.exit(bool(errors)) diff --git a/docs/netkingdom-security-architecture-review.md b/docs/netkingdom-security-architecture-review.md new file mode 100644 index 00000000..857a1b23 --- /dev/null +++ b/docs/netkingdom-security-architecture-review.md @@ -0,0 +1,161 @@ +# NetKingdom security architecture and framework reuse review + +Assessed **14 October 2026** under [CUST-WP-0081](../workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md). + +**NetKingdom is a credible modular security architecture with working components, but the assembled security framework is still at an integration stage.** Its strongest design decision is the separation of identity, authorization, approval, credential lifecycle and evidence. The highest-return work is to prove and package the interfaces between these components, then use measured operational feedback to improve them. Building another coordinating security service would increase the integration burden. + +The review covers **60 capability-owning repositories and 70 reusable capability boundaries**, plus two inspected nonproviders, listed in the [capability inventory](assessments/netkingdom-2026-10-14/capability-inventory.md). The inventory records each capability's owner, interface, supported use cases, maturity vector, operational estimate, limitations and source links. [Source revisions and hashes](assessments/netkingdom-2026-10-14/full-inventory.json) bind this assessment to the inspected worktrees, including their pre-existing changes. + +## Scope and evidence + +Included repositories either define NetKingdom security semantics, implement a security responsibility, host a security component, or provide a direct execution, detection, recovery or improvement dependency. “All relevant” means this architectural dependency boundary, not every application that logs in. A capability is a separately consumable contract or tool surface; individual functions and endpoints are grouped where they share a lifecycle and owner. + +The principal consumers are humans, workload operators, developers, security reviewers, coding agents and framework adopters. Forgejo, Markitect and Qonto Assistant are integration examples, not additional security authorities. CommerceCanon and role-engine are not identity or access-control engines; role-engine is included explicitly to resolve that misleading name. Keycloak is an expanded-mode option; the present KeyCape stack uses Authelia, LLDAP and privacyIDEA. OpenBao and those upstream products are dependencies, not additional local repositories. Helm/ArgoCD/ESO/CNPG/Gitleaks similarly appear under their local owners. The derived `rail-knative` execution contract and `rapp-sbom-nexus` runtime package are included. `rapp-secrets-engine` is retired; `rapp-forgejo` is a placeholder with no family declaration. Neither contributes a delivered capability. Optional business application packages, external-tracker packaging, generic hub implementation dependencies and unrelated business systems are outside the denominator. + +Evidence precedence is executable owner source and specific dated acceptance receipts, then current workplans and scope declarations, then registry metadata. An implemented API, a deployed service and a verified consumer journey are separate claims. No new live penetration test, credential read, recovery drill or deployment is implied by this review. The previous [blueprint](netkingdom-security-blueprint.md), [gap analysis](netkingdom-security-gaps.md) and owner plans supply detailed native evidence. Their dated progress must be read as a timeline: the blueprint's original 22-repository scanner observation is superseded by the October 13 forge expansion evidence. + +The Emergent Security orientation check returned package **0.2.6**, digest `8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`, with the start card **withheld** for source drift. Owner sources were therefore inspected directly. Withholding is a useful integrity control; the stale orientation still causes avoidable integration effort. + +## Architectural responsibilities + +| Plane | Owners | Reusable contract and boundary | +| --- | --- | --- | +| Semantics and doctrine | security-canon, info-tech-canon, net-kingdom, gate-house | Vocabulary, IAM and security layer standards, case types, authority context and conformance criteria. Doctrine enters runtime as claims or versioned policy. | +| Identity and facts | key-cape, user-engine, tenant-engine, zone-engine, maturity-engine | Identity/assurance and bounded facts. Zone Engine is an offline reference; Maturity Engine has source/library delivery, not an asserted production service. | +| Authorization and approval | access-engine, approval-engine, informed-decision | Access Engine owns policy decisions. Approval Engine owns bound approval state and atomic consumption. Informed Decision presents human choices and preserves their disposition. | +| Credential and operation lifecycle | secrets-engine, ops-warden, ops-mason, ops-bridge | Catalog and lifecycle, access routing/SSH issuance, reviewed structure construction and private transport. These are distinct authorities. | +| Evidence and improvement | audit-core, kings-guard, whitehat-security, risk-nexus, railiance-telemetry | Independent custody, posture evaluation, authorized adversarial proof, risk judgments and operational signals. Detection and proposals do not authorize containment. | +| Agent execution | glas-harness, sand-boxer, reins, agentic-resources | Profile selection, isolation, actual tool execution and measured learning. Effective authority includes credentials reachable through tools. | +| Platform realization | Railiance owners, rail-kubernetes, reef-railiance and rapp packages | Concrete hosts, cluster, custody, packages, deployment, backup and recovery. Package readiness does not certify an entire security workflow. | +| Discovery and coordination | reuse-surface, repo-manager, state-hub, the-custodian, coordination-engine, activity-core | Find existing capabilities, retain owner-backed work records and schedule bounded work. None substitutes for runtime approval or independent audit custody. | + +“One PDP” means **one decision-owning engine and contract**, not one global process. Access Engine deliberately uses consumer-specific deployment pins. Consolidating all pins into a shared availability and trust domain without measurements would weaken the current isolation design. The `flex-auth` name persists in runtime audiences and endpoints during the source rename; that is migration compatibility, not another decision engine. + +```mermaid +flowchart LR + I[KeyCape identity and assurance] --> P[Consumer enforcement point] + F[User tenant zone and maturity facts] --> D[Access Engine decision] + H[Human via Informed Decision] --> A[Approval Engine bound approval] + A --> D + P --> D + D --> P + P --> C[Consume required approval] + C --> N[Native target identity or scoped credential lifecycle] + N --> S[Secrets Engine and OpenBao] + S --> T[Exact protected operation] + P --> E[Durable source emission] + T --> E + E --> U[Audit Core custody and reconciliation] + U --> K[Posture and risk findings] + K --> R[Owner review and bounded improvement] + R --> H +``` + +The diagram is the composition contract, not an assertion that every connection has native acceptance. Direct native identity should avoid credential issuance where possible; it does not bypass the applicable authorization or evidence obligations. + +## Supported use cases + +“Available” identifies a bounded delivered surface with owner evidence. “Partial” means useful components exist while the integrated outcome retains named gates. “Reference” means local planning or validation, without a live enforcement claim. + +| ID | Actor and outcome | Support today | Composition and decisive limit | +| --- | --- | --- | --- | +| U01 | Architect composes a new service's security model | Available for contracts and reference planning | NetKingdom conformance, scenario composer, case types, Gate House and reuse-surface. Provider selection and trust ordering are deterministic; execution remains explicitly disabled in the composer. | +| U02 | Human signs in, steps up MFA and manages account/factor recovery | Available sign-in; partial recovery and automated browser access | KeyCape + User Engine + relying-party enforcement. Real-factor recovery acceptance remains KEY-WP-0040/U08. Rapp Playwright has a deployed pilot, but human/agent self-service identity and connectivity are pending. | +| U03 | Application applies tenant-aware, resource-specific access | Available components; partial uniform enforcement | KeyCape/User/Tenant facts → Access Engine → application PEP. Wrong tenant, stale claims, replay and unavailable dependencies must be tested per consumer. Offline zone reference cannot supply a live claim service. | +| U04 | Approver authorizes an exact protected action once | Partial integrated journey | Informed Decision → Approval Engine claim → PDP decision → atomic consume → PEP effect. Approval service deployment exists; named PEP execution and exact native issuer/tenant acceptance remain APPROVAL-WP-0002 gates. | +| U05 | Operator provisions and delivers a narrow workload credential | Available bounded legacy lanes; partial task-scoped path | Warden route → Mason structure → Secrets Engine lifecycle → OpenBao. CCR38 service login is identity-only. SECRETS-WP-0013 and platform entitlement acceptance still govern protected execution. | +| U06 | Human or automation obtains SSH access and private connectivity | Available bounded paths | Warden certificates, host principal mapping and Bridge tunnel lifecycle. A tunnel or valid certificate does not establish application authorization. Operator-only MFA/login acts remain attended. | +| U07 | Owner inventories credentials, rotates/revokes them and detects exposure | Partial lifecycle and estate coverage | Secrets Engine catalog + platform custody + owner consumer inventory + Repo Manager/Forge scanning. Rotation needs adoption and predecessor refusal, not merely a changed KV value. Import/mirror and detection-to-response gaps remain. | +| U08 | Producer retains attributable security events and detects missing evidence | Available custody and local contracts; partial source coverage | Source outbox → Audit Core → cadence/heartbeat/reconciliation → telemetry/Guard. Independent arrival integrity cannot establish events a compromised source omitted. Sender and emission-class admission stay explicit. | +| U09 | Maintainer improves posture from recurring evidence | Available assessment/proposal tools; partial closed loop | Posture Feedback, Maturity Engine, Guard, Risk Nexus, Activity Core and owner work records. Unassisted schedule, owner adoption and verified outcome feedback are not uniformly established. No adaptive component may grant new authority. | +| U10 | Operator restores identity, roots or platform data | Available scoped procedures and some data restore evidence; partial estate recovery | Owner runbooks, encrypted custody, Rapp OpenBao/Postgres and independent recovery resources. Full root inventory, independent issuer bootstrap and estate-native recovery gates remain NK-WP-0049 and the close-down checklist. | +| U11 | Coding agent performs a bounded attributable task | Available source/runtime pieces; partial privileged isolation | Glas + Sand-boxer + rein + supervision receipts. CUST-WP-0073/GLAS-WP-0012 do not yet establish this interactive agent's enforced credential separation or autopilot. | +| U12 | Developer builds and publishes with source and dependency controls | Available components; partial supply-chain boundary | Forge + Repo Manager + SBOM Nexus + Enablement + Apps. Hosted runners remain a privileged shared boundary; scanning, required checks, artifact provenance and per-job credentials have different coverage. | +| U13 | Platform owner deploys, observes and rolls back a security workload | Available owner/package paths | Infra → Cluster → Platform → rail/rapp/reef bindings. Current single-node and headroom limits affect availability and rollout; a package declaration alone proves no consumer acceptance. | +| U14 | Adopter builds a security framework from reusable parts | Available contracts/tools; partial portable product | Start with the profile below and independently validate each adapter. There is no proven estate-independent one-command distribution or measured second installation. | + +Use-case mapping is many-to-many in the inventory and registry entries. A listed supporting capability inherits neither the whole journey's maturity nor its authorization. + +## Maturity estimate + +This review uses a local operational scale: **M1 described**, **M2 implemented/reference**, **M3 repeatedly operated for a bounded scope**, **M4 measured integrated operation with lifecycle/failure coverage**, **M5 improvement validated across repeated cycles**. These are estimates, not certification or NIST tiers. NIST distinguishes CSF implementation tiers from maturity levels. [NIST guidance](https://www.nist.gov/cyberframework/cybersecurity-framework-faqs-framework-components). + +The separate reuse-surface **D/A/C/R vector** means discovery, availability form, consumer completeness and consumer reliability. A0 can be the correct destination for a standard; A4 API availability does not imply mature operations. Existing C/R claims are retained as owner assessments where present, not independently recertified. New entries use conservative C1/R0 until consumer evidence supports more. See the [registry maturity standard](../../reuse-surface/specs/CapabilityMaturityStandard.md). + +| Dimension | Estimate | Basis and evidence needed to advance | +| --- | --- | --- | +| Responsibility model and governance | M3; medium-high confidence | Accepted layer model and concrete owner boundaries, with explicit exceptions. Advance through continuously checked implementation/standard correspondence and bounded exception retirement. | +| Individual identity/PDP/custody components | M3 for bounded operated paths; medium confidence | Working source and dated deployments/consumer receipts. Uniform negative tests, key rotation, outages and revocation evidence are needed for M4. | +| End-to-end privileged authorization | M2; high confidence in the limit | Approval, PDP provenance and task-bound execution gaps remain named owner work. A complete protected operation with denial, replay, expiry, failure and recovery proof is the gate. | +| Detection, audit and response | M2 overall; some custody/scanner paths M3 | Native scanner expansion and audit service exist; source emission completeness, import paths and private response handling remain incomplete. | +| Recovery and resilience | M2 overall; scoped database/package recovery M3 | Restore procedures and selected proofs exist; independent root recovery and estate-wide loss scenarios remain unproven. Single-node risk is explicitly accepted for build mode. | +| Agent authority and isolation | M2; medium-high confidence | Supervised record and source isolation mechanisms exist; the active assignment has no verified runtime isolation or autopilot grant. | +| Reuse as an independent framework | M2; medium confidence | Useful APIs, contracts and local tools; heterogeneous packaging, stale metadata and estate coupling prevent an M3 portability claim. | +| Self-optimization | M2; high confidence in the limit | Deterministic findings and proposals exist; regular native collection, authorized change, verified improvement and rollback do not form a uniformly accepted loop. | + +**Overall: M2 integration stage, with several M3 components.** The weakest mandatory trust boundary limits the integrated claim; averaging component scores would hide it. There is no defensible percentage “complete” or forecast incident rate from the available evidence. The SEC-DSM ledger records **116 numbered entries: 20 anti-pattern references, 12 incomplete assessments and 84 unverified entries, with none marked conformant**. This is assessment coverage, not a claim that 84 controls are absent. [Requirement ledger](evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json). + +## SWOT + +| | Assessment | +| --- | --- | +| **Strengths** | Clear single-owner boundaries for decisions, approvals, identity, custody and audit. Deterministic composition and proposal-only feedback tools. Explicit exceptions and source/native proof separation. Working identity, policy, audit, platform and operational access components. Repo-native evidence and existing discovery/coordination infrastructure reduce the need for new services. | +| **Weaknesses** | Interface acceptance lags component delivery. Stale SCOPE/registry descriptions can direct consumers incorrectly: Secrets Engine still describes a missing approval endpoint while Approval Engine records deployment and consumer-specific acceptance gates. Several capabilities were invisible or malformed in reuse-surface. Runtime/source renames and split package ownership add discovery friction. The package family check fails because the `rapp-forgejo` placeholder has no family declaration; the telemetry package itself renders successfully. Credential recovery, adoption-tested rotation, agent isolation and source completeness retain gaps. | +| **Opportunities** | Publish a versioned minimal profile, reusable conformance suite and provider adapters. Measure one complete protected-operation path and one second installation. Connect current posture and maturity tools to existing scheduling/work records with verified outcome feedback. Make capability discovery describe exact interfaces and limits, so consumers can reuse a small subset rather than reproduce the estate. | +| **Threats** | A forged or stale decision reaching an incompletely verifying PEP; confused actor/principal/tenant bindings; privileged tools outside agent isolation; runner or repository-write authority reaching credentials; omitted source events; bootstrap/recovery roots depending on the failed issuer; operator bottlenecks and single-node failure; documentation or build-mode exceptions being mistaken for production acceptance. | + +## Ranked improvements + +Rank reflects **risk reduction first, shared dependency removal second, then reuse benefit per implementation effort**. The order is an engineering judgment, not a calculated ROI. Effort bands are planning estimates for a focused engineer with available owner inputs: **S 1–3 days, M 4–10 days, L 2–6 weeks**. Attended windows and cross-owner review can add calendar time. These are suggestions; they do not authorize production changes or promote deferred residuals. + +| Rank | Improvement and owner | Benefit and effort | Dependency and acceptance criterion | +| --- | --- | --- | --- | +| **1** | Authenticate PDP decisions at every enforcing consumer. Access Engine + Secrets Engine, then each PEP. | Removes a trust gap shared by all privileged reuse. **M**, high risk reduction and reuse value. | SECRETS-WP-0014; independently admitted verification keys or authenticated channel, exact request/lifetime binding. Refuse forged/unsigned/unknown-key responses and prove key rotation and outage behavior in the native path. | +| **2** | Finish one exact approval-to-effect integration and make it the executable reference. Approval Engine + Secrets Engine + KeyCape + Platform. | Removes the largest integration uncertainty and repeated owner negotiation. **L**, high operational/reuse value. | APPROVAL-WP-0002, SECRETS-WP-0013, RPF-WP-0035-T12. Prove claim/check/consume-before-effect, distinct identities, tenant binding, expiry/replay refusal, uncertain-outcome reconciliation, cleanup and independent evidence. | +| **3** | Enforce agent and runner credential boundaries. Glas/Sand-boxer/rein owners, Platform and Forge. | Bounds exposure from a tool or job compromise. **L**, high risk reduction. | CUST-WP-0073/GLAS-WP-0012 and FORGE-WP-0006. Test real read denial for admin material, task-specific identity, constrained delegated action, teardown/revocation and repository-controlled workflow abuse. Preserve founder-deferred rotation decisions. | +| **4** | Complete inventory and credential lifecycle evidence. Secrets Engine + Platform + consumer owners. | Eliminates unknown consumers and manual rotation ambiguity. **M–L**, high risk reduction and operational efficiency. | Reuse existing catalog, CCRs and G04/G09/G12 owner work. Every credential has owner, consumers, scope, delivery, expiry/rotation, revocation and elimination trigger; sample rotation proves new adoption and old refusal. | +| **5** | Close detection-to-response and non-receive coverage. Repo Manager + Forge + Risk Nexus/credential owner. | Converts preventive scans into a usable incident workflow. **M**, high operational value. | RMGR-WP-0021/FORGE-WP-0006. Reconcile exact repository denominator, imports/mirrors/history and mandatory CI; deliver a private synthetic finding through triage, owner action and retained resolution without content disclosure. | +| **6** | Complete independent recovery and exception retirement. Platform + NetKingdom + Infra + package owners. | Reduces correlated issuer/cluster loss and operator dependence. **L**, high resilience value. | NK-WP-0049, G11 and close-down checklist. Inventory roots; prove isolated restore without the failed issuer, consumer reconnect, audit continuity and ordinary custody restoration; give each exception a review/elimination trigger. | +| **7** | Package the proven interfaces as a minimal framework profile and conformance kit. NetKingdom + provider owners + Railiance Master. | Largest direct reduction in framework adoption cost. **M** after ranks 1–2; high reuse value. | Reuse existing case/composer/validator tools. Pin contract and provider versions; test a second clean installation and publish a compatibility matrix, positive/negative journeys, upgrade and rollback instructions. | +| **8** | Make discovery continuously truthful. Reuse Surface + Repo Manager + each owner. | Removes repeated rediscovery and incorrect integration plans. **S–M**, broad efficiency gain. | This review establishes the capability denominator. Require valid owner entries, exact index/entry parity, resolvable relations, drift/freshness checks, valid package-family declarations (including a disposition for rapp-forgejo) and hosted round-trip discovery; fix stale endpoint and runtime-name claims at their source. | +| **9** | Admit security event sources and measure missing evidence. Audit Core + Approval/Tenant/Secrets owners + Telemetry. | Gives optimization trustworthy inputs and reveals silent controls. **M**, prerequisite for measured improvement. | Existing outbox/cadence work. Verify source transition → durable outbox → receiver → independent readback; include lag, duplicates, downtime, rare-event heartbeats and revocation of sender access. | +| **10** | Close the existing improvement loop with outcome verification. NetKingdom + Guard + Maturity + Activity Core + coordination owners. | Reduces manual follow-up and prevents recurring findings. **M** after rank 9. | CUST-WP-0079 cadence and owner contracts. First unassisted observation → deduplicated finding → ranked owner work → approved change → native remeasurement → retained result; failure retains finding and rollback. | +| **11** | Standardize consumer adapters and error/evidence contracts. Access/Approval/Secrets owners with NetKingdom. | Reduces per-consumer binding, retry, freshness and transport bugs. **M**, high reuse value. | Extract only behavior proven by ranks 1–2 into a small SDK/contract test kit. Preserve owner authority, no embedded second PDP; demonstrate two consumers and version compatibility. | +| **12** | Optimize operational cost from measurements. Resource Control + Fin Hub + Platform + Telemetry. | Avoids unnecessary service hops, replicas and deploy-per-lane work. **S** measurement then **M** changes. | Measure p50/p95 decision and protected-operation latency, approval touches, queue age, replica cost, headroom and failure rates. Batch compatible owner work and prefer native identity; retain security invariants and demonstrate improvement against a baseline. | + +Ranks 1–6 establish trustworthy operations. Registry cleanup can proceed alongside them because it is low risk. Ranks 7 and 11 should package the accepted reference, while ranks 9–10 make improvement measurable. These recommendations reference existing owner work instead of creating another parallel security backlog. + +## Reusable framework shape + +A first adopter should choose a small profile from the inventory: + +1. **Contracts and offline verification:** SecurityCanon practice, NetKingdom IAM/layer/case contracts, conformance validators and scenario composer. This is useful today even when using different runtime providers. +2. **Application access:** an IAM-profile-compatible identity provider, Access Engine and a consumer enforcement adapter; add User/Tenant facts only where the application needs them. Do not require the offline Zone Engine as a service dependency. +3. **Privileged operations:** Approval Engine and a proven consume-before-effect adapter; use Secrets Engine/OpenBao only when target-native identity is insufficient. Warden/Bridge/Mason apply when operational access or structure construction is needed. +4. **Evidence and operations:** source outbox and Audit Core, then owner-specific rollout/recovery contracts. Railiance is the current reference substrate; its hostnames, local tunnels and admin procedures should be configuration/adapters, not framework requirements. +5. **Improvement:** posture feedback, Guard/Maturity claims and existing work scheduling. Add learning only after stable source provenance and native outcome measurement. + +Stable reuse surfaces should be schemas, versioned request/claim/decision/receipt contracts, package entry points, fixtures and provider adapters. No new umbrella broker is needed. A framework distribution should publish its dependency lock, supported versions, migration rules, sample consumer and explicit unsupported scenarios. Commercial licensing and redistribution rights need their own artifact-by-artifact review before an external distribution; this assessment establishes technical reuse, not a blanket redistribution grant. + +## Optimization measurements + +| Outcome | Measure and owner | Comparison that would demonstrate improvement | +| --- | --- | --- | +| Faster onboarding | Time and human touches from accepted case to natively verified consumer; Warden/Mason/Platform | Same case class before/after templates, with negative tests unchanged | +| Lower execution overhead | Policy and complete protected-operation latency, failure rate and issuer calls; PEP/Access/Secrets | Representative p50/p95 and throughput under the same authority and failure requirements | +| Lower recurring work | Reopened/duplicate findings, overdue owner work and manual handoffs; Guard/Activity/State Hub | Repeat observation windows with stable source denominator | +| Better security coverage | Credentials, PEPs, repositories and event classes with complete evidence divided by explicitly inventoried totals | Unknowns reported separately; no denominator shrink to improve a score | +| Cheaper operation | Resource requests versus measured demand, recovery storage and operator effort; Resource Control/Fin Hub | Native capacity/recovery checks and error rate remain within the agreed bounds | +| Better reuse | Successful second installation, time to integrate, adapter-specific code and upgrade failures; NetKingdom/Reuse Surface | Independent consumer acceptance against pinned contracts | + +A useful automatic loop observes and proposes. Any actuation still passes existing authority, cost/risk, approval and rollback controls. A maturity score, performance lesson or optimization target must never manufacture a permission. + +## Capability establishment status + +**Owner registries and local reuse-surface discovery are established; hosted establishment remains incomplete.** All 70 reviewed capabilities validate and occur exactly once in the composed local federation. The normal `plan-check` command finds Approval Engine for bound approval consumption and NetKingdom Posture Feedback for evidence expiry. The default local federation preserves unrelated sources: 99 source registrations compose 114 total capabilities without warnings. [Local verification](assessments/netkingdom-2026-10-14/verification-local.json), [normal CLI discovery](assessments/netkingdom-2026-10-14/local-discovery-receipt.json). + +All 60 owner repositories have published registry-only commits with verified remote revisions. Valid stable IDs were preserved, missing entries added, the copied Secrets Engine template entry removed, malformed metadata normalized and concrete use cases and relations established. Existing unrelated staging was preserved. Maturity Engine had an unrelated unpublished local commit; its registry publication used a separate checkout based on the remote head and left that local commit untouched. [Publication receipts](assessments/netkingdom-2026-10-14/registry-publication.json), [additional providers](assessments/netkingdom-2026-10-14/supplement/registry-publication.json). + +The hosted hub currently exposes **32 of 70** reviewed capabilities after a fresh composition. **38 owner registrations remain:** 31 public indexes are ready; seven package indexes return 404 anonymously and need admitted private-source reading. The normal `reuse-surface-hub-write-token` Warden path received a PDP decision but OpenBao denied the current caller with **HTTP 403**. No registration helper ran and no hub write occurred. Repository visibility and credential policy were left intact. [Hosted readback and denial](assessments/netkingdom-2026-10-14/hosted-verification.json), [exact registration plan](assessments/netkingdom-2026-10-14/hub-registration-plan.json), [private-source gates](assessments/netkingdom-2026-10-14/hub-private-source-pending.json). + +Verification also passed 23 local scenario/posture tests, 11 User Engine package tests, nine policy-package tests and Helm lint. The telemetry package rendered 93 resources successfully; its estate family check failed on the pre-existing `rapp-forgejo` declaration gap. Source hashes and report links were checked. These results establish the documentation and registry work, not native security conformance. [Check receipt](assessments/netkingdom-2026-10-14/source-test-receipt.json), [source integrity](assessments/netkingdom-2026-10-14/review-integrity.json). diff --git a/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md new file mode 100644 index 00000000..dc739a4c --- /dev/null +++ b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md @@ -0,0 +1,68 @@ +--- +id: CUST-WP-0081 +type: workplan +title: "Review NetKingdom architecture and establish security reuse capabilities" +domain: infotech +repo: the-custodian +status: active +owner: codex +topic_slug: custodian +created: "2026-10-14" +updated: "2026-10-14" +flavor: planning +depends_on: [] +state_hub_workstream_id: "e8992815-389a-5c40-8569-a2b0ee3945f0" +--- + +User-requested repository/capability/use-case inventory, SWOT, maturity estimate, +ranked architecture efficiency and framework reuse recommendations, and actual +reuse-surface establishment. CUST-WP-0080 retains security defect implementation +and native acceptance; this assessment does not close those gaps or promote +residual implementation work. + +## Establish the evidence and complete the architecture review + +```task +id: CUST-WP-0081-T01 +status: done +priority: high +state_hub_task_id: "73c92cb6-cf82-5c86-ada1-9b9f8e637127" +``` + +Inspect owner sources, current workplans, implementation interfaces and existing +receipts. Record an explicit inclusion boundary, repo revisions and source hashes. +Deliver a repository/capability inventory, supported and conditional use cases, +SWOT, justified maturity estimates and ranked improvements with owner, benefit, +effort, dependency and acceptance evidence. + +Delivered `docs/netkingdom-security-architecture-review.md` and the linked inventory: 60 capability-owning repos, 70 capability boundaries, 14 use cases and two inspected nonproviders. Includes SWOT, separate operational/reuse maturity estimates and 12 ranked improvements. Source hashes and report links pass. Existing native security gaps remain with CUST-WP-0080 and owner plans. + +## Establish all reviewed capabilities through reuse-surface + +```task +id: CUST-WP-0081-T02 +status: progress +priority: high +state_hub_task_id: "80b037cd-876d-53c2-9272-b1dfe0524446" +``` + +Retain valid owner capability IDs; repair misleading metadata and add missing +bounded capabilities with consumer guidance and relations. Validate owner +registries and compose a deterministic federation with no missing reviewed IDs. +Verify publication and hosted discovery separately; local establishment alone +does not prove hosted federation. Preserve unrelated worktree changes. + +2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User asked to arrange scoped access or leave hosted establishment pending; no answer recorded. Exact plan, denial and verification evidence are in the assessment directory. + +## Audit coverage and record the result + +```task +id: CUST-WP-0081-T03 +status: progress +priority: high +state_hub_task_id: "9bccb18e-0501-5319-a18c-f1fb36312cb7" +``` + +Check every inventory capability against its source, use cases, maturity and +registry entry. Verify actual federation coverage and report any unresolved +publication gate. Log progress and run statehub fix-consistency.