From 55f2090ff9f75cd0675b2c70bf9f62b5f1af7251 Mon Sep 17 00:00:00 2001
From: codex <codex@local>
Date: Wed, 14 Oct 2026 09:52:45 +0200
Subject: [PATCH] docs: publish reviewed NetKingdom evidence batch 7

---
 .../registry/indexes/capabilities.yaml        |  19 +
 ...pability.railiance.sbom-runtime-package.md | 108 +++++
 .../registry/indexes/capabilities.yaml        |  20 +
 .../supplement/use-cases.json                 |  16 +
 .../supplement/verification-staged.json       |  23 ++
 .../supplement/verify_registry.py             |  62 +++
 .../netkingdom-2026-10-14/use-cases.json      |  16 +
 .../verification-local.json                   | 371 ++++++++++++++++++
 .../verification-staged.json                  | 359 +++++++++++++++++
 .../verify_publication.py                     |  33 ++
 .../netkingdom-2026-10-14/verify_registry.py  |  62 +++
 ...netkingdom-security-architecture-review.md | 161 ++++++++
 ...etkingdom-architecture-review-and-reuse.md |  68 ++++
 13 files changed, 1318 insertions(+)
 create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml
 create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/capabilities/capability.railiance.sbom-runtime-package.md
 create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml
 create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/use-cases.json
 create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/verification-staged.json
 create mode 100644 docs/assessments/netkingdom-2026-10-14/supplement/verify_registry.py
 create mode 100644 docs/assessments/netkingdom-2026-10-14/use-cases.json
 create mode 100644 docs/assessments/netkingdom-2026-10-14/verification-local.json
 create mode 100644 docs/assessments/netkingdom-2026-10-14/verification-staged.json
 create mode 100644 docs/assessments/netkingdom-2026-10-14/verify_publication.py
 create mode 100644 docs/assessments/netkingdom-2026-10-14/verify_registry.py
 create mode 100644 docs/netkingdom-security-architecture-review.md
 create mode 100644 workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md

diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml
new file mode 100644
index 00000000..2c378522
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rail-knative/registry/indexes/capabilities.yaml
@@ -0,0 +1,19 @@
+version: 1
+domain: infotech
+capabilities:
+- id: capability.railiance.knative-rail
+  name: Knative workload lifecycle
+  summary: Derived rail for activation, revisions, traffic, scaling and rollback.
+  domain: infotech
+  status: draft
+  owner: rail-knative
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.knative-rail.md
+  consumption_modes:
+  - CLI
+  - source
+updated: '2026-10-14'
diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/capabilities/capability.railiance.sbom-runtime-package.md b/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/capabilities/capability.railiance.sbom-runtime-package.md
new file mode 100644
index 00000000..fc0af3f2
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/capabilities/capability.railiance.sbom-runtime-package.md
@@ -0,0 +1,108 @@
+---
+id: capability.railiance.sbom-runtime-package
+owner: rapp-sbom-nexus
+status: draft
+domain: infotech
+maturity:
+  discovery:
+    current: D3
+    target: D5
+    confidence: medium
+    rationale: Owner scope, neighboring responsibilities, concrete use cases and limitations
+      are documented; no exhaustive or generalized maturity claim.
+  availability:
+    current: A2
+    target: A2
+    confidence: medium
+    rationale: 'Source interface assessed 2026-10-14: Immutable deployment, private
+      network policy, dynamic database leases and migration/rollback. Availability
+      describes the delivery form, not production acceptance. Product owns schema
+      and ingestion; database and backup authority remain with platform owners.'
+external_evidence:
+  completeness:
+    level: C1
+    confidence: low
+    basis: Source artifacts establish a bounded capability; no independent consumer-completeness
+      assessment in this review.
+  reliability:
+    level: R0
+    confidence: low
+    basis: No longitudinal consumer reliability measurement established by this review.
+name: Private SBOM runtime and dynamic database delivery
+summary: Immutable deployment, private network policy, dynamic database leases and
+  migration/rollback.
+tags:
+- security
+- netkingdom
+- framework-reuse
+discovery:
+  intent: Immutable deployment, private network policy, dynamic database leases and
+    migration/rollback
+  includes:
+  - Immutable deployment, private network policy, dynamic database leases and migration/rollback
+  excludes:
+  - Product owns schema and ingestion; database and backup authority remain with platform
+    owners
+  use_cases:
+  - 'U07: Owner inventories, rotates, revokes and detects exposure of credentials'
+  - 'U12: Developer builds and publishes through controlled source, dependency and
+    runner paths'
+  - 'U13: Platform owner deploys and rolls back a workload with explicit substrate
+    and custody bindings'
+availability:
+  current_level: A2
+  target_level: A2
+  current_artifacts:
+  - SCOPE.md
+  - README.md
+  consumption_modes:
+  - CLI
+  - source
+relations:
+  related_to:
+  - capability.infotech.sbom-management
+  - capability.railiance.postgres-isolation-recovery
+  - capability.railiance.platform-services
+  wraps:
+  - capability.infotech.sbom-management
+evidence:
+  documentation:
+  - SCOPE.md
+  - README.md
+consumer_guidance:
+  recommended_for:
+  - Owner inventories, rotates, revokes and detects exposure of credentials
+  - Developer builds and publishes through controlled source, dependency and runner
+    paths
+  - Platform owner deploys and rolls back a workload with explicit substrate and custody
+    bindings
+  not_recommended_for:
+  - Product owns schema and ingestion; database and backup authority remain with platform
+    owners
+  known_limitations:
+  - Product owns schema and ingestion; database and backup authority remain with platform
+    owners
+  - 2026-10-14 architecture review estimates operational maturity separately; a registry
+    entry does not authorize execution or establish deployment.
+---
+
+# Private SBOM runtime and dynamic database delivery
+
+Immutable deployment, private network policy, dynamic database leases and migration/rollback.
+
+## Reuse boundary
+
+Product owns schema and ingestion; database and backup authority remain with platform owners.
+
+## Supported use cases
+
+- U07: Owner inventories, rotates, revokes and detects exposure of credentials
+- U12: Developer builds and publishes through controlled source, dependency and runner paths
+- U13: Platform owner deploys and rolls back a workload with explicit substrate and custody bindings
+
+## Evidence and integration
+
+- [SCOPE.md](../../SCOPE.md)
+- [README.md](../../README.md)
+
+Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists.
diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml b/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml
new file mode 100644
index 00000000..250245ac
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/supplement/registry-stage/rapp-sbom-nexus/registry/indexes/capabilities.yaml
@@ -0,0 +1,20 @@
+version: 1
+domain: infotech
+capabilities:
+- id: capability.railiance.sbom-runtime-package
+  name: Private SBOM runtime and dynamic database delivery
+  summary: Immutable deployment, private network policy, dynamic database leases and
+    migration/rollback.
+  domain: infotech
+  status: draft
+  owner: rapp-sbom-nexus
+  tags:
+  - security
+  - netkingdom
+  - framework-reuse
+  vector: D3 / A2 / C1 / R0
+  path: registry/capabilities/capability.railiance.sbom-runtime-package.md
+  consumption_modes:
+  - CLI
+  - source
+updated: '2026-10-14'
diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/use-cases.json b/docs/assessments/netkingdom-2026-10-14/supplement/use-cases.json
new file mode 100644
index 00000000..2f3c3dad
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/supplement/use-cases.json
@@ -0,0 +1,16 @@
+{
+  "U01": "Architect composes a security deployment from explicit owner contracts and case types",
+  "U02": "Human signs in with MFA and manages account or factor recovery",
+  "U03": "Application combines identity, tenant and resource facts and enforces a bound decision",
+  "U04": "Protected operation obtains and consumes exact human approval before its side effect",
+  "U05": "Operator provisions and delivers a scoped workload credential through the approved owner lane",
+  "U06": "Operator or automation obtains a bounded SSH certificate and maintains private connectivity",
+  "U07": "Owner inventories, rotates, revokes and detects exposure of credentials",
+  "U08": "Consumer emits security events and reconciles independently retained evidence",
+  "U09": "Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes",
+  "U10": "Operator recovers identity, custody or data with independently held recovery material",
+  "U11": "Agent executes an attributable bounded task and supplies supervision evidence",
+  "U12": "Developer builds and publishes through controlled source, dependency and runner paths",
+  "U13": "Platform owner deploys and rolls back a workload with explicit substrate and custody bindings",
+  "U14": "Framework adopter validates and reuses selected contracts, tools and reference compositions"
+}
diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/verification-staged.json b/docs/assessments/netkingdom-2026-10-14/supplement/verification-staged.json
new file mode 100644
index 00000000..1d952ea3
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/supplement/verification-staged.json
@@ -0,0 +1,23 @@
+{
+  "scope": "staged",
+  "repositories": 2,
+  "reviewed_capabilities": 2,
+  "federated_capabilities": 2,
+  "matched_exactly_once": 2,
+  "checks": [
+    {
+      "repo": "rail-knative",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-sbom-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    }
+  ],
+  "errors": [],
+  "proof_boundary": "Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof."
+}
diff --git a/docs/assessments/netkingdom-2026-10-14/supplement/verify_registry.py b/docs/assessments/netkingdom-2026-10-14/supplement/verify_registry.py
new file mode 100644
index 00000000..dff4ca48
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/supplement/verify_registry.py
@@ -0,0 +1,62 @@
+"""Verify review coverage beyond the native CLI's limited cross-repo checks."""
+import argparse, collections, hashlib, json, sys
+from pathlib import Path
+import yaml
+sys.path.insert(0,'/home/worsch/reuse-surface')
+from reuse_surface.cli import _run_validate
+from reuse_surface.registry import parse_front_matter,entry_vector
+from reuse_surface.federation import compose_federated_index
+OUT=Path(__file__).resolve().parent
+p=argparse.ArgumentParser();p.add_argument('--live-local',action='store_true');a=p.parse_args()
+v=json.loads((OUT/'inventory.json').read_text());root=Path('/home/worsch') if a.live_local else OUT/'registry-stage'
+errors=[];entries={};sources=[];checks=[]
+for n in v['repositories']:
+ b=root/n;e,w,paths=_run_validate(b,target=None,relations=False);errors.extend(e+w)
+ sources.append({'repo':n,'index':str(b/'registry/indexes/capabilities.yaml'),'enabled':True,'required':True})
+ ix=yaml.safe_load((b/'registry/indexes/capabilities.yaml').read_text())
+ for c in ix['capabilities']:
+  f=parse_front_matter(b/c['path']);entries[f['id']]=f
+  for k in ['id','name','summary','owner','status','domain']:
+   if c.get(k)!=f.get(k):errors.append(n+': index mismatch '+c['id']+' '+k)
+  if c.get('vector')!=entry_vector(f):errors.append(n+': vector mismatch '+c['id'])
+ checks.append({'repo':n,'entry_count':len(paths),'errors':len(e),'warnings':len(w)})
+expected={r['id'] for r in v['capabilities']}
+for r in v['capabilities']:
+ f=entries.get(r['id']);b=Path('/home/worsch')/r['repo']
+ if f is None: errors.append('Missing '+r['id']);continue
+ for artifact in r['artifacts']:
+  if not (b/artifact).is_file():errors.append('Missing artifact '+str(b/artifact))
+ for u in r['use_cases']:
+  if not any(x.startswith(u+':') for x in f['discovery']['use_cases']):errors.append('Missing usecase '+r['id']+':'+u)
+ if f['owner']!=r['repo']:errors.append('Owner mismatch '+r['id'])
+ # Relations outside this review must still resolve to an actual owner entry.
+for b in Path('/home/worsch').glob('*/registry/indexes/capabilities.yaml'):
+ try:
+  for c in (yaml.safe_load(b.read_text()) or {}).get('capabilities',[]):
+   if c.get('id') not in entries and (b.parents[2]/c.get('path','')).is_file():entries[c['id']]={'id':c['id']}
+ except (ValueError,TypeError,KeyError,yaml.YAMLError):pass
+for cap in expected:
+ for kind,targets in entries[cap].get('relations',{}).items():
+  if kind=='reused_by':continue
+  for target in targets:
+   if target not in entries:errors.append('Unresolved relation '+cap+' -> '+target)
+# Walk dependency edges across all reviewed entries; symmetric related_to is valid.
+visited=set();stack=[]
+def visit(cap):
+ if cap in stack:errors.append('Dependency cycle '+' -> '.join(stack+[cap]));return
+ if cap in visited:return
+ stack.append(cap)
+ for target in entries.get(cap,{}).get('relations',{}).get('depends_on',[]):visit(target)
+ stack.pop();visited.add(cap)
+for cap in expected:visit(cap)
+manifest={'version':1,'domain':'infotech','collision_policy':'warn','sources':sources}
+federated,warnings=compose_federated_index(manifest);errors.extend(warnings)
+counts=collections.Counter(c['id'] for c in federated['capabilities'])
+for cap in expected:
+ if counts[cap]!=1:errors.append(f'{cap}: federated count {counts[cap]}')
+label='local' if a.live_local else 'staged'
+(OUT/f'federation-{label}.yaml').write_text(yaml.safe_dump(manifest,sort_keys=False))
+(OUT/f'federated-{label}.yaml').write_text(yaml.safe_dump(federated,sort_keys=False))
+receipt={'scope':label,'repositories':len(checks),'reviewed_capabilities':len(expected),'federated_capabilities':len(federated['capabilities']),'matched_exactly_once':sum(counts[k]==1 for k in expected),'checks':checks,'errors':errors,'proof_boundary':'Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof.'}
+(OUT/f'verification-{label}.json').write_text(json.dumps(receipt,indent=2)+'\n')
+print(json.dumps({k:v for k,v in receipt.items() if k!='checks'},indent=2));sys.exit(bool(errors))
diff --git a/docs/assessments/netkingdom-2026-10-14/use-cases.json b/docs/assessments/netkingdom-2026-10-14/use-cases.json
new file mode 100644
index 00000000..2f3c3dad
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/use-cases.json
@@ -0,0 +1,16 @@
+{
+  "U01": "Architect composes a security deployment from explicit owner contracts and case types",
+  "U02": "Human signs in with MFA and manages account or factor recovery",
+  "U03": "Application combines identity, tenant and resource facts and enforces a bound decision",
+  "U04": "Protected operation obtains and consumes exact human approval before its side effect",
+  "U05": "Operator provisions and delivers a scoped workload credential through the approved owner lane",
+  "U06": "Operator or automation obtains a bounded SSH certificate and maintains private connectivity",
+  "U07": "Owner inventories, rotates, revokes and detects exposure of credentials",
+  "U08": "Consumer emits security events and reconciles independently retained evidence",
+  "U09": "Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes",
+  "U10": "Operator recovers identity, custody or data with independently held recovery material",
+  "U11": "Agent executes an attributable bounded task and supplies supervision evidence",
+  "U12": "Developer builds and publishes through controlled source, dependency and runner paths",
+  "U13": "Platform owner deploys and rolls back a workload with explicit substrate and custody bindings",
+  "U14": "Framework adopter validates and reuses selected contracts, tools and reference compositions"
+}
diff --git a/docs/assessments/netkingdom-2026-10-14/verification-local.json b/docs/assessments/netkingdom-2026-10-14/verification-local.json
new file mode 100644
index 00000000..13e788f3
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/verification-local.json
@@ -0,0 +1,371 @@
+{
+  "scope": "local",
+  "repositories": 60,
+  "reviewed_capabilities": 70,
+  "federated_capabilities": 71,
+  "matched_exactly_once": 70,
+  "checks": [
+    {
+      "repo": "access-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "activity-core",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "agentic-resources",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "approval-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "audit-core",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "coordination-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "emergent-security",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "fin-hub",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "gate-house",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "glas-harness",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "info-tech-canon",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "informed-decision",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "issue-core",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "key-cape",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "kings-guard",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "maturity-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "net-kingdom",
+      "entry_count": 6,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "ops-bridge",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "ops-mason",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "ops-warden",
+      "entry_count": 3,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "policy-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rail-kubernetes",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-apps",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-bootstrap",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-cluster",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-enablement",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-fabric",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-forge",
+      "entry_count": 2,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-infra",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-master",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-platform",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-telemetry",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-openbao",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-playwright",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-policy-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-postgres",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-telemetry",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-tenant-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-user-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "reef-railiance",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rein-aharness",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rein-openweights",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "repo-manager",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "resource-control",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "reuse-surface",
+      "entry_count": 3,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "risk-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "role-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "runbook-tutorials",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "sand-boxer",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "sbom-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "secrets-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "security-canon",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "state-hub",
+      "entry_count": 2,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "tenant-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "the-custodian",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "user-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "whitehat-security",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "zone-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rail-knative",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-sbom-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    }
+  ],
+  "errors": [],
+  "proof_boundary": "Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof."
+}
diff --git a/docs/assessments/netkingdom-2026-10-14/verification-staged.json b/docs/assessments/netkingdom-2026-10-14/verification-staged.json
new file mode 100644
index 00000000..d1acd8ae
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/verification-staged.json
@@ -0,0 +1,359 @@
+{
+  "scope": "staged",
+  "repositories": 58,
+  "reviewed_capabilities": 68,
+  "federated_capabilities": 69,
+  "matched_exactly_once": 68,
+  "checks": [
+    {
+      "repo": "access-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "activity-core",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "agentic-resources",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "approval-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "audit-core",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "coordination-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "emergent-security",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "fin-hub",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "gate-house",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "glas-harness",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "info-tech-canon",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "informed-decision",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "issue-core",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "key-cape",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "kings-guard",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "maturity-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "net-kingdom",
+      "entry_count": 6,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "ops-bridge",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "ops-mason",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "ops-warden",
+      "entry_count": 3,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "policy-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rail-kubernetes",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-apps",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-bootstrap",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-cluster",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-enablement",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-fabric",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-forge",
+      "entry_count": 2,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-infra",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-master",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-platform",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "railiance-telemetry",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-openbao",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-playwright",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-policy-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-postgres",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-telemetry",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-tenant-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rapp-user-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "reef-railiance",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rein-aharness",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "rein-openweights",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "repo-manager",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "resource-control",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "reuse-surface",
+      "entry_count": 3,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "risk-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "role-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "runbook-tutorials",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "sand-boxer",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "sbom-nexus",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "secrets-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "security-canon",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "state-hub",
+      "entry_count": 2,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "tenant-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "the-custodian",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "user-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "whitehat-security",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    },
+    {
+      "repo": "zone-engine",
+      "entry_count": 1,
+      "errors": 0,
+      "warnings": 0
+    }
+  ],
+  "errors": [],
+  "proof_boundary": "Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof."
+}
diff --git a/docs/assessments/netkingdom-2026-10-14/verify_publication.py b/docs/assessments/netkingdom-2026-10-14/verify_publication.py
new file mode 100644
index 00000000..ad61719c
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/verify_publication.py
@@ -0,0 +1,33 @@
+from pathlib import Path
+import concurrent.futures,hashlib,json,urllib.request,urllib.error
+OUT=Path(__file__).resolve().parent;data=json.loads((OUT/'full-inventory.json').read_text())
+publications=json.loads((OUT/'registry-publication.json').read_text())+json.loads((OUT/'supplement/registry-publication.json').read_text())
+commits={r['repo']:r['commit'] for r in publications if r.get('verified_remote')}
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+ def redirect_request(self,*args,**kwargs):return None
+def check(n):
+ out={'repo':n,'files':[],'errors':[]}
+ if n not in commits:out['errors'].append('No verified source publication');return out
+ paths=['registry/indexes/capabilities.yaml']+[r['entry_path'] for r in data['capabilities'] if r['repo']==n]
+ for path in paths:
+  url=f'https://forgejo.coulomb.social/coulomb/{n}/raw/commit/{commits[n]}/{path}'
+  try:
+   with urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect()).open(url,timeout=30) as response:
+    body=response.read(2*1024*1024+1);status=response.status
+   sha=hashlib.sha256(body).hexdigest();expected=hashlib.sha256((Path('/home/worsch')/n/path).read_bytes()).hexdigest()
+   out['files'].append({'path':path,'http':status,'sha256':sha,'matches_local':sha==expected})
+   if sha!=expected:out['errors'].append('Published bytes differ: '+path)
+  except Exception as e:out['errors'].append(path+': '+type(e).__name__)
+ # Also verify the stable URL the federation will fetch, not just immutable commit URLs.
+ try:
+  path='registry/indexes/capabilities.yaml';url=f'https://forgejo.coulomb.social/coulomb/{n}/raw/branch/main/{path}'
+  with urllib.request.build_opener(urllib.request.ProxyHandler({}),NoRedirect()).open(url,timeout=30) as response:body=response.read(2*1024*1024+1)
+  out['stable_index_matches']=hashlib.sha256(body).hexdigest()==hashlib.sha256((Path('/home/worsch')/n/path).read_bytes()).hexdigest()
+  if not out['stable_index_matches']:out['errors'].append('Stable index differs')
+ except Exception as e:out['errors'].append('Stable URL: '+type(e).__name__)
+ return out
+with concurrent.futures.ThreadPoolExecutor(max_workers=6) as ex:results=list(ex.map(check,data['repositories']))
+errors=[{'repo':r['repo'],'errors':r['errors']} for r in results if r['errors']]
+receipt={'checked_repositories':len(results),'checked_capabilities':len(data['capabilities']),'errors':errors,'results':results}
+(OUT/'published-source-verification.json').write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps({k:v for k,v in receipt.items() if k!='results'},indent=2))
+raise SystemExit(bool(errors))
diff --git a/docs/assessments/netkingdom-2026-10-14/verify_registry.py b/docs/assessments/netkingdom-2026-10-14/verify_registry.py
new file mode 100644
index 00000000..7c5f6538
--- /dev/null
+++ b/docs/assessments/netkingdom-2026-10-14/verify_registry.py
@@ -0,0 +1,62 @@
+"""Verify review coverage beyond the native CLI's limited cross-repo checks."""
+import argparse, collections, hashlib, json, sys
+from pathlib import Path
+import yaml
+sys.path.insert(0,'/home/worsch/reuse-surface')
+from reuse_surface.cli import _run_validate
+from reuse_surface.registry import parse_front_matter,entry_vector
+from reuse_surface.federation import compose_federated_index
+OUT=Path(__file__).resolve().parent
+p=argparse.ArgumentParser();p.add_argument('--live-local',action='store_true');p.add_argument('--inventory',default='inventory.json');a=p.parse_args()
+v=json.loads((OUT/a.inventory).read_text());root=Path('/home/worsch') if a.live_local else OUT/'registry-stage'
+errors=[];entries={};sources=[];checks=[]
+for n in v['repositories']:
+ b=root/n;e,w,paths=_run_validate(b,target=None,relations=False);errors.extend(e+w)
+ sources.append({'repo':n,'index':str(b/'registry/indexes/capabilities.yaml'),'enabled':True,'required':True})
+ ix=yaml.safe_load((b/'registry/indexes/capabilities.yaml').read_text())
+ for c in ix['capabilities']:
+  f=parse_front_matter(b/c['path']);entries[f['id']]=f
+  for k in ['id','name','summary','owner','status','domain']:
+   if c.get(k)!=f.get(k):errors.append(n+': index mismatch '+c['id']+' '+k)
+  if c.get('vector')!=entry_vector(f):errors.append(n+': vector mismatch '+c['id'])
+ checks.append({'repo':n,'entry_count':len(paths),'errors':len(e),'warnings':len(w)})
+expected={r['id'] for r in v['capabilities']}
+for r in v['capabilities']:
+ f=entries.get(r['id']);b=Path('/home/worsch')/r['repo']
+ if f is None: errors.append('Missing '+r['id']);continue
+ for artifact in r['artifacts']:
+  if not (b/artifact).is_file():errors.append('Missing artifact '+str(b/artifact))
+ for u in r['use_cases']:
+  if not any(x.startswith(u+':') for x in f['discovery']['use_cases']):errors.append('Missing usecase '+r['id']+':'+u)
+ if f['owner']!=r['repo']:errors.append('Owner mismatch '+r['id'])
+ # Relations outside this review must still resolve to an actual owner entry.
+for b in Path('/home/worsch').glob('*/registry/indexes/capabilities.yaml'):
+ try:
+  for c in (yaml.safe_load(b.read_text()) or {}).get('capabilities',[]):
+   if c.get('id') not in entries and (b.parents[2]/c.get('path','')).is_file():entries[c['id']]={'id':c['id']}
+ except (ValueError,TypeError,KeyError,yaml.YAMLError):pass
+for cap in expected:
+ for kind,targets in entries[cap].get('relations',{}).items():
+  if kind=='reused_by':continue
+  for target in targets:
+   if target not in entries:errors.append('Unresolved relation '+cap+' -> '+target)
+# Walk dependency edges across all reviewed entries; symmetric related_to is valid.
+visited=set();stack=[]
+def visit(cap):
+ if cap in stack:errors.append('Dependency cycle '+' -> '.join(stack+[cap]));return
+ if cap in visited:return
+ stack.append(cap)
+ for target in entries.get(cap,{}).get('relations',{}).get('depends_on',[]):visit(target)
+ stack.pop();visited.add(cap)
+for cap in expected:visit(cap)
+manifest={'version':1,'domain':'infotech','collision_policy':'warn','sources':sources}
+federated,warnings=compose_federated_index(manifest);errors.extend(warnings)
+counts=collections.Counter(c['id'] for c in federated['capabilities'])
+for cap in expected:
+ if counts[cap]!=1:errors.append(f'{cap}: federated count {counts[cap]}')
+label='local' if a.live_local else 'staged'
+(OUT/f'federation-{label}.yaml').write_text(yaml.safe_dump(manifest,sort_keys=False))
+(OUT/f'federated-{label}.yaml').write_text(yaml.safe_dump(federated,sort_keys=False))
+receipt={'scope':label,'repositories':len(checks),'reviewed_capabilities':len(expected),'federated_capabilities':len(federated['capabilities']),'matched_exactly_once':sum(counts[k]==1 for k in expected),'checks':checks,'errors':errors,'proof_boundary':'Schema, source-path, use-case, owner, index, relation and local federation checks only; no runtime or hosted proof.'}
+(OUT/f'verification-{label}.json').write_text(json.dumps(receipt,indent=2)+'\n')
+print(json.dumps({k:v for k,v in receipt.items() if k!='checks'},indent=2));sys.exit(bool(errors))
diff --git a/docs/netkingdom-security-architecture-review.md b/docs/netkingdom-security-architecture-review.md
new file mode 100644
index 00000000..857a1b23
--- /dev/null
+++ b/docs/netkingdom-security-architecture-review.md
@@ -0,0 +1,161 @@
+# NetKingdom security architecture and framework reuse review
+
+Assessed **14 October 2026** under [CUST-WP-0081](../workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md).
+
+**NetKingdom is a credible modular security architecture with working components, but the assembled security framework is still at an integration stage.** Its strongest design decision is the separation of identity, authorization, approval, credential lifecycle and evidence. The highest-return work is to prove and package the interfaces between these components, then use measured operational feedback to improve them. Building another coordinating security service would increase the integration burden.
+
+The review covers **60 capability-owning repositories and 70 reusable capability boundaries**, plus two inspected nonproviders, listed in the [capability inventory](assessments/netkingdom-2026-10-14/capability-inventory.md). The inventory records each capability's owner, interface, supported use cases, maturity vector, operational estimate, limitations and source links. [Source revisions and hashes](assessments/netkingdom-2026-10-14/full-inventory.json) bind this assessment to the inspected worktrees, including their pre-existing changes.
+
+## Scope and evidence
+
+Included repositories either define NetKingdom security semantics, implement a security responsibility, host a security component, or provide a direct execution, detection, recovery or improvement dependency. “All relevant” means this architectural dependency boundary, not every application that logs in. A capability is a separately consumable contract or tool surface; individual functions and endpoints are grouped where they share a lifecycle and owner.
+
+The principal consumers are humans, workload operators, developers, security reviewers, coding agents and framework adopters. Forgejo, Markitect and Qonto Assistant are integration examples, not additional security authorities. CommerceCanon and role-engine are not identity or access-control engines; role-engine is included explicitly to resolve that misleading name. Keycloak is an expanded-mode option; the present KeyCape stack uses Authelia, LLDAP and privacyIDEA. OpenBao and those upstream products are dependencies, not additional local repositories. Helm/ArgoCD/ESO/CNPG/Gitleaks similarly appear under their local owners. The derived `rail-knative` execution contract and `rapp-sbom-nexus` runtime package are included. `rapp-secrets-engine` is retired; `rapp-forgejo` is a placeholder with no family declaration. Neither contributes a delivered capability. Optional business application packages, external-tracker packaging, generic hub implementation dependencies and unrelated business systems are outside the denominator.
+
+Evidence precedence is executable owner source and specific dated acceptance receipts, then current workplans and scope declarations, then registry metadata. An implemented API, a deployed service and a verified consumer journey are separate claims. No new live penetration test, credential read, recovery drill or deployment is implied by this review. The previous [blueprint](netkingdom-security-blueprint.md), [gap analysis](netkingdom-security-gaps.md) and owner plans supply detailed native evidence. Their dated progress must be read as a timeline: the blueprint's original 22-repository scanner observation is superseded by the October 13 forge expansion evidence.
+
+The Emergent Security orientation check returned package **0.2.6**, digest `8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02`, with the start card **withheld** for source drift. Owner sources were therefore inspected directly. Withholding is a useful integrity control; the stale orientation still causes avoidable integration effort.
+
+## Architectural responsibilities
+
+| Plane | Owners | Reusable contract and boundary |
+| --- | --- | --- |
+| Semantics and doctrine | security-canon, info-tech-canon, net-kingdom, gate-house | Vocabulary, IAM and security layer standards, case types, authority context and conformance criteria. Doctrine enters runtime as claims or versioned policy. |
+| Identity and facts | key-cape, user-engine, tenant-engine, zone-engine, maturity-engine | Identity/assurance and bounded facts. Zone Engine is an offline reference; Maturity Engine has source/library delivery, not an asserted production service. |
+| Authorization and approval | access-engine, approval-engine, informed-decision | Access Engine owns policy decisions. Approval Engine owns bound approval state and atomic consumption. Informed Decision presents human choices and preserves their disposition. |
+| Credential and operation lifecycle | secrets-engine, ops-warden, ops-mason, ops-bridge | Catalog and lifecycle, access routing/SSH issuance, reviewed structure construction and private transport. These are distinct authorities. |
+| Evidence and improvement | audit-core, kings-guard, whitehat-security, risk-nexus, railiance-telemetry | Independent custody, posture evaluation, authorized adversarial proof, risk judgments and operational signals. Detection and proposals do not authorize containment. |
+| Agent execution | glas-harness, sand-boxer, reins, agentic-resources | Profile selection, isolation, actual tool execution and measured learning. Effective authority includes credentials reachable through tools. |
+| Platform realization | Railiance owners, rail-kubernetes, reef-railiance and rapp packages | Concrete hosts, cluster, custody, packages, deployment, backup and recovery. Package readiness does not certify an entire security workflow. |
+| Discovery and coordination | reuse-surface, repo-manager, state-hub, the-custodian, coordination-engine, activity-core | Find existing capabilities, retain owner-backed work records and schedule bounded work. None substitutes for runtime approval or independent audit custody. |
+
+“One PDP” means **one decision-owning engine and contract**, not one global process. Access Engine deliberately uses consumer-specific deployment pins. Consolidating all pins into a shared availability and trust domain without measurements would weaken the current isolation design. The `flex-auth` name persists in runtime audiences and endpoints during the source rename; that is migration compatibility, not another decision engine.
+
+```mermaid
+flowchart LR
+    I[KeyCape identity and assurance] --> P[Consumer enforcement point]
+    F[User tenant zone and maturity facts] --> D[Access Engine decision]
+    H[Human via Informed Decision] --> A[Approval Engine bound approval]
+    A --> D
+    P --> D
+    D --> P
+    P --> C[Consume required approval]
+    C --> N[Native target identity or scoped credential lifecycle]
+    N --> S[Secrets Engine and OpenBao]
+    S --> T[Exact protected operation]
+    P --> E[Durable source emission]
+    T --> E
+    E --> U[Audit Core custody and reconciliation]
+    U --> K[Posture and risk findings]
+    K --> R[Owner review and bounded improvement]
+    R --> H
+```
+
+The diagram is the composition contract, not an assertion that every connection has native acceptance. Direct native identity should avoid credential issuance where possible; it does not bypass the applicable authorization or evidence obligations.
+
+## Supported use cases
+
+“Available” identifies a bounded delivered surface with owner evidence. “Partial” means useful components exist while the integrated outcome retains named gates. “Reference” means local planning or validation, without a live enforcement claim.
+
+| ID | Actor and outcome | Support today | Composition and decisive limit |
+| --- | --- | --- | --- |
+| U01 | Architect composes a new service's security model | Available for contracts and reference planning | NetKingdom conformance, scenario composer, case types, Gate House and reuse-surface. Provider selection and trust ordering are deterministic; execution remains explicitly disabled in the composer. |
+| U02 | Human signs in, steps up MFA and manages account/factor recovery | Available sign-in; partial recovery and automated browser access | KeyCape + User Engine + relying-party enforcement. Real-factor recovery acceptance remains KEY-WP-0040/U08. Rapp Playwright has a deployed pilot, but human/agent self-service identity and connectivity are pending. |
+| U03 | Application applies tenant-aware, resource-specific access | Available components; partial uniform enforcement | KeyCape/User/Tenant facts → Access Engine → application PEP. Wrong tenant, stale claims, replay and unavailable dependencies must be tested per consumer. Offline zone reference cannot supply a live claim service. |
+| U04 | Approver authorizes an exact protected action once | Partial integrated journey | Informed Decision → Approval Engine claim → PDP decision → atomic consume → PEP effect. Approval service deployment exists; named PEP execution and exact native issuer/tenant acceptance remain APPROVAL-WP-0002 gates. |
+| U05 | Operator provisions and delivers a narrow workload credential | Available bounded legacy lanes; partial task-scoped path | Warden route → Mason structure → Secrets Engine lifecycle → OpenBao. CCR38 service login is identity-only. SECRETS-WP-0013 and platform entitlement acceptance still govern protected execution. |
+| U06 | Human or automation obtains SSH access and private connectivity | Available bounded paths | Warden certificates, host principal mapping and Bridge tunnel lifecycle. A tunnel or valid certificate does not establish application authorization. Operator-only MFA/login acts remain attended. |
+| U07 | Owner inventories credentials, rotates/revokes them and detects exposure | Partial lifecycle and estate coverage | Secrets Engine catalog + platform custody + owner consumer inventory + Repo Manager/Forge scanning. Rotation needs adoption and predecessor refusal, not merely a changed KV value. Import/mirror and detection-to-response gaps remain. |
+| U08 | Producer retains attributable security events and detects missing evidence | Available custody and local contracts; partial source coverage | Source outbox → Audit Core → cadence/heartbeat/reconciliation → telemetry/Guard. Independent arrival integrity cannot establish events a compromised source omitted. Sender and emission-class admission stay explicit. |
+| U09 | Maintainer improves posture from recurring evidence | Available assessment/proposal tools; partial closed loop | Posture Feedback, Maturity Engine, Guard, Risk Nexus, Activity Core and owner work records. Unassisted schedule, owner adoption and verified outcome feedback are not uniformly established. No adaptive component may grant new authority. |
+| U10 | Operator restores identity, roots or platform data | Available scoped procedures and some data restore evidence; partial estate recovery | Owner runbooks, encrypted custody, Rapp OpenBao/Postgres and independent recovery resources. Full root inventory, independent issuer bootstrap and estate-native recovery gates remain NK-WP-0049 and the close-down checklist. |
+| U11 | Coding agent performs a bounded attributable task | Available source/runtime pieces; partial privileged isolation | Glas + Sand-boxer + rein + supervision receipts. CUST-WP-0073/GLAS-WP-0012 do not yet establish this interactive agent's enforced credential separation or autopilot. |
+| U12 | Developer builds and publishes with source and dependency controls | Available components; partial supply-chain boundary | Forge + Repo Manager + SBOM Nexus + Enablement + Apps. Hosted runners remain a privileged shared boundary; scanning, required checks, artifact provenance and per-job credentials have different coverage. |
+| U13 | Platform owner deploys, observes and rolls back a security workload | Available owner/package paths | Infra → Cluster → Platform → rail/rapp/reef bindings. Current single-node and headroom limits affect availability and rollout; a package declaration alone proves no consumer acceptance. |
+| U14 | Adopter builds a security framework from reusable parts | Available contracts/tools; partial portable product | Start with the profile below and independently validate each adapter. There is no proven estate-independent one-command distribution or measured second installation. |
+
+Use-case mapping is many-to-many in the inventory and registry entries. A listed supporting capability inherits neither the whole journey's maturity nor its authorization.
+
+## Maturity estimate
+
+This review uses a local operational scale: **M1 described**, **M2 implemented/reference**, **M3 repeatedly operated for a bounded scope**, **M4 measured integrated operation with lifecycle/failure coverage**, **M5 improvement validated across repeated cycles**. These are estimates, not certification or NIST tiers. NIST distinguishes CSF implementation tiers from maturity levels. [NIST guidance](https://www.nist.gov/cyberframework/cybersecurity-framework-faqs-framework-components).
+
+The separate reuse-surface **D/A/C/R vector** means discovery, availability form, consumer completeness and consumer reliability. A0 can be the correct destination for a standard; A4 API availability does not imply mature operations. Existing C/R claims are retained as owner assessments where present, not independently recertified. New entries use conservative C1/R0 until consumer evidence supports more. See the [registry maturity standard](../../reuse-surface/specs/CapabilityMaturityStandard.md).
+
+| Dimension | Estimate | Basis and evidence needed to advance |
+| --- | --- | --- |
+| Responsibility model and governance | M3; medium-high confidence | Accepted layer model and concrete owner boundaries, with explicit exceptions. Advance through continuously checked implementation/standard correspondence and bounded exception retirement. |
+| Individual identity/PDP/custody components | M3 for bounded operated paths; medium confidence | Working source and dated deployments/consumer receipts. Uniform negative tests, key rotation, outages and revocation evidence are needed for M4. |
+| End-to-end privileged authorization | M2; high confidence in the limit | Approval, PDP provenance and task-bound execution gaps remain named owner work. A complete protected operation with denial, replay, expiry, failure and recovery proof is the gate. |
+| Detection, audit and response | M2 overall; some custody/scanner paths M3 | Native scanner expansion and audit service exist; source emission completeness, import paths and private response handling remain incomplete. |
+| Recovery and resilience | M2 overall; scoped database/package recovery M3 | Restore procedures and selected proofs exist; independent root recovery and estate-wide loss scenarios remain unproven. Single-node risk is explicitly accepted for build mode. |
+| Agent authority and isolation | M2; medium-high confidence | Supervised record and source isolation mechanisms exist; the active assignment has no verified runtime isolation or autopilot grant. |
+| Reuse as an independent framework | M2; medium confidence | Useful APIs, contracts and local tools; heterogeneous packaging, stale metadata and estate coupling prevent an M3 portability claim. |
+| Self-optimization | M2; high confidence in the limit | Deterministic findings and proposals exist; regular native collection, authorized change, verified improvement and rollback do not form a uniformly accepted loop. |
+
+**Overall: M2 integration stage, with several M3 components.** The weakest mandatory trust boundary limits the integrated claim; averaging component scores would hide it. There is no defensible percentage “complete” or forecast incident rate from the available evidence. The SEC-DSM ledger records **116 numbered entries: 20 anti-pattern references, 12 incomplete assessments and 84 unverified entries, with none marked conformant**. This is assessment coverage, not a claim that 84 controls are absent. [Requirement ledger](evidence/2026-10-12-netkingdom-security/sec-dsm-requirement-ledger.json).
+
+## SWOT
+
+| | Assessment |
+| --- | --- |
+| **Strengths** | Clear single-owner boundaries for decisions, approvals, identity, custody and audit. Deterministic composition and proposal-only feedback tools. Explicit exceptions and source/native proof separation. Working identity, policy, audit, platform and operational access components. Repo-native evidence and existing discovery/coordination infrastructure reduce the need for new services. |
+| **Weaknesses** | Interface acceptance lags component delivery. Stale SCOPE/registry descriptions can direct consumers incorrectly: Secrets Engine still describes a missing approval endpoint while Approval Engine records deployment and consumer-specific acceptance gates. Several capabilities were invisible or malformed in reuse-surface. Runtime/source renames and split package ownership add discovery friction. The package family check fails because the `rapp-forgejo` placeholder has no family declaration; the telemetry package itself renders successfully. Credential recovery, adoption-tested rotation, agent isolation and source completeness retain gaps. |
+| **Opportunities** | Publish a versioned minimal profile, reusable conformance suite and provider adapters. Measure one complete protected-operation path and one second installation. Connect current posture and maturity tools to existing scheduling/work records with verified outcome feedback. Make capability discovery describe exact interfaces and limits, so consumers can reuse a small subset rather than reproduce the estate. |
+| **Threats** | A forged or stale decision reaching an incompletely verifying PEP; confused actor/principal/tenant bindings; privileged tools outside agent isolation; runner or repository-write authority reaching credentials; omitted source events; bootstrap/recovery roots depending on the failed issuer; operator bottlenecks and single-node failure; documentation or build-mode exceptions being mistaken for production acceptance. |
+
+## Ranked improvements
+
+Rank reflects **risk reduction first, shared dependency removal second, then reuse benefit per implementation effort**. The order is an engineering judgment, not a calculated ROI. Effort bands are planning estimates for a focused engineer with available owner inputs: **S 1–3 days, M 4–10 days, L 2–6 weeks**. Attended windows and cross-owner review can add calendar time. These are suggestions; they do not authorize production changes or promote deferred residuals.
+
+| Rank | Improvement and owner | Benefit and effort | Dependency and acceptance criterion |
+| --- | --- | --- | --- |
+| **1** | Authenticate PDP decisions at every enforcing consumer. Access Engine + Secrets Engine, then each PEP. | Removes a trust gap shared by all privileged reuse. **M**, high risk reduction and reuse value. | SECRETS-WP-0014; independently admitted verification keys or authenticated channel, exact request/lifetime binding. Refuse forged/unsigned/unknown-key responses and prove key rotation and outage behavior in the native path. |
+| **2** | Finish one exact approval-to-effect integration and make it the executable reference. Approval Engine + Secrets Engine + KeyCape + Platform. | Removes the largest integration uncertainty and repeated owner negotiation. **L**, high operational/reuse value. | APPROVAL-WP-0002, SECRETS-WP-0013, RPF-WP-0035-T12. Prove claim/check/consume-before-effect, distinct identities, tenant binding, expiry/replay refusal, uncertain-outcome reconciliation, cleanup and independent evidence. |
+| **3** | Enforce agent and runner credential boundaries. Glas/Sand-boxer/rein owners, Platform and Forge. | Bounds exposure from a tool or job compromise. **L**, high risk reduction. | CUST-WP-0073/GLAS-WP-0012 and FORGE-WP-0006. Test real read denial for admin material, task-specific identity, constrained delegated action, teardown/revocation and repository-controlled workflow abuse. Preserve founder-deferred rotation decisions. |
+| **4** | Complete inventory and credential lifecycle evidence. Secrets Engine + Platform + consumer owners. | Eliminates unknown consumers and manual rotation ambiguity. **M–L**, high risk reduction and operational efficiency. | Reuse existing catalog, CCRs and G04/G09/G12 owner work. Every credential has owner, consumers, scope, delivery, expiry/rotation, revocation and elimination trigger; sample rotation proves new adoption and old refusal. |
+| **5** | Close detection-to-response and non-receive coverage. Repo Manager + Forge + Risk Nexus/credential owner. | Converts preventive scans into a usable incident workflow. **M**, high operational value. | RMGR-WP-0021/FORGE-WP-0006. Reconcile exact repository denominator, imports/mirrors/history and mandatory CI; deliver a private synthetic finding through triage, owner action and retained resolution without content disclosure. |
+| **6** | Complete independent recovery and exception retirement. Platform + NetKingdom + Infra + package owners. | Reduces correlated issuer/cluster loss and operator dependence. **L**, high resilience value. | NK-WP-0049, G11 and close-down checklist. Inventory roots; prove isolated restore without the failed issuer, consumer reconnect, audit continuity and ordinary custody restoration; give each exception a review/elimination trigger. |
+| **7** | Package the proven interfaces as a minimal framework profile and conformance kit. NetKingdom + provider owners + Railiance Master. | Largest direct reduction in framework adoption cost. **M** after ranks 1–2; high reuse value. | Reuse existing case/composer/validator tools. Pin contract and provider versions; test a second clean installation and publish a compatibility matrix, positive/negative journeys, upgrade and rollback instructions. |
+| **8** | Make discovery continuously truthful. Reuse Surface + Repo Manager + each owner. | Removes repeated rediscovery and incorrect integration plans. **S–M**, broad efficiency gain. | This review establishes the capability denominator. Require valid owner entries, exact index/entry parity, resolvable relations, drift/freshness checks, valid package-family declarations (including a disposition for rapp-forgejo) and hosted round-trip discovery; fix stale endpoint and runtime-name claims at their source. |
+| **9** | Admit security event sources and measure missing evidence. Audit Core + Approval/Tenant/Secrets owners + Telemetry. | Gives optimization trustworthy inputs and reveals silent controls. **M**, prerequisite for measured improvement. | Existing outbox/cadence work. Verify source transition → durable outbox → receiver → independent readback; include lag, duplicates, downtime, rare-event heartbeats and revocation of sender access. |
+| **10** | Close the existing improvement loop with outcome verification. NetKingdom + Guard + Maturity + Activity Core + coordination owners. | Reduces manual follow-up and prevents recurring findings. **M** after rank 9. | CUST-WP-0079 cadence and owner contracts. First unassisted observation → deduplicated finding → ranked owner work → approved change → native remeasurement → retained result; failure retains finding and rollback. |
+| **11** | Standardize consumer adapters and error/evidence contracts. Access/Approval/Secrets owners with NetKingdom. | Reduces per-consumer binding, retry, freshness and transport bugs. **M**, high reuse value. | Extract only behavior proven by ranks 1–2 into a small SDK/contract test kit. Preserve owner authority, no embedded second PDP; demonstrate two consumers and version compatibility. |
+| **12** | Optimize operational cost from measurements. Resource Control + Fin Hub + Platform + Telemetry. | Avoids unnecessary service hops, replicas and deploy-per-lane work. **S** measurement then **M** changes. | Measure p50/p95 decision and protected-operation latency, approval touches, queue age, replica cost, headroom and failure rates. Batch compatible owner work and prefer native identity; retain security invariants and demonstrate improvement against a baseline. |
+
+Ranks 1–6 establish trustworthy operations. Registry cleanup can proceed alongside them because it is low risk. Ranks 7 and 11 should package the accepted reference, while ranks 9–10 make improvement measurable. These recommendations reference existing owner work instead of creating another parallel security backlog.
+
+## Reusable framework shape
+
+A first adopter should choose a small profile from the inventory:
+
+1. **Contracts and offline verification:** SecurityCanon practice, NetKingdom IAM/layer/case contracts, conformance validators and scenario composer. This is useful today even when using different runtime providers.
+2. **Application access:** an IAM-profile-compatible identity provider, Access Engine and a consumer enforcement adapter; add User/Tenant facts only where the application needs them. Do not require the offline Zone Engine as a service dependency.
+3. **Privileged operations:** Approval Engine and a proven consume-before-effect adapter; use Secrets Engine/OpenBao only when target-native identity is insufficient. Warden/Bridge/Mason apply when operational access or structure construction is needed.
+4. **Evidence and operations:** source outbox and Audit Core, then owner-specific rollout/recovery contracts. Railiance is the current reference substrate; its hostnames, local tunnels and admin procedures should be configuration/adapters, not framework requirements.
+5. **Improvement:** posture feedback, Guard/Maturity claims and existing work scheduling. Add learning only after stable source provenance and native outcome measurement.
+
+Stable reuse surfaces should be schemas, versioned request/claim/decision/receipt contracts, package entry points, fixtures and provider adapters. No new umbrella broker is needed. A framework distribution should publish its dependency lock, supported versions, migration rules, sample consumer and explicit unsupported scenarios. Commercial licensing and redistribution rights need their own artifact-by-artifact review before an external distribution; this assessment establishes technical reuse, not a blanket redistribution grant.
+
+## Optimization measurements
+
+| Outcome | Measure and owner | Comparison that would demonstrate improvement |
+| --- | --- | --- |
+| Faster onboarding | Time and human touches from accepted case to natively verified consumer; Warden/Mason/Platform | Same case class before/after templates, with negative tests unchanged |
+| Lower execution overhead | Policy and complete protected-operation latency, failure rate and issuer calls; PEP/Access/Secrets | Representative p50/p95 and throughput under the same authority and failure requirements |
+| Lower recurring work | Reopened/duplicate findings, overdue owner work and manual handoffs; Guard/Activity/State Hub | Repeat observation windows with stable source denominator |
+| Better security coverage | Credentials, PEPs, repositories and event classes with complete evidence divided by explicitly inventoried totals | Unknowns reported separately; no denominator shrink to improve a score |
+| Cheaper operation | Resource requests versus measured demand, recovery storage and operator effort; Resource Control/Fin Hub | Native capacity/recovery checks and error rate remain within the agreed bounds |
+| Better reuse | Successful second installation, time to integrate, adapter-specific code and upgrade failures; NetKingdom/Reuse Surface | Independent consumer acceptance against pinned contracts |
+
+A useful automatic loop observes and proposes. Any actuation still passes existing authority, cost/risk, approval and rollback controls. A maturity score, performance lesson or optimization target must never manufacture a permission.
+
+## Capability establishment status
+
+**Owner registries and local reuse-surface discovery are established; hosted establishment remains incomplete.** All 70 reviewed capabilities validate and occur exactly once in the composed local federation. The normal `plan-check` command finds Approval Engine for bound approval consumption and NetKingdom Posture Feedback for evidence expiry. The default local federation preserves unrelated sources: 99 source registrations compose 114 total capabilities without warnings. [Local verification](assessments/netkingdom-2026-10-14/verification-local.json), [normal CLI discovery](assessments/netkingdom-2026-10-14/local-discovery-receipt.json).
+
+All 60 owner repositories have published registry-only commits with verified remote revisions. Valid stable IDs were preserved, missing entries added, the copied Secrets Engine template entry removed, malformed metadata normalized and concrete use cases and relations established. Existing unrelated staging was preserved. Maturity Engine had an unrelated unpublished local commit; its registry publication used a separate checkout based on the remote head and left that local commit untouched. [Publication receipts](assessments/netkingdom-2026-10-14/registry-publication.json), [additional providers](assessments/netkingdom-2026-10-14/supplement/registry-publication.json).
+
+The hosted hub currently exposes **32 of 70** reviewed capabilities after a fresh composition. **38 owner registrations remain:** 31 public indexes are ready; seven package indexes return 404 anonymously and need admitted private-source reading. The normal `reuse-surface-hub-write-token` Warden path received a PDP decision but OpenBao denied the current caller with **HTTP 403**. No registration helper ran and no hub write occurred. Repository visibility and credential policy were left intact. [Hosted readback and denial](assessments/netkingdom-2026-10-14/hosted-verification.json), [exact registration plan](assessments/netkingdom-2026-10-14/hub-registration-plan.json), [private-source gates](assessments/netkingdom-2026-10-14/hub-private-source-pending.json).
+
+Verification also passed 23 local scenario/posture tests, 11 User Engine package tests, nine policy-package tests and Helm lint. The telemetry package rendered 93 resources successfully; its estate family check failed on the pre-existing `rapp-forgejo` declaration gap. Source hashes and report links were checked. These results establish the documentation and registry work, not native security conformance. [Check receipt](assessments/netkingdom-2026-10-14/source-test-receipt.json), [source integrity](assessments/netkingdom-2026-10-14/review-integrity.json).
diff --git a/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
new file mode 100644
index 00000000..a1174fc2
--- /dev/null
+++ b/workplans/CUST-WP-0081-netkingdom-architecture-review-and-reuse.md
@@ -0,0 +1,68 @@
+---
+id: CUST-WP-0081
+type: workplan
+title: "Review NetKingdom architecture and establish security reuse capabilities"
+domain: infotech
+repo: the-custodian
+status: active
+owner: codex
+topic_slug: custodian
+created: "2026-10-14"
+updated: "2026-10-14"
+flavor: planning
+depends_on: []
+state_hub_workstream_id: "e8992815-389a-5c40-8569-a2b0ee3945f0"
+---
+
+User-requested repository/capability/use-case inventory, SWOT, maturity estimate,
+ranked architecture efficiency and framework reuse recommendations, and actual
+reuse-surface establishment. CUST-WP-0080 retains security defect implementation
+and native acceptance; this assessment does not close those gaps or promote
+residual implementation work.
+
+## Establish the evidence and complete the architecture review
+
+```task
+id: CUST-WP-0081-T01
+status: done
+priority: high
+state_hub_task_id: "73c92cb6-cf82-5c86-ada1-9b9f8e637127"
+```
+
+Inspect owner sources, current workplans, implementation interfaces and existing
+receipts. Record an explicit inclusion boundary, repo revisions and source hashes.
+Deliver a repository/capability inventory, supported and conditional use cases,
+SWOT, justified maturity estimates and ranked improvements with owner, benefit,
+effort, dependency and acceptance evidence.
+
+Delivered `docs/netkingdom-security-architecture-review.md` and the linked inventory: 60 capability-owning repos, 70 capability boundaries, 14 use cases and two inspected nonproviders. Includes SWOT, separate operational/reuse maturity estimates and 12 ranked improvements. Source hashes and report links pass. Existing native security gaps remain with CUST-WP-0080 and owner plans.
+
+## Establish all reviewed capabilities through reuse-surface
+
+```task
+id: CUST-WP-0081-T02
+status: progress
+priority: high
+state_hub_task_id: "80b037cd-876d-53c2-9272-b1dfe0524446"
+```
+
+Retain valid owner capability IDs; repair misleading metadata and add missing
+bounded capabilities with consumer guidance and relations. Validate owner
+registries and compose a deterministic federation with no missing reviewed IDs.
+Verify publication and hosted discovery separately; local establishment alone
+does not prove hosted federation. Preserve unrelated worktree changes.
+
+2026-10-14: 70 owner capability entries established across 60 repositories. All source registry commits published and exact remote heads verified. Native local federation and normal plan-check discover all 70; existing unrelated sources retained. Hosted federation exposes 32/70. Thirty-eight registrations remain (31 public, seven private sources). Warden routed the write lane, but OpenBao denied caller access with 403; no helper/hub writes occurred. Private-source credentials/metadata disclosure require owner admission. User selected "Arrange scoped owner access"; provisioning remains unverified. The scoped-access-handoff.json records the exact owner requirements without secret values. Exact plan, denial and verification evidence are in the assessment directory.
+
+## Audit coverage and record the result
+
+```task
+id: CUST-WP-0081-T03
+status: progress
+priority: high
+state_hub_task_id: "9bccb18e-0501-5319-a18c-f1fb36312cb7"
+```
+
+Check every inventory capability against its source, use cases, maturity and
+registry entry. Verify actual federation coverage and report any unresolved
+publication gate. Log progress and run statehub fix-consistency.