From cec1f5be1c0eb23b2a8cdce4d8ad084571b40c73 Mon Sep 17 00:00:00 2001 From: codex Date: Sun, 1 Nov 2026 22:35:53 +0100 Subject: [PATCH] docs: preserve reviewed NetKingdom session artifacts --- .../attended-custody-login-failure-r1.json | 30 + .../attended-custody-login-failure-r2.json | 49 + ...-private-registration-owner-review-r1.json | 35 + .../attended_private_registration.py | 245 ++ ...te-registration-order-owner-review-r2.json | 29 + ...-private-registration-owner-review-r1.json | 42 + ...ttended-public-registration-receipts.jsonl | 2 + ...attended-reader-custody-wait-audit-r1.json | 30 + .../attended_public_registration.py | 158 + .../hardened-reader-local-image-r1.json | 61 + .../hosted-after-hardened-phase-a.json | 3023 +++++++++++++++++ .../hosted-after-owner-consent.json | 3023 +++++++++++++++++ .../hosted-after-public-registration.json | 3023 +++++++++++++++++ .../hosted-before-federated.json | 608 +++- .../hosted-owner-consent-verification.json | 17 + .../hosted-post-all-clear-check.json | 108 + ...b-private-registration-preparation-r1.json | 155 + .../hub-private-registration-r1.lock | 0 .../hub-private-source-pending.json | 9 +- .../hub-public-resume-receipts.jsonl | 125 + ...ive-authenticated-source-inventory-r1.json | 14 + .../live-native-federation-source-r1.json | 8 + ...oidc-diagnostic-finding-correction-r1.json | 11 + .../owner-access-gate.json | 6 +- .../active-phase-a-source-declaration-r1.json | 23 + .../exact-execution-proposal-r1.json | 53 + .../helm-recovery-revision-r1.json | 49 + .../semantic-diff-r1.json | 53 + .../server-preflight-r1.json | 110 + .../source-publication-r3.json | 25 + .../apps-owner-phase-b-review.md | 53 + .../command-parser-check-r2.json | 13 + .../eso-preflight-r1.json | 31 + .../apps-phase-b-current/manifest.json | 18 + .../native-proof-wrapper-local-checks-r1.json | 15 + .../native_runtime_proof_stdin.py | 38 + .../phase-b-execution-proposal-r1.json | 88 + .../phase-b-preparation.patch | 283 ++ .../apps-phase-b-current/run_eso_preflight.py | 30 + .../apps-phase-b-publication-r2.json | 18 + .../reuse-surface/templates/_helpers.tpl | 56 + .../reuse-surface/templates/deployment.yaml | 87 + .../charts/reuse-surface/values.schema.json | 30 + .../files/charts/reuse-surface/values.yaml | 106 + .../reuse_authenticated_source_inventory.py | 61 + ...PS-WP-0017-reuse-private-reader-release.md | 57 + .../review/apps-chart-preparation-r1.patch | 615 ++++ .../publication-preflight.json | 254 +- .../published-source-verification.json | 2 +- .../scoped-access-handoff.json | 18 +- 50 files changed, 12696 insertions(+), 301 deletions(-) create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended-private-registration-owner-review-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended_private_registration.py create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-private-registration-order-owner-review-r2.json create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-private-registration-owner-review-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-public-registration-receipts.jsonl create mode 100644 docs/assessments/netkingdom-2026-10-14/attended-reader-custody-wait-audit-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/attended_public_registration.py create mode 100644 docs/assessments/netkingdom-2026-10-14/hardened-reader-local-image-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-after-hardened-phase-a.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-after-owner-consent.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-after-public-registration.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-owner-consent-verification.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hosted-post-all-clear-check.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-private-registration-preparation-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-private-registration-r1.lock create mode 100644 docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl create mode 100644 docs/assessments/netkingdom-2026-10-14/live-authenticated-source-inventory-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/live-native-federation-source-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/oidc-diagnostic-finding-correction-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/exact-execution-proposal-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/helm-recovery-revision-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/semantic-diff-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/server-preflight-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/source-publication-r3.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/apps-owner-phase-b-review.md create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/command-parser-check-r2.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/eso-preflight-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/manifest.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native-proof-wrapper-local-checks-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native_runtime_proof_stdin.py create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-execution-proposal-r1.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-preparation.patch create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/run_eso_preflight.py create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-publication-r2.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/_helpers.tpl create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/deployment.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.schema.json create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.yaml create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/scripts/reuse_authenticated_source_inventory.py create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/workplans/RAPPS-WP-0017-reuse-private-reader-release.md create mode 100644 docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/review/apps-chart-preparation-r1.patch diff --git a/docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json b/docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json new file mode 100644 index 00000000..0d70fdf7 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r1.json @@ -0,0 +1,30 @@ +{ + "id": "CUST81-ATTENDED-CUSTODY-LOGIN-FAILURE-R1", + "observed_at": "2026-10-15T02:11:21.901965+00:00", + "source": "founder user_shell_command result", + "command": "run_attended_reader_custody_r1.sh", + "exit_code": 10, + "duration_seconds": 121.2892, + "outcome": "login_failed_closed_before_command_handoff", + "reason": "login client produced non-allowlisted output", + "possible_session_contained": true, + "revocation_confirmed": false, + "provisioning_handoff_executed": false, + "raw_login_output_requested": false, + "approval_remains_valid": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e", + "resumed_blocked_audit": "fresh; transport diagnosis now active", + "cust81-policy-custody-r1.jsonl": { + "exists": false, + "bytes": 0 + }, + "cust81-forge-reader-r1.jsonl": { + "exists": false, + "bytes": 0 + }, + "browser_evidence": "Two freshprofiles initialized; founder allseemedfine", + "source_correction": "Globalformatpre-scan honors trailingformat; ordering isdefensive, notprovenfunctionalbug", + "confirmed_dependency_gap": "Fallbackrecoveryregex omittedestate s. tokens; narrowownerfixunder84focusedtests", + "failure_cause": "unproven; existingcapturedloginbytesdiscarded", + "server_correlation": "owner-assembly/oidc-owner-correlation-summary-r1.json", + "correction_receipt": "oidc-diagnostic-finding-correction-r1.json" +} diff --git a/docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json b/docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json new file mode 100644 index 00000000..b60d5615 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-custody-login-failure-r2.json @@ -0,0 +1,49 @@ +{ + "id": "CUST81-ATTENDED-CUSTODY-LOGIN-FAILURE-R2", + "observed_at": "2026-10-15T02:47:57.569767+00:00", + "source": "founder user_shell_command result", + "command": "run_attended_reader_custody_r1.sh", + "exit_code": 10, + "duration_seconds": 121.1726, + "category": "callback_timeout", + "client_exit": 2, + "helper_present": false, + "stdout_allowed": true, + "stderr_allowed": false, + "outcome": "login_failed_closed_before_command_handoff", + "provisioning_handoff_executed": false, + "revocation_confirmed": false, + "failure_scope": "Callback timeout before handoff; founder confirms actual login did not launch Firefox. Direct adapter.launch connectivity is proven; Bao-to-adapter entrypoint/parser/environment remains under diagnosis.", + "approval_remains_valid": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e", + "raw_login_output_requested": false, + "fresh_resumed_audit": true, + "owner_diagnosis": [ + "warden_browser_owner", + "platform_reader_owner" + ], + "credential_free_probe": { + "sandbox_powershell": "WSL interop socket denied; not network evidence", + "elevated_windows_http": "Exact Go listener localhost binds127.0.0.1; Windows no-proxy requests to localhost and127.0.0.1 both204/fixedheader verified; IPv6 connection fails as expected for IPv4-only listener. Default callback path generally reachable; no listen-host repair justified.", + "matrix_receipt": "owner-assembly/cust81-windows-go-loopback-matrix-r1.json", + "firefox_r1": "Probe unavailable before GUI; concurrent port use observed. Retained failure, not browser reachability evidence.", + "firefox_r2": { + "status": "browser_reached_listener", + "expected_request_count": 1, + "firefox_launch_returned": true, + "receipt": "owner-assembly/cust81-firefox-loopback-probe-r2-receipt.json" + } + }, + "next_action": "Determine whether founder command ran through Codex ! sandbox or separate WSL terminal; actual URL passes parser and elevated Firefox-to-WSL works, while sandbox Windowsinterop fails. Convenience wrapper now fixedPowerShell exit0 preflight before anyOIDC, exit78 if unavailable.", + "founder_clarification": { + "observed_at": "2026-10-15T02:59:15.427688+00:00", + "latest_actual_failed_login": "No new Firefox window opened", + "harmless_diagnostic": "Firefox opened blank http://localhost:8250/cust81-loopback-probe-r1 and exactly1 request verified" + }, + "authorization_url_shape": { + "receipt": "owner-assembly/cust81-auth-url-shape-observation-r1.json", + "parser_accepted": true, + "raw_url_retained": false, + "oidc_login_executed": false + }, + "shell_isolation_hypothesis": "Strong lead, not confirmed for founder execution yet" +} diff --git a/docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended-private-registration-owner-review-r1.json b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended-private-registration-owner-review-r1.json new file mode 100644 index 00000000..1c69e3f3 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended-private-registration-owner-review-r1.json @@ -0,0 +1,35 @@ +{ + "id": "CUST81-WARDEN-PRIVATE-WRITER-TRANSPORT-REVIEW-R1", + "revision": 1, + "status": "approved_preparation_integration_only", + "reviewer": "ops-warden-owner (codex worker)", + "authority_basis": "Explicit user worker delegation; CUST-WP-0081-T02 sanctioned writer route preparation. No autonomous grant or credential/live approval.", + "reviewed_at": "2026-10-14T23:57:51.993236+00:00", + "files": { + "attended_private_registration.py": "279cc07bc5a89dccf21b5ae1f89683319560a692f99119a7a6320776f0a87cf9", + "test_attended_private_registration.py": "496319822fe3621b47f8077af67f54b91b405fbdbaf99da3999248a8b5ae7e14", + "register_private_hub_r1.py": "31058fdc9257ce7f15f7cd273dfab1a0c856bb37e1f90bc6ef3a112eb1de163d", + "hub-private-registration-plan-r1.json": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7" + }, + "mason_contract_sha256": "43f80ce86dbc32fcdb9f67d479f43077094ace66a618bde68ed858aa2f3e6e12", + "browser_adapter_sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96", + "tests_passed": 11, + "no_gui_login_or_credentials": true, + "live_approval_required": true, + "founder_identity_act": "Dedicated member OIDC/MFA after actual hardened rollout and native proofs; writer privileges verified in-memory before Warden route.", + "containment": [ + "Token-only and explicit no-store; existing ambient BAO/VAULT/writer credentials removed", + "Exact policy/entity TTL scope; no admin-role fallback", + "Original helper/plan plus exact approval/current rollout/native proof gates before login and after OIDC", + "Fresh isolated Windows Firefox private profile; output-silent browser adapter", + "Warden output/error bytes captured and discarded; no raw error strings in receipts", + "Self-revoke on successful/failed sole-token login, wrong caller, proof rejection, child failure; failed revocation overrides success", + "Caller-owned regular no-follow0600 fsynced append journal" + ], + "limits": [ + "Offline tests only; actual GUI/callback connectivity unverified", + "Ambiguous multiple login-token output refuses writer and cannot identify a sole token for self-revocation; outcome fails closed and requires owner investigation", + "Close dedicated Firefox after attended operation; task-specific profile remains in Windows temp", + "Fresh rollout/native proofs have a 600-second gate; obtain them immediately before attended writer login" + ] +} diff --git a/docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended_private_registration.py b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended_private_registration.py new file mode 100644 index 00000000..3a278ed6 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-before-oci-membership/attended_private_registration.py @@ -0,0 +1,245 @@ +"""Attend the dedicated writer role, register seven approved sources, self-revoke. + +No token persistence, raw child/error output, admin authority or browser reuse. +Preapproval and fresh actual-runtime proofs must pass before any login attempt. +""" +from pathlib import Path +import argparse +import hashlib +import importlib.util +import json +import os +import stat +import subprocess +import sys +import tempfile +import threading +import uuid +from datetime import datetime, timezone + +import yaml + +OUT = Path(__file__).resolve().parent +ROLE = 'reuse-surface-hub-writer-workload-kv-read' +POLICY = 'workload-kv-read-reuse-surface-runtime' +ENTITY = 'c204099b-cb94-363f-e207-5ff4d4aa6e94' +HASHES = { + 'register_private_hub_r1.py': '31058fdc9257ce7f15f7cd273dfab1a0c856bb37e1f90bc6ef3a112eb1de163d', + 'hub-private-registration-plan-r1.json': 'ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7', +} +MASON = Path('/home/worsch/ops-mason/src/ops_mason/attended_login.py') +MASON_SHA = '43f80ce86dbc32fcdb9f67d479f43077094ace66a618bde68ed858aa2f3e6e12' +BROWSER = OUT / 'warden-browser-opener-r1' / 'cmd.exe' +BROWSER_SHA = '4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96' +MAX_BYTES = 65536 + + +def module(path, name, expected): + if hashlib.sha256(path.read_bytes()).hexdigest() != expected: + raise ValueError('reviewed_input_changed') + spec = importlib.util.spec_from_file_location(name, path) + if spec is None: + from importlib.machinery import SourceFileLoader + spec = importlib.util.spec_from_loader(name, SourceFileLoader(name, str(path))) + result = importlib.util.module_from_spec(spec) + spec.loader.exec_module(result) + return result + + +def prepare(args): + for name, expected in HASHES.items(): + if hashlib.sha256((OUT / name).read_bytes()).hexdigest() != expected: + raise ValueError('reviewed_input_changed') + helper = module(OUT / 'register_private_hub_r1.py', 'cust81_private_helper', HASHES['register_private_hub_r1.py']) + paths = [OUT / 'register_private_hub_r1.py', helper.PLAN, helper.PUBLIC, + helper.DISCLOSURE, helper.CONSENT, args.rollout_proof, args.native_proof] + helper.public_tools() + helper.gates(helper.load(helper.PLAN), helper.load(args.approval), + helper.load(args.rollout_proof), helper.load(args.native_proof), paths) + if not args.kubeconfig.is_file(): + raise ValueError('kubeconfig_unavailable') + mason = module(MASON, 'cust81_mason_attended_contract', MASON_SHA) + browser = module(BROWSER, 'cust81_private_browser_adapter', BROWSER_SHA) + return helper, mason, browser + + +def append(path, event): + fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_APPEND | os.O_NOFOLLOW, 0o600) + try: + info = os.fstat(fd) + if (not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid() + or stat.S_IMODE(info.st_mode) != 0o600): + raise ValueError('journal_custody') + data = memoryview((json.dumps(event, sort_keys=True) + '\n').encode()) + while data: + count = os.write(fd, data) + if not count: + raise OSError('journal_write') + data = data[count:] + os.fsync(fd) + finally: + os.close(fd) + + +def verify_caller(raw): + if len(raw) > MAX_BYTES: + raise ValueError('lookup_size') + data = json.loads(raw)['data'] + ttl = data.get('ttl') + if (data.get('policies') != [POLICY] or data.get('identity_policies') not in (None, []) + or data.get('entity_id') != ENTITY or type(ttl) is not int + or not 0 < ttl <= 1800): + raise ValueError('scoped_caller_mismatch') + + +def extract_token(raw, matcher): + # Extract for self-revocation even if surrounding login output is invalid. + if len(raw) > MAX_BYTES: + return '' + found = matcher.findall(raw) + return found[0] if len(found) == 1 else '' + + +def child_args(args): + return ['warden', 'access', 'reuse-surface-hub-write-token', '--exec', '--field', + 'REUSE_SURFACE_TOKEN', '--', 'python3', str(OUT / 'register_private_hub_r1.py'), + '--apply', '--approval', str(args.approval), '--rollout-proof', str(args.rollout_proof), + '--native-proof', str(args.native_proof), '--kubeconfig', str(args.kubeconfig)] + + +def execute(args, helper, mason, browser, record): + env = os.environ.copy() + for key in ('BAO_TOKEN', 'VAULT_TOKEN', 'BAO_LOG_LEVEL', 'VAULT_LOG_LEVEL', + 'BAO_LOG_FORMAT', 'VAULT_LOG_FORMAT', 'REUSE_SURFACE_TOKEN'): + env.pop(key, None) + env['BAO_ADDR'] = env['VAULT_ADDR'] = 'http://127.0.0.1:18200' + attempt = {'attempt_id': str(uuid.uuid4()), 'at': datetime.now(timezone.utc).isoformat(), + 'proposal_id': 'CUST81-PRIVATE-REGISTRATION-EXECUTION-R1', 'revision': 1, + 'approval_sha256': hashlib.sha256(args.approval.read_bytes()).hexdigest(), + 'login': False, 'warden_exit': None, 'revoked': None, 'outcome': 'started'} + record(attempt.copy()) # Establish durable audit before any login. + token = '' + result_code = 1 + proc = None + timer = None + with tempfile.TemporaryDirectory(prefix='cust81-private-warden-state-') as state: + config = yaml.safe_load(Path('/home/worsch/.config/warden/warden.yaml').read_text()) + if not isinstance(config, dict): + raise ValueError('warden_config_shape') + config['state_dir'] = state + config_path = Path(state) / 'warden.yaml' + fd = os.open(config_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600) + with os.fdopen(fd, 'w') as stream: + stream.write(yaml.safe_dump(config, sort_keys=False)) + stream.flush() + os.fsync(stream.fileno()) + env['WARDEN_CONFIG'] = str(config_path) + try: + # token-only does not store; explicit no-store guards helper persistence. + proc = subprocess.Popen(['bao', *mason.login_args('netkingdom', ROLE), '-no-store'], + env=env, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, + stderr=subprocess.PIPE, text=True) + timer = threading.Timer(150, proc.kill) + timer.start() + failures = [] + browser_opened = [] + def pump(): + while True: + line = proc.stderr.readline(MAX_BYTES + 1) + if not line: + break + if len(line) > MAX_BYTES: + failures.append('login_stream_size') + proc.kill() + break + kind = mason.classify_login_line(line) + if kind == 'url': + try: + if browser_opened: + raise ValueError('duplicate_browser_request') + browser_opened.append(True) + url = browser.parse_args('xdg-open', [line.strip()]) + browser.launch(url) + print('Firefox opened in a fresh private profile; complete member login and MFA.', flush=True) + except Exception: + failures.append('browser_unavailable') + proc.kill() + break + elif kind == 'error': + # Raw error text never reaches receipts, stdout or exceptions. + if not failures: + failures.append('login_error') + reader = threading.Thread(target=pump, daemon=True) + reader.start() + raw = proc.stdout.read(MAX_BYTES + 1).strip() + token = extract_token(raw, mason.TOKEN_RE) + if len(raw) > MAX_BYTES: + proc.kill() + proc.wait(timeout=155) + timer.cancel() + reader.join(timeout=5) + if proc.returncode or mason.TOKEN_RE.fullmatch(raw) is None or failures or reader.is_alive(): + attempt['outcome'] = 'login_refused' + else: + attempt['login'] = True + env['BAO_TOKEN'] = token + lookup = subprocess.run(['bao', 'token', 'lookup', '-format=json'], env=env, + capture_output=True, text=True, timeout=30) + if lookup.returncode: + raise ValueError('lookup_failed') + verify_caller(lookup.stdout) + attempt['entity_id'] = ENTITY + # Recheck proof freshness and exact artifact approval after OIDC. + paths = [OUT / 'register_private_hub_r1.py', helper.PLAN, helper.PUBLIC, + helper.DISCLOSURE, helper.CONSENT, args.rollout_proof, args.native_proof] + helper.gates(helper.load(helper.PLAN), helper.load(args.approval), + helper.load(args.rollout_proof), helper.load(args.native_proof), paths) + print('Dedicated caller verified; registering the seven approved sources.', flush=True) + result = subprocess.run(child_args(args), env=env, capture_output=True, timeout=600) + attempt['warden_exit'] = result.returncode + result_code = result.returncode + attempt['outcome'] = 'writer_returned' + except Exception: + attempt['outcome'] = 'stopped_inspect_receipts_before_retry' + result_code = 1 + finally: + if timer: + timer.cancel() + if proc and proc.poll() is None: + proc.kill() + proc.wait(timeout=10) + if token: + env['BAO_TOKEN'] = token + try: + revoked = subprocess.run(['bao', 'token', 'revoke', '-self'], env=env, + capture_output=True, timeout=30) + attempt['revoked'] = revoked.returncode == 0 + except Exception: + attempt['revoked'] = False + env.pop('BAO_TOKEN', None) + token = '' + if attempt['revoked'] is not True: + result_code = 1 + print('Scoped session revocation confirmed: ' + str(attempt['revoked']), flush=True) + attempt['finished_at'] = datetime.now(timezone.utc).isoformat() + record(attempt) + return result_code + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--apply', action='store_true', required=True) + for name in ('approval', 'rollout-proof', 'native-proof', 'kubeconfig'): + parser.add_argument('--' + name, type=Path, required=True) + args = parser.parse_args() + helper, mason, browser = prepare(args) + return execute(args, helper, mason, browser, + lambda event: append(OUT / 'attended-private-registration-receipts.jsonl', event)) + + +if __name__ == '__main__': + try: + sys.exit(main()) + except Exception: + print('Attended private registration refused; inspect bounded receipts.', file=sys.stderr) + sys.exit(1) diff --git a/docs/assessments/netkingdom-2026-10-14/attended-private-registration-order-owner-review-r2.json b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-order-owner-review-r2.json new file mode 100644 index 00000000..f9e5c97d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-order-owner-review-r2.json @@ -0,0 +1,29 @@ +{ + "id": "CUST81-WARDEN-PRIVATE-WRITER-TRANSPORT-ORDER-REVIEW-R2", + "reviewer": "ops-warden-owner (codex worker)", + "status": "approved_preparation_integration_only", + "reviewed_at": "2026-10-15T03:21:13.798940+00:00", + "amendment_sha256": "c8fa74ad6648af1c884a4c607e100097f917761af5d3a6e0c5e8ce9a53b809dc", + "original_approved_sha256": "56806b127b6a926361ef82c2b53732ef71fb385bcc0b918ae4e4d815015e6966", + "candidate_sha256": "1ec34b8cded859845dc29cedf55ff02fa4881bd4d6a3a264879efd5b3e706c88", + "exact_one_line_replacement_verified": true, + "retained": [ + "Explicit no-store now precedes all auth data", + "Existing token-only contract also implies no-store", + "Exact dedicated role/path and skip_browser=true", + "Exact policy/entity/TTL and no-identity-policies checks", + "External approval, pinned helper/plan and fresh runtime/native proof gates before and after OIDC", + "Captured-output suppression, no-follow0600 fsynced journal, in-memory token and finally self-revocation", + "No provisioning replay, credential/repo scope expansion or alternate writer route" + ], + "independent_checks": { + "transport_tests_passed": 11, + "registration_helper_tests_passed": 14, + "constructed_current_contract_all_flags_before_auth_data": true, + "amendment_hash_verified": true + }, + "proof_review": "Reviewed private-writer-cli-order-failure-r1.json: original trailing flag becomes malformed K=V before network; corrected closed-loopback probe reaches connection-refused. This worker did not rerun Bao/login.", + "prior_test_gap": "Original transport tests asserted flag presence but did not enforce flag order; they missed the pre-auth CLI parsing failure. The original approval and failed live outcome remain preserved.", + "live_execution_or_login_performed": false, + "founder_approval_still_required": true +} diff --git a/docs/assessments/netkingdom-2026-10-14/attended-private-registration-owner-review-r1.json b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-owner-review-r1.json new file mode 100644 index 00000000..db784a40 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-private-registration-owner-review-r1.json @@ -0,0 +1,42 @@ +{ + "id": "CUST81-WARDEN-PRIVATE-WRITER-TRANSPORT-REVIEW-R1", + "revision": 2, + "status": "approved_preparation_integration_only", + "reviewer": "ops-warden-owner (codex worker)", + "authority_basis": "Explicit user worker delegation; CUST-WP-0081-T02 sanctioned writer route preparation. No autonomous grant or credential/live approval.", + "reviewed_at": "2026-10-14T23:59:41.682862+00:00", + "files": { + "attended_private_registration.py": "56806b127b6a926361ef82c2b53732ef71fb385bcc0b918ae4e4d815015e6966", + "test_attended_private_registration.py": "fd3cc6f564e2e81f0a514233a20c4add45cbd580e4e624d52bda9eb40c6bb642", + "register_private_hub_r1.py": "de431eb2942d469eaad0e7e167ebfb98a717c6fa2a92b7cd987333d764792113", + "hub-private-registration-plan-r1.json": "ec0964addcc95a2f0509d70bb58c10006a3d00e1d2479d8678d3b7c6a15602b7", + "hardened-reader-image-publication-r1.json": "f4ba7eff3d34dd732876b6dbba619f8c901ce9c2519b6d660101330f935a6c14" + }, + "mason_contract_sha256": "43f80ce86dbc32fcdb9f67d479f43077094ace66a618bde68ed858aa2f3e6e12", + "browser_adapter_sha256": "4b91a4dc635e464143bfe1f484eccb2456ccd992326ac7a126b53d0a9a3c7f96", + "tests_passed": 11, + "no_gui_login_or_credentials": true, + "live_approval_required": true, + "founder_identity_act": "Dedicated member OIDC/MFA after actual hardened rollout and native proofs; writer privileges verified in-memory before Warden route.", + "containment": [ + "Token-only and explicit no-store; existing ambient BAO/VAULT/writer credentials removed", + "Exact policy/entity TTL scope; no admin-role fallback", + "Original helper/plan plus exact approval/current rollout/native proof gates before login and after OIDC", + "Fresh isolated Windows Firefox private profile; output-silent browser adapter", + "Warden output/error bytes captured and discarded; no raw error strings in receipts", + "Self-revoke on successful/failed sole-token login, wrong caller, proof rejection, child failure; failed revocation overrides success", + "Caller-owned regular no-follow0600 fsynced append journal" + ], + "limits": [ + "Offline tests only; actual GUI/callback connectivity unverified", + "Ambiguous multiple login-token output refuses writer and cannot identify a sole token for self-revocation; outcome fails closed and requires owner investigation", + "Close dedicated Firefox after attended operation; task-specific profile remains in Windows temp", + "Fresh rollout/native proofs have a 600-second gate; obtain them immediately before attended writer login" + ], + "refinement": { + "same_trial": true, + "previous_review_sha256": "fc147c1fdf782a11a9277412eae7e87e01c7a633e8149885d8685eeb2f452352", + "preserved_under": "attended-private-registration-before-oci-membership/", + "reason": "Successor private helper verifies Deployment/Pod pinned index plus exact registry repository and OCI index/approved linuxamd64 child membership. Both transport pre-login and post-OIDC gates now include immutable image-publication evidence required by helper." + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/attended-public-registration-receipts.jsonl b/docs/assessments/netkingdom-2026-10-14/attended-public-registration-receipts.jsonl new file mode 100644 index 00000000..81661d5a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-public-registration-receipts.jsonl @@ -0,0 +1,2 @@ +{"at": "2026-10-14T22:13:41.969079+00:00", "attempt_id": "8c160098-587b-426c-9f9f-33f57de30c92", "finished_at": "2026-10-14T22:15:54.561630+00:00", "login": false, "login_error": "Error authenticating: timed out waiting for response from provider", "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", "revision": 1, "revoked": null, "warden_exit": null, "warden_state": "/tmp/custodian-warden-state-0x5_fd96"} +{"at": "2026-10-14T22:18:17.520607+00:00", "attempt_id": "23c02e30-1a4c-4bc1-a3dc-45c9bf7ce962", "entity_id": "c204099b-cb94-363f-e207-5ff4d4aa6e94", "finished_at": "2026-10-14T22:19:26.523659+00:00", "login": true, "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", "revision": 1, "revoked": true, "warden_exit": 0, "warden_state": "/tmp/custodian-warden-state-bpn99gi5"} diff --git a/docs/assessments/netkingdom-2026-10-14/attended-reader-custody-wait-audit-r1.json b/docs/assessments/netkingdom-2026-10-14/attended-reader-custody-wait-audit-r1.json new file mode 100644 index 00000000..35ecf4e0 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended-reader-custody-wait-audit-r1.json @@ -0,0 +1,30 @@ +{ + "checked_at": "2026-10-15T03:21:25.946727+00:00", + "previous_goal_turn": "no progress: second consecutive verified impasse awaiting attended execution", + "current_goal_turn": "progress: actualcustody/phaseBnative14 verified; writerCLIdefect reproducedandone-line revision2 prepared with25tests; exactamendmentpendingfounderdisposition", + "consistency": { + "session": 44500, + "terminal": true, + "exit_code": 0, + "automation_errors": 0, + "assessment_failures": 0, + "warnings": 8, + "task_description_and_waitqualifiers_synced": true, + "generated_commit_guard": "rejected; no bypass" + }, + "attendance_block": { + "condition": "Await exact revision2 founder disposition before corrected writer execution", + "consecutive_impasse_turns": 0, + "approval_remains_valid": true, + "custody_receipts_present": true, + "live_process_confirmed": false, + "human_command": "docs/assessments/netkingdom-2026-10-14/run_attended_reader_custody_r1.sh", + "next_action": "After actual approval, record disposition and amendedexecutabledigest; refresh actualsamepodproofs, derive8artifactapproval, scopedwriterregistration/final70audit" + }, + "reader_delivery_executed": true, + "private_registrations_executed": false, + "goal_complete": false, + "blocked_threshold_satisfied": false, + "no_available_independent_required_work": "Corrected exactprivileged executable revision2 requires supervisorreview; allpreparation/tests complete, no correctedliveexecution permitted yet.", + "resumed_blocked_audit": "fresh after explicit userresume and actualattempt" +} diff --git a/docs/assessments/netkingdom-2026-10-14/attended_public_registration.py b/docs/assessments/netkingdom-2026-10-14/attended_public_registration.py new file mode 100644 index 00000000..5914a0f8 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/attended_public_registration.py @@ -0,0 +1,158 @@ +"""Attend scoped OIDC, run the unchanged public registration helper, revoke. + +No login token is printed or saved. Windows Firefox uses a new temporary +profile and a private window, so existing Authelia sessions are not reused. +""" +from pathlib import Path +import argparse +import hashlib +import json +import os +import subprocess +import sys +import tempfile +import threading +import uuid +from datetime import datetime, timezone +from contextlib import nullcontext +from urllib.parse import urlsplit + +import yaml + +OUT = Path(__file__).resolve().parent +sys.path.insert(0, '/home/worsch/ops-mason/src') +from ops_mason.attended_login import TOKEN_RE, classify_login_line, login_args, openbao_error_text + +ROLE = 'reuse-surface-hub-writer-workload-kv-read' +POLICY = 'workload-kv-read-reuse-surface-runtime' +HASHES = { + 'hub-public-registration-proposal-r1.json': '84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1', + 'hub-public-resume-plan.json': '768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b', + 'register_public_hub.py': 'c6a5f08e01af3a5c4b1d6557859f4400eaba0d7eb0bb1976f45bba6bc5a05fda', + 'test_register_public_hub.py': '519cd624eef4ad3c0ed97ab686368b4ffb26985066c8baa2d804e1c6c1af8e02', +} + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--apply', action='store_true', required=True) + parser.parse_args() + for filename, expected in HASHES.items(): + if hashlib.sha256((OUT / filename).read_bytes()).hexdigest() != expected: + raise RuntimeError('prepared public proposal inputs changed') + env = os.environ.copy() + for name in ('BAO_TOKEN', 'VAULT_TOKEN', 'BAO_LOG_LEVEL', 'VAULT_LOG_LEVEL'): + env.pop(name, None) + env['BAO_ADDR'] = env['VAULT_ADDR'] = 'http://127.0.0.1:18200' + attempt = {'attempt_id': str(uuid.uuid4()), 'at': datetime.now(timezone.utc).isoformat(), + 'proposal_id': 'CUST81-REUSE-PUBLIC-REGISTRATION-R1', 'revision': 1, + 'login': False, 'warden_exit': None, 'revoked': None} + token = '' + profile_id = 'custodian-oidc-' + attempt['attempt_id'] + windows_temp = subprocess.run( + ['powershell.exe', '-NoProfile', '-NonInteractive', '-Command', + '[System.IO.Path]::GetTempPath()'], capture_output=True, text=True, check=True, + timeout=20).stdout.strip() + if not windows_temp or '\n' in windows_temp or not windows_temp[1:3] == ':\\': + raise RuntimeError('Windows temporary profile location unavailable') + windows_profile = windows_temp.rstrip('\\') + '\\' + profile_id + linux_profile = subprocess.run(['wslpath', '-u', windows_profile], capture_output=True, + text=True, check=True, timeout=10).stdout.strip() + Path(linux_profile).mkdir(mode=0o700) + with nullcontext(tempfile.mkdtemp(prefix='custodian-warden-state-')) as state: + attempt['warden_state'] = state + config = yaml.safe_load(Path('/home/worsch/.config/warden/warden.yaml').read_text()) + config['state_dir'] = state + config_path = Path(state) / 'warden.yaml' + config_path.write_text(yaml.safe_dump(config, sort_keys=False)) + config_path.chmod(0o600) + env['WARDEN_CONFIG'] = str(config_path) + try: + proc = subprocess.Popen(['bao', *login_args('netkingdom', ROLE)], env=env, + stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, + stderr=subprocess.PIPE, text=True) + errors = [] + browser_errors = [] + + def pump(): + for line in proc.stderr: + kind = classify_login_line(line) + if kind == 'url': + url = line.strip() + parsed = urlsplit(url) + if parsed.scheme != 'https' or not parsed.hostname or parsed.username: + browser_errors.append('unexpected OIDC URL') + proc.terminate() + continue + try: + subprocess.Popen( + ['/mnt/c/Program Files/Mozilla Firefox/firefox.exe', + '-no-remote', '-profile', windows_profile, '-new-instance', + '-private-window', url], stdout=subprocess.DEVNULL, + stderr=subprocess.DEVNULL, start_new_session=True) + print('Firefox opened in a fresh private profile; complete member login and MFA.', flush=True) + except OSError: + browser_errors.append('Firefox launch failed') + proc.terminate() + elif kind == 'error': + errors.append(line) + + reader = threading.Thread(target=pump, daemon=True) + reader.start() + login_output = proc.stdout.read().strip() + token_match = TOKEN_RE.search(login_output) + token = token_match.group(0) if token_match else '' + proc.wait() + reader.join(timeout=5) + if proc.returncode or TOKEN_RE.fullmatch(login_output) is None or browser_errors: + attempt['login_error'] = openbao_error_text(errors)[:1200] or '; '.join(browser_errors) or 'login failed' + print(attempt['login_error'], flush=True) + return 1 + attempt['login'] = True + env['BAO_TOKEN'] = token + lookup = subprocess.run(['bao', 'token', 'lookup', '-format=json'], env=env, + capture_output=True, text=True, timeout=30) + if lookup.returncode: + raise RuntimeError('scoped token lookup failed') + data = json.loads(lookup.stdout)['data'] + if (set(data.get('policies', [])) != {POLICY} or data.get('identity_policies') + or data.get('entity_id') != 'c204099b-cb94-363f-e207-5ff4d4aa6e94' + or not 0 < int(data.get('ttl', 0)) <= 1800): + raise RuntimeError('caller does not match the dedicated role boundary') + attempt['entity_id'] = data.get('entity_id') + print('Dedicated caller verified; applying the unchanged 31-public-repository plan.', flush=True) + result = subprocess.run( + ['warden', 'access', 'reuse-surface-hub-write-token', '--exec', '--field', + 'REUSE_SURFACE_TOKEN', '--', 'python3', str(OUT / 'register_public_hub.py'), '--apply'], + env=env, capture_output=True, timeout=600) + attempt['warden_exit'] = result.returncode + print('Warden returned status ' + str(result.returncode) + '; durable hub receipts require readback.', flush=True) + return result.returncode + finally: + if token: + env['BAO_TOKEN'] = token + try: + revocation = subprocess.run(['bao', 'token', 'revoke', '-self'], env=env, + capture_output=True, timeout=30) + attempt['revoked'] = revocation.returncode == 0 + except Exception: + attempt['revoked'] = False + env.pop('BAO_TOKEN', None) + token = '' + print('Scoped session revocation confirmed: ' + str(attempt['revoked']), flush=True) + attempt['finished_at'] = datetime.now(timezone.utc).isoformat() + receipt = OUT / 'attended-public-registration-receipts.jsonl' + fd = os.open(receipt, os.O_WRONLY | os.O_CREAT | os.O_APPEND, 0o600) + try: + os.write(fd, (json.dumps(attempt, sort_keys=True) + '\n').encode()) + os.fsync(fd) + finally: + os.close(fd) + + +if __name__ == '__main__': + try: + sys.exit(main()) + except Exception as exc: + print('Attended run stopped: ' + type(exc).__name__, file=sys.stderr) + sys.exit(1) diff --git a/docs/assessments/netkingdom-2026-10-14/hardened-reader-local-image-r1.json b/docs/assessments/netkingdom-2026-10-14/hardened-reader-local-image-r1.json new file mode 100644 index 00000000..38decc1c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hardened-reader-local-image-r1.json @@ -0,0 +1,61 @@ +{ + "created_at": "2026-10-14T22:55:37.628846+00:00", + "status": "local_hardened_image_built_and_smoke_verified", + "tag": "cust81-reuse-surface:reader-r1", + "local_image_manifest_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0", + "platform": "linux/amd64", + "base_image_digest": "sha256:78387bc3881b8273120a12ebe6c1ab22b018ccc2c9adf565ae1ac9b536e184ea", + "published": false, + "deployed": false, + "credentials_provisioned": false, + "context_file_hashes": { + "Dockerfile": "004ccbd1aafccada16635993e6634cfeadcc5f4aa332ff84395f3888744ca769", + "README.md": "6e4dc8d382612320cc2c8558ad583b0564ff594a7032b33137cb7a61887621cc", + "pyproject.toml": "c208dda78bc490a03310cae2cc4d1b774973caddd8cecbcdf9efc35efa8acf49", + "reuse_surface/__init__.py": "c0c598dada3cd7dfcf87c3bf0562a2b4454f6c569e4fd248f2105a0404367277", + "reuse_surface/catalog.py": "df4ae59123f900cf396c857853b9c3e88f0fad9ad18b3a26c295cc2067119dcb", + "reuse_surface/cli.py": "da968735cb45dc9944c3a722234641e17cd49a6bef9aa91f40e78ddde3fb9c0e", + "reuse_surface/establish.py": "58e05d8572506c03cdd83598e823df63872cbc9a6f0d0c94897dd5d5829c3fc9", + "reuse_surface/federation.py": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd", + "reuse_surface/forge_host.py": "9900ce52d478250d39609fb6fadf2aae17acc8cbb3b66bd8117a58e9b3571fe4", + "reuse_surface/graph.py": "6ccca1ab09d13caf8aae4490ec86e8431784aeb96414550e90e181a418599406", + "reuse_surface/hub/__init__.py": "19266d0b695aa6ba7e5efda5ce8b3c2baa1925d92cec3c129a01ca436be64440", + "reuse_surface/hub/app.py": "19bdc8331d62df69b1df65958e107639d13a2d0c3e3202786c9127f1f4cc68f3", + "reuse_surface/hub/compose.py": "ded3838e664d8c680171b9ffefeeaa5189aeba056f572d0c33778d35c760937d", + "reuse_surface/hub/hub-registration.schema.yaml": "8b1d838a13f505b27abcae018db098f2abb14882f95bc5095fd967a0997bad09", + "reuse_surface/hub/store.py": "806fb8b70e55f80c819c6fff8d45956f324c74ea41897f32d3a115bc17c0d8b5", + "reuse_surface/hub/webhooks.py": "88c0706d9884e8cc3b3149985ab59228e32ac73c568b1f9285094876dd372cbd", + "reuse_surface/hub_client.py": "12d626992963fb60abdcd4d7a6c1df7eb9b29f0ea1a33616ff3a82846e9497df", + "reuse_surface/hub_sync.py": "ba6390c563507e86e8ed45d887bc925b96ecfbeabc4a9e03f60f8871b147fb60", + "reuse_surface/interactive.py": "572fccd3933947d0ad9a747971d157d57ecd6cb9031401e780c1e014dd6fd0e8", + "reuse_surface/llm_bridge.py": "b0511ce17400f896bc7e0ebdad4b17fe1ef16129dd1558705c277d32cf158cb5", + "reuse_surface/maintain.py": "7a52fa965102df4837ab6d238ddba2dc9cc3608e0c04d9705311ff2333ce648c", + "reuse_surface/maintain_llm.py": "b8a085a4d015368d94dece921a2a143b11c229ddb412dfd630168a4cf4a3751f", + "reuse_surface/overlaps.py": "815ea57f3e0d438c22a9df5d04893e99efc8172f93c3cbea77e65acb2b270ef3", + "reuse_surface/patches.py": "7de8fe12e6b91ec0ac897cd9baa0efabe436b0b6885f6429d9cceb6ed8ca03af", + "reuse_surface/plan_check.py": "17cfac48ec1cd5baafd4466991a8f8fc146d0107c80d8dae3c8a0514281a863d", + "reuse_surface/plan_snapshot.py": "1c020e77786d179cc2f20cb554b63051b3cb77ed31dfa06b2de76ef0bec07ae0", + "reuse_surface/private_source_verify.py": "c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c", + "reuse_surface/registry.py": "14b910a9088ef8bc9b8b68256dcf3201e2f8dad418c7b405ca67da503f1561aa", + "reuse_surface/registry_update.py": "b44cdec110d1b3070c9939969288e10aa3bf1ebb01aed9fe7bf17c47a2db474b", + "reuse_surface/reports.py": "20f15564500d0686dea540b7ba18e53d38f672867e47ce9f12978d8effbf7c81", + "reuse_surface/statehub_bridge.py": "769becb3c064203c468cc5d22aec2ef34c2220d08531cbfaa2b00e00cd24d03f", + "reuse_surface/stats.py": "1760e313bd99f47a7b005e857ab81e9f8e4462de74dae79a5a8c0f3f83f45f7b", + "schemas/capability.schema.yaml": "3b0172baa4e6d54f400e911af6adb0d86b4576b86d7aea6d8f18c3fce3b8ae3f", + "schemas/federation.schema.yaml": "82670dfe8585c37f9e38cafa6de951eecf705a3324657b1c1ba7bea662b8dc59", + "schemas/hub-registration.schema.yaml": "8b1d838a13f505b27abcae018db098f2abb14882f95bc5095fd967a0997bad09", + "schemas/plan-check-rerank.schema.json": "33f2cbf9bc92cf9a9f41a2f31dd21c280ccc2dfc5bcae783be39aa28b66904d5", + "schemas/plan-check-result.schema.json": "8e7cb33547c647be9322b39e8bee64a24b6807391214da707a2fde4835e9b5d0", + "schemas/registry-draft.schema.json": "200b17cf6c3e1ea523887f4e51650dffd6d919f64824d4c9dfc28ace28272d91", + "schemas/registry-patch.schema.json": "a11e2385946edaffc772568103bcc4769274ad78456ae6b62e59103ede898de7", + "schemas/reuse-event.schema.json": "67b7d7436effdfd6c389eefc76de76c57bd1bc577388c60c4a2f0839dc36b6be" + }, + "smoke": { + "network": "none", + "filesystem": "read-only with task-owned data/tmp tmpfs", + "health": "ok", + "empty_registry": true, + "native_source_sha256": "dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd" + }, + "registry_pin_gate": "Owner must publish this exact artifact and independently verify registry digest before rendering actual approved release values." +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-after-hardened-phase-a.json b/docs/assessments/netkingdom-2026-10-14/hosted-after-hardened-phase-a.json new file mode 100644 index 00000000..97b3238a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-after-hardened-phase-a.json @@ -0,0 +1,3023 @@ +{ + "version": 1, + "updated": "2026-10-15", + "domain": "helix_forge", + "collision_policy": "warn", + "sources": [ + { + "repo": "access-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/access-engine.yaml" + }, + { + "repo": "activity-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/activity-core.yaml" + }, + { + "repo": "agentic-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/agentic-resources.yaml" + }, + { + "repo": "approval-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/approval-engine.yaml" + }, + { + "repo": "artifact-store", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/artifact-store.yaml" + }, + { + "repo": "audit-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/audit-core.yaml" + }, + { + "repo": "can-you-assist", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/can-you-assist.yaml" + }, + { + "repo": "citation-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-engine.yaml" + }, + { + "repo": "citation-evidence", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-evidence.yaml" + }, + { + "repo": "citation-work", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-work.yaml" + }, + { + "repo": "commerce-canon", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/commerce-canon.yaml" + }, + { + "repo": "config-atlas", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/config-atlas.yaml" + }, + { + "repo": "coordination-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/coordination-engine.yaml" + }, + { + "repo": "core-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/core-hub.yaml" + }, + { + "repo": "domain-tree", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/domain-tree.yaml" + }, + { + "repo": "email-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/email-connect.yaml" + }, + { + "repo": "emergent-security", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/emergent-security.yaml" + }, + { + "repo": "evidence-anchor", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-anchor.yaml" + }, + { + "repo": "evidence-binder", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-binder.yaml" + }, + { + "repo": "evidence-source", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-source.yaml" + }, + { + "repo": "feature-control", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/feature-control.yaml" + }, + { + "repo": "fin-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/fin-hub.yaml" + }, + { + "repo": "gate-house", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/gate-house.yaml" + }, + { + "repo": "glas-harness", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/glas-harness.yaml" + }, + { + "repo": "guide-board", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/guide-board.yaml" + }, + { + "repo": "helix-forge", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/helix-forge.yaml" + }, + { + "repo": "hub-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/hub-core.yaml" + }, + { + "repo": "human-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/human-resources.yaml" + }, + { + "repo": "ihp-railiance-probe", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ihp-railiance-probe.yaml" + }, + { + "repo": "info-tech-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/info-tech-canon.yaml" + }, + { + "repo": "informed-decision", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/informed-decision.yaml" + }, + { + "repo": "infospace-bench", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/infospace-bench.yaml" + }, + { + "repo": "issue-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/issue-core.yaml" + }, + { + "repo": "kaizen-agentic", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kaizen-agentic.yaml" + }, + { + "repo": "key-cape", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/key-cape.yaml" + }, + { + "repo": "kings-guard", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kings-guard.yaml" + }, + { + "repo": "kontextual-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kontextual-engine.yaml" + }, + { + "repo": "llm-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/llm-connect.yaml" + }, + { + "repo": "markitect-filter", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-filter.yaml" + }, + { + "repo": "markitect-main", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-main.yaml" + }, + { + "repo": "markitect-quarkdown", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-quarkdown.yaml" + }, + { + "repo": "markitect-tool", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-tool.yaml" + }, + { + "repo": "maturity-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/maturity-engine.yaml" + }, + { + "repo": "net-kingdom", + "count": 6, + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/net-kingdom.yaml" + }, + { + "repo": "open-cmis-tck", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-cmis-tck.yaml" + }, + { + "repo": "open-reuse", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-reuse.yaml" + }, + { + "repo": "ops-bridge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-bridge.yaml" + }, + { + "repo": "ops-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-hub.yaml" + }, + { + "repo": "ops-mason", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-mason.yaml" + }, + { + "repo": "ops-warden", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-warden.yaml" + }, + { + "repo": "phase-memory", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/phase-memory.yaml" + }, + { + "repo": "policy-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/policy-nexus.yaml" + }, + { + "repo": "rail-knative", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rail-knative.yaml" + }, + { + "repo": "rail-kubernetes", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rail-kubernetes.yaml" + }, + { + "repo": "railiance-apps", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-apps.yaml" + }, + { + "repo": "railiance-bootstrap", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-bootstrap.yaml" + }, + { + "repo": "railiance-cluster", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-cluster.yaml" + }, + { + "repo": "railiance-enablement", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-enablement.yaml" + }, + { + "repo": "railiance-fabric", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-fabric.yaml" + }, + { + "repo": "railiance-forge", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-forge.yaml" + }, + { + "repo": "railiance-infra", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-infra.yaml" + }, + { + "repo": "railiance-master", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-master.yaml" + }, + { + "repo": "railiance-platform", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-platform.yaml" + }, + { + "repo": "railiance-telemetry", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-telemetry.yaml" + }, + { + "repo": "rapp-playwright", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rapp-playwright.yaml" + }, + { + "repo": "reef-railiance", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reef-railiance.yaml" + }, + { + "repo": "rein-aharness", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rein-aharness.yaml" + }, + { + "repo": "rein-openweights", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rein-openweights.yaml" + }, + { + "repo": "repo-manager", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-manager.yaml" + }, + { + "repo": "repo-scoping", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-scoping.yaml" + }, + { + "repo": "repo-seed", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-seed.yaml" + }, + { + "repo": "resource-control", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/resource-control.yaml" + }, + { + "repo": "reuse-surface", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reuse-surface.yaml" + }, + { + "repo": "risk-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/risk-nexus.yaml" + }, + { + "repo": "role-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/role-engine.yaml" + }, + { + "repo": "runbook-tutorials", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/runbook-tutorials.yaml" + }, + { + "repo": "sand-boxer", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/sand-boxer.yaml" + }, + { + "repo": "sbom-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/sbom-nexus.yaml" + }, + { + "repo": "secrets-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/secrets-engine.yaml" + }, + { + "repo": "security-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/security-canon.yaml" + }, + { + "repo": "shard-wiki", + "count": 8, + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/shard-wiki.yaml" + }, + { + "repo": "state-hub", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/state-hub.yaml" + }, + { + "repo": "tegwick-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tegwick-control.yaml" + }, + { + "repo": "tenant-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tenant-engine.yaml" + }, + { + "repo": "the-custodian", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/the-custodian.yaml" + }, + { + "repo": "user-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/user-engine.yaml" + }, + { + "repo": "vantage-point", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vantage-point.yaml" + }, + { + "repo": "vergabe-teilnahme", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "repo": "whitehat-security", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whitehat-security.yaml" + }, + { + "repo": "whynot-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-control.yaml" + }, + { + "repo": "whynot-design", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-design.yaml" + }, + { + "repo": "zone-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/zone-engine.yaml" + } + ], + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Durable automation and bounded operations", + "summary": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "tags": [ + "activity", + "coordination", + "automation", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "activity-core", + "source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/activity-core.yaml" + }, + { + "id": "capability.agents.cli-assistant", + "name": "Console-Native LLM Assistant (cya)", + "summary": "Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "can-you-assist", + "path": "registry/capabilities/capability.agents.cli-assistant.md", + "tags": [ + "cli", + "assistant", + "llm", + "safety" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "can-you-assist", + "source_url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/can-you-assist.yaml" + }, + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Generic agent runtime and repository tooling", + "summary": "Agent runtime modules and repository classification tooling.", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "tags": [ + "agents", + "runtime", + "classification", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "the-custodian", + "source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/the-custodian.yaml" + }, + { + "id": "capability.agents.kaizen-framework", + "name": "Kaizen Agentic Framework", + "summary": "AI agency framework providing 20 deployable agent instruction sets, project memory, metrics, role and engagement contracts, and scheduled preparation for governed execution.", + "vector": "D3 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "kaizen-agentic", + "path": "registry/capabilities/capability.agents.kaizen-framework.md", + "tags": [ + "agents", + "memory", + "coordination", + "metrics", + "scheduling", + "engagements" + ], + "consumption_modes": [ + "cli", + "library import", + "file contracts" + ], + "source_repo": "kaizen-agentic", + "source_url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kaizen-agentic.yaml" + }, + { + "id": "capability.agents.llm-connector", + "name": "Pluggable LLM Adapter Library (llm-connect)", + "summary": "Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers.", + "vector": "D3 / A2 / C2 / R1", + "domain": "agents", + "status": "draft", + "owner": "llm-connect", + "path": "registry/capabilities/capability.agents.llm-connector.md", + "tags": [ + "llm", + "adapter", + "provider-neutral" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "llm-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/llm-connect.yaml" + }, + { + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "summary": "Capture sessions, curate patterns, distribute lessons and measure outcomes.", + "domain": "infotech", + "status": "draft", + "owner": "agentic-resources", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.performance-learning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "agentic-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/agentic-resources.yaml" + }, + { + "id": "capability.agents.repo-scoping-service", + "name": "Repository Scoping Service", + "summary": "Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "repo-scoping", + "path": "registry/capabilities/capability.agents.repo-scoping-service.md", + "tags": [ + "classification", + "scoping", + "registry" + ], + "consumption_modes": [ + "http api", + "library import", + "ui" + ], + "source_repo": "repo-scoping", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-scoping.yaml" + }, + { + "id": "capability.audit.event-retain", + "name": "Independent audit custody", + "summary": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.", + "domain": "infotech", + "status": "draft", + "owner": "audit-core", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C3 / R2", + "path": "registry/capabilities/capability.audit.event-retain.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "audit-core", + "source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/audit-core.yaml" + }, + { + "id": "capability.authorization.policy-evaluate", + "name": "Policy evaluation and decision evidence", + "summary": "Check, batch, list-allowed, explain, binding, lifetime and decision records.", + "domain": "helix_forge", + "status": "draft", + "owner": "access-engine", + "tags": [ + "authorization", + "policy", + "flex-auth", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "access-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/access-engine.yaml" + }, + { + "id": "capability.cmis.tck", + "name": "OpenCMIS Conformance-Preparation Extension", + "summary": "CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "open-cmis-tck", + "path": "registry/capabilities/capability.cmis.tck.md", + "tags": [ + "cmis", + "compliance", + "guide-board-extension" + ], + "consumption_modes": [ + "library import (guide-board extension)" + ], + "source_repo": "open-cmis-tck", + "source_url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-cmis-tck.yaml" + }, + { + "id": "capability.communication.compliance-evidence-framework", + "name": "Certification And Compliance Evidence Framework", + "summary": "Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture.", + "vector": "D2 / A2 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "guide-board", + "path": "registry/capabilities/capability.communication.compliance-evidence-framework.md", + "tags": [ + "compliance", + "certification", + "evidence", + "extensions" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "guide-board", + "source_url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/guide-board.yaml" + }, + { + "id": "capability.communication.context-engine", + "name": "Kontextual Engine (Knowledge Operations Runtime)", + "summary": "Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge.", + "vector": "D4 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "kontextual-engine", + "path": "registry/capabilities/capability.communication.context-engine.md", + "tags": [ + "knowledge", + "context", + "runtime" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "kontextual-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kontextual-engine.yaml" + }, + { + "id": "capability.communication.infospace-workspace", + "name": "Infospace Workspace And Evaluation Bench", + "summary": "Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main.", + "vector": "D3 / A1 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "infospace-bench", + "path": "registry/capabilities/capability.communication.infospace-workspace.md", + "tags": [ + "infospace", + "knowledge", + "evaluation" + ], + "consumption_modes": [ + "cli", + "library import (consumed by info-tech-canon)" + ], + "source_repo": "infospace-bench", + "source_url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/infospace-bench.yaml" + }, + { + "id": "capability.communication.markitect-legacy-platform", + "name": "MarkiTect Legacy Platform", + "summary": "Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-main", + "path": "registry/capabilities/capability.communication.markitect-legacy-platform.md", + "tags": [ + "markitect", + "markdown", + "legacy" + ], + "consumption_modes": [ + "application (legacy, not recommended for new integration)" + ], + "source_repo": "markitect-main", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-main.yaml" + }, + { + "id": "capability.communication.markitect-quarkdown-adapter", + "name": "Markitect Quarkdown Render Adapter", + "summary": "Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-quarkdown", + "path": "registry/capabilities/capability.communication.markitect-quarkdown-adapter.md", + "tags": [ + "markitect", + "quarkdown", + "adapter" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-quarkdown", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-quarkdown.yaml" + }, + { + "id": "capability.communication.markitect-source-adapters", + "name": "Markitect Source-Format Adapters", + "summary": "Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-filter", + "path": "registry/capabilities/capability.communication.markitect-source-adapters.md", + "tags": [ + "markitect", + "adapter", + "document-conversion" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-filter", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-filter.yaml" + }, + { + "id": "capability.communication.markitect-toolkit", + "name": "Markitect Markdown Toolkit And CLI", + "summary": "Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main.", + "vector": "D4 / A2 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "markitect-tool", + "path": "registry/capabilities/capability.communication.markitect-toolkit.md", + "tags": [ + "markitect", + "markdown", + "cli", + "toolkit" + ], + "consumption_modes": [ + "cli", + "library import" + ], + "source_repo": "markitect-tool", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-tool.yaml" + }, + { + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "summary": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime.", + "domain": "infotech", + "status": "draft", + "owner": "coordination-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.coordination.cross-owner-work.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "coordination-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/coordination-engine.yaml" + }, + { + "id": "capability.design.whynot-system", + "name": "Whynot Design System", + "summary": "Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters.", + "vector": "D3 / A2 / C2 / R1", + "domain": "consumer", + "status": "draft", + "owner": "whynot-design", + "path": "registry/capabilities/capability.design.whynot-system.md", + "tags": [ + "design-system", + "web-components", + "frontend" + ], + "consumption_modes": [ + "library import (npm)", + "cli", + "django template adapter" + ], + "source_repo": "whynot-design", + "source_url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whynot-design.yaml" + }, + { + "id": "capability.evidence.binding", + "name": "Evidence-to-Target Binding", + "summary": "Links evidence items to structured targets with relation, status, and confidence metadata, bidirectional queries, active-state coordination, and canonical engine events.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.binding.md", + "tags": [ + "evidence", + "binding", + "evidence-link", + "form-field", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React provider" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.evidence.rect-registry", + "name": "Visual-Guide Rect Registry", + "summary": "Coordinates field, evidence-card, and highlight rectangles from independent renderers so an SVG overlay can draw the active visual guide without polling.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.rect-registry.md", + "tags": [ + "rect-registry", + "visual-guide", + "overlay", + "active-state", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React component" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.execution.openweight-rein", + "name": "Bounded open-weight agent execution", + "summary": "Tool loop, path guards, turn/budget limits and verified-commit result.", + "domain": "infotech", + "status": "draft", + "owner": "rein-openweights", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.execution.openweight-rein.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rein-openweights", + "source_url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rein-openweights.yaml" + }, + { + "id": "capability.execution.profile-harness", + "name": "Profile-bound agent execution lifecycle", + "summary": "Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration.", + "domain": "infotech", + "status": "draft", + "owner": "glas-harness", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.execution.profile-harness.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "glas-harness", + "source_url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/glas-harness.yaml" + }, + { + "id": "capability.execution.sandbox-provision", + "name": "Sandbox establishment and lifecycle", + "summary": "Profiles, extensions, provision, checkpoints, TTL teardown and telemetry.", + "domain": "infotech", + "status": "draft", + "owner": "sand-boxer", + "tags": [ + "sandbox", + "isolation", + "provision", + "e2e", + "agentic", + "execution", + "profile", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D5 / A5 / C5 / R0", + "path": "registry/capabilities/execution.sandbox-provision.md", + "consumption_modes": [ + "containerized service", + "CLI" + ], + "source_repo": "sand-boxer", + "source_url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/sand-boxer.yaml" + }, + { + "id": "capability.execution.scheduled-agent-rein", + "name": "Scheduled agent intake and harness routing", + "summary": "Activity Core lease claim/heartbeat and Glas profile execution.", + "domain": "infotech", + "status": "draft", + "owner": "rein-aharness", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.execution.scheduled-agent-rein.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rein-aharness", + "source_url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rein-aharness.yaml" + }, + { + "id": "capability.feature-control.evaluate", + "name": "Feature Availability Evaluation", + "summary": "Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context.", + "vector": "D5 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.evaluate.md", + "tags": [ + "feature-control", + "evaluation", + "sdk" + ], + "consumption_modes": [ + "SDK", + "service API" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.rollout", + "name": "Feature Rollout Control", + "summary": "Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.rollout.md", + "tags": [ + "feature-control", + "rollout", + "planning" + ], + "consumption_modes": [ + "source module", + "SDK" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.visibility", + "name": "Feature Visibility Control", + "summary": "Control whether features are visible or hidden for subjects without changing entitlement or authorization.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.visibility.md", + "tags": [ + "feature-control", + "visibility" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.finance.security-budget-evidence", + "name": "Budget and cost evidence for security operations", + "summary": "Budget, commitment, spend attribution and planning-evidence consumption.", + "domain": "infotech", + "status": "draft", + "owner": "fin-hub", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.finance.security-budget-evidence.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "fin-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/fin-hub.yaml" + }, + { + "id": "capability.graph.nbgm-spec", + "name": "Network-Based Graph Model (NBGM) Specification", + "summary": "Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains.", + "vector": "D2 / A0 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "vantage-point", + "path": "registry/capabilities/capability.graph.nbgm-spec.md", + "tags": [ + "graph", + "nbgm", + "specification" + ], + "consumption_modes": [ + "informational (specification only)" + ], + "source_repo": "vantage-point", + "source_url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vantage-point.yaml" + }, + { + "id": "capability.hr.workflow-catalog", + "name": "HR Workflow Catalog", + "summary": "Markdown-first registry of HR planning workflows with an iterative assessment loop tied to INTENT phases.", + "vector": "D3 / A1 / C1 / R0", + "domain": "consumer", + "status": "draft", + "owner": "human-resources", + "path": "registry/capabilities/capability.hr.workflow-catalog.md", + "tags": [ + "hr", + "workflows", + "assessment", + "planning" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "human-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/human-resources.yaml" + }, + { + "id": "capability.iam.key-cape", + "name": "OIDC identity and assurance", + "summary": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.iam.key-cape.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "key-cape", + "source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/key-cape.yaml" + }, + { + "id": "capability.identity.subject-resolution", + "name": "Identity Subject Resolution", + "summary": "Resolve who or what is acting by mapping principals, accounts, actors, and identifiers to a stable subject model.", + "vector": "D3 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.subject-resolution.md", + "tags": [ + "identity", + "subject", + "architecture" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.identity.tenant-facts", + "name": "Tenant lifecycle and guardrail facts", + "summary": "Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.", + "domain": "infotech", + "status": "draft", + "owner": "tenant-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.identity.tenant-facts.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "tenant-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/tenant-engine.yaml" + }, + { + "id": "capability.identity.user-engine", + "name": "User lifecycle and account journeys", + "summary": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog.", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "tags": [ + "identity", + "user-management", + "multi-tenant", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R0", + "path": "registry/capabilities/capability.identity.user-engine.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "user-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/user-engine.yaml" + }, + { + "id": "capability.identity.vocabulary-canonicalize", + "name": "Identity Vocabulary Canonicalization", + "summary": "Define an implementation-neutral vocabulary for identity-related concepts across overlapping domains.", + "vector": "D4 / A0 / C2 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.vocabulary-canonicalize.md", + "tags": [ + "identity", + "terminology", + "research" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.infotech.artifact-store", + "name": "Artifact Registry And Storage Gateway", + "summary": "Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "artifact-store", + "path": "registry/capabilities/capability.infotech.artifact-store.md", + "tags": [ + "artifact", + "storage", + "provenance", + "registry" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "artifact-store", + "source_url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/artifact-store.yaml" + }, + { + "id": "capability.infotech.canon-service", + "name": "Shared semantic contracts and validation", + "summary": "Markdown canon with library, CLI and read-only API.", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "tags": [ + "canon", + "infospace", + "service", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "info-tech-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/info-tech-canon.yaml" + }, + { + "id": "capability.infotech.citation-engine", + "name": "Citation Evidence Domain Engine", + "summary": "Core domain model and engine services for the citation-evidence ecosystem \u2014 shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-engine", + "path": "registry/capabilities/capability.infotech.citation-engine.md", + "tags": [ + "citation", + "evidence", + "domain-model" + ], + "consumption_modes": [ + "library import (workspace link)" + ], + "source_repo": "citation-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-engine.yaml" + }, + { + "id": "capability.infotech.citation-evidence-workspace", + "name": "Citation Evidence Workspace", + "summary": "Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations \u2014 the umbrella application over the citation-evidence six-package design.", + "vector": "D4 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-evidence", + "path": "registry/capabilities/capability.infotech.citation-evidence-workspace.md", + "tags": [ + "citation", + "evidence", + "workspace" + ], + "consumption_modes": [ + "application (local dev server)" + ], + "source_repo": "citation-evidence", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-evidence.yaml" + }, + { + "id": "capability.infotech.config-surface-atlas", + "name": "Configuration Surface Atlas", + "summary": "Read-first, cross-kind map and evidence layer for configuration surfaces \u2014 what configures a system, who owns it, its scope, and where the source of truth lives.", + "vector": "D5 / A0 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "config-atlas", + "path": "registry/capabilities/capability.infotech.config-surface-atlas.md", + "tags": [ + "configuration", + "registry", + "control-plane", + "effective-config", + "evidence" + ], + "consumption_modes": [ + "informational", + "source module" + ], + "source_repo": "config-atlas", + "source_url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/config-atlas.yaml" + }, + { + "id": "capability.infotech.core-hub", + "name": "Core Hub Production Interaction Framework", + "summary": "Contract-first framework for cross-domain state, agent coordination, evidence, registries, workplans, and operator interaction surfaces.", + "vector": "D3 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "core-hub", + "path": "registry/capabilities/capability.infotech.core-hub.md", + "tags": [ + "interaction-framework", + "state-hub", + "inter-hub-successor", + "agent-coordination", + "registry", + "api" + ], + "consumption_modes": [ + "informational", + "planning", + "cli" + ], + "source_repo": "core-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/core-hub.yaml" + }, + { + "id": "capability.infotech.email-connector", + "name": "Mailbox Evidence Scanner (email-connect)", + "summary": "Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "email-connect", + "path": "registry/capabilities/capability.infotech.email-connector.md", + "tags": [ + "email", + "evidence", + "coordination" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "email-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/email-connect.yaml" + }, + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.infotech.hub-core-library", + "name": "Reusable FOS Hub Core Primitives", + "summary": "Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "hub-core", + "path": "registry/capabilities/capability.infotech.hub-core-library.md", + "tags": [ + "hub", + "fastapi", + "sqlalchemy", + "mcp" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "hub-core", + "source_url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/hub-core.yaml" + }, + { + "id": "capability.infotech.issue-tracking", + "name": "External issue tracker connector", + "summary": "CLI and Python adapters for external issue systems.", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "tags": [ + "issue-tracking", + "connector", + "work-record", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "issue-core", + "source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/issue-core.yaml" + }, + { + "id": "capability.infotech.oss-integration-continuity", + "name": "Managed Continuity For OSS Integrations", + "summary": "Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "open-reuse", + "path": "registry/capabilities/capability.infotech.oss-integration-continuity.md", + "tags": [ + "oss", + "integration", + "maintenance" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "open-reuse", + "source_url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-reuse.yaml" + }, + { + "id": "capability.infotech.pdf-evidence-ingest", + "name": "Headless PDF Evidence Ingest", + "summary": "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "evidence-source", + "path": "registry/capabilities/capability.infotech.pdf-evidence-ingest.md", + "tags": [ + "pdf", + "ingest", + "fingerprint", + "canonical-text", + "evidence" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "evidence-source", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-source.yaml" + }, + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ], + "source_repo": "repo-seed", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-seed.yaml" + }, + { + "id": "capability.infotech.runbook-tutorials", + "name": "Guided administrative runbooks", + "summary": "Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.", + "domain": "infotech", + "status": "draft", + "owner": "runbook-tutorials", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "runbook-tutorials", + "source_url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/runbook-tutorials.yaml" + }, + { + "id": "capability.infotech.sbom-management", + "name": "Dependency provenance and SBOM evidence", + "summary": "Controlled archive ingest, immutable snapshots, freshness and license review.", + "domain": "infotech", + "status": "draft", + "owner": "sbom-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.sbom-management.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "sbom-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/sbom-nexus.yaml" + }, + { + "id": "capability.memory.phase-planning", + "name": "Profile-Driven Memory Phase Planning (phase-memory)", + "summary": "Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "phase-memory", + "path": "registry/capabilities/capability.memory.phase-planning.md", + "tags": [ + "memory", + "agentic", + "planning" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "phase-memory", + "source_url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/phase-memory.yaml" + }, + { + "id": "capability.observability.security-signals", + "name": "Security-relevant telemetry contracts and adapters", + "summary": "Signal contract, platform adapters, report exporter and absence/alert rules.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-telemetry", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.observability.security-signals.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-telemetry", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-telemetry.yaml" + }, + { + "id": "capability.operations.ops-hub", + "name": "Operations Hub Extension Contract", + "summary": "Versioned hub-extension package and bootstrap client for operational truth, service-catalog records, readiness evidence, and migration gates.", + "vector": "D3 / A1 / C1 / R1", + "domain": "operations", + "status": "reviewed", + "owner": "ops-hub", + "path": "registry/capabilities/capability.operations.ops-hub.md", + "tags": [ + "operations", + "service-catalog", + "readiness", + "hub-extension" + ], + "consumption_modes": [ + "contract package", + "command-line bootstrap" + ], + "source_repo": "ops-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-hub.yaml" + }, + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH tunnel lifecycle", + "summary": "Named tunnels, reconnect, health and TTL-aware cert_command.", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-bridge", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-bridge.yaml" + }, + { + "id": "capability.organization.role-catalog", + "name": "Organizational role definitions", + "summary": "Versioned documentation catalog.", + "domain": "infotech", + "status": "draft", + "owner": "role-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.organization.role-catalog.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "role-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/role-engine.yaml" + }, + { + "id": "capability.procurement.vergabe-teilnahme", + "name": "Vergabe Teilnahme (Public Procurement Participation) Application", + "summary": "Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation \u2014 Ausschreibungs- und Teilnahme-Management-System.", + "vector": "D3 / A1 / C1 / R1", + "domain": "communication", + "status": "draft", + "owner": "vergabe-teilnahme", + "path": "registry/capabilities/capability.procurement.vergabe-teilnahme.md", + "tags": [ + "procurement", + "django", + "vergabe" + ], + "consumption_modes": [ + "application (Django + Vite, local dev via docker-compose)" + ], + "source_repo": "vergabe-teilnahme", + "source_url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "id": "capability.railiance.bootstrap-sequencing", + "name": "Bootstrap sequencing contracts", + "summary": "Bare-VM to estate sequence and handoff contract.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-bootstrap", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.bootstrap-sequencing.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "railiance-bootstrap", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-bootstrap.yaml" + }, + { + "id": "capability.railiance.browser-verification", + "name": "Managed browser verification pilot", + "summary": "Bounded jobs, cancellation, artifacts, origin checks and restart receipts.", + "domain": "infotech", + "status": "draft", + "owner": "rapp-playwright", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.railiance.browser-verification.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "rapp-playwright", + "source_url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rapp-playwright.yaml" + }, + { + "id": "capability.railiance.ci-enablement", + "name": "Developer delivery and CI templates", + "summary": "Reusable CI workflows, build and deployment patterns.", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-enablement", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-enablement.yaml" + }, + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Kubernetes runtime and cluster controls", + "summary": "k3s, ingress, CNI, operators and kubeconfig/runtime checks.", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-cluster", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-cluster.yaml" + }, + { + "id": "capability.railiance.fabric-graph", + "name": "Infrastructure ownership and dependency graph", + "summary": "Schemas, validation, graph queries and State Hub exports.", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-fabric", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-fabric.yaml" + }, + { + "id": "capability.railiance.forge-infrastructure", + "name": "Source forge, registries and runner substrate", + "summary": "Forgejo operation, package registries and runner lifecycle.", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.railiance.infra-provisioning", + "name": "Host convergence and security baseline", + "summary": "Ansible inventory, firewall, SSH bootstrap and baseline verification.", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-infra", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-infra.yaml" + }, + { + "id": "capability.railiance.knative-rail", + "name": "Knative workload lifecycle", + "summary": "Derived rail for activation, revisions, traffic, scaling and rollback.", + "domain": "infotech", + "status": "draft", + "owner": "rail-knative", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.knative-rail.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rail-knative", + "source_url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rail-knative.yaml" + }, + { + "id": "capability.railiance.kubernetes-rail", + "name": "Generic Kubernetes workload lifecycle", + "summary": "Workload declaration, rollout, observe, promote and rollback surfaces.", + "domain": "infotech", + "status": "draft", + "owner": "rail-kubernetes", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.kubernetes-rail.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rail-kubernetes", + "source_url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rail-kubernetes.yaml" + }, + { + "id": "capability.railiance.platform-services", + "name": "Secret custody and platform data services", + "summary": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-platform", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-platform.yaml" + }, + { + "id": "capability.railiance.security-consumption-contracts", + "name": "Platform security consumption architecture", + "summary": "Rail/rapp/reef boundaries, exposure and security consumption contracts.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-master", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.security-consumption-contracts.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "railiance-master", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-master.yaml" + }, + { + "id": "capability.railiance.substrate-bindings", + "name": "Substrate topology and bindings", + "summary": "Grouped home-reef identity, topology and placement declarations.", + "domain": "infotech", + "status": "draft", + "owner": "reef-railiance", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.substrate-bindings.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "reef-railiance", + "source_url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reef-railiance.yaml" + }, + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Workload release configuration and guards", + "summary": "Helm/manifests, exact image pins, application runbooks and rollout/rollback.", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-apps", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-apps.yaml" + }, + { + "id": "capability.registry.register", + "name": "Capability registry and federation", + "summary": "Owner Markdown entries, indexes, federation hub and planning queries.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "governance", + "meta", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C2 / R3", + "path": "registry/capabilities/capability.registry.register.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.registry.validate", + "name": "Capability registry validation", + "summary": "Schema, index consistency and relation checks.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "validation", + "cli", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R3", + "path": "registry/capabilities/capability.registry.validate.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.resources.security-capacity", + "name": "Capacity and recovery resource planning", + "summary": "Provider-neutral inventory, procurement evidence and optimization reports.", + "domain": "infotech", + "status": "draft", + "owner": "resource-control", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.resources.security-capacity.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "resource-control", + "source_url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/resource-control.yaml" + }, + { + "id": "capability.security.access-routing", + "name": "Credential routing and contained access", + "summary": "warden route and access catalog; exact lane conduit and secret-exec routing.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.security.access-routing.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.adversarial-evidence", + "name": "Authorized adversarial evidence harness", + "summary": "Offline ASM and tenancy calibrations and engagement admission.", + "domain": "infotech", + "status": "draft", + "owner": "whitehat-security", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.adversarial-evidence.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "whitehat-security", + "source_url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whitehat-security.yaml" + }, + { + "id": "capability.security.agent-knowledge", + "name": "Verified security orientation for agents", + "summary": "Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports.", + "domain": "infotech", + "status": "draft", + "owner": "emergent-security", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.agent-knowledge.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "emergent-security", + "source_url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/emergent-security.yaml" + }, + { + "id": "capability.security.approval-lifecycle", + "name": "Bound approval lifecycle", + "summary": "Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.", + "domain": "infotech", + "status": "draft", + "owner": "approval-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.security.approval-lifecycle.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "approval-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/approval-engine.yaml" + }, + { + "id": "capability.security.bootstrap-recovery", + "name": "Guarded bootstrap and recovery preparation", + "summary": "Local identity, bootstrap console, encrypted custody handoff and caller tools.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.bootstrap-recovery.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-contracts", + "name": "Security case types and instance validation", + "summary": "Versioned types, cases and schema validation.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-contracts.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-follow-through", + "name": "Security case operational follow-through", + "summary": "KnownSecurityCase route, plan and operational receipts.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-follow-through.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.credential-lifecycle", + "name": "Cataloged credential lifecycle", + "summary": "CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.", + "domain": "infotech", + "status": "draft", + "owner": "secrets-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.credential-lifecycle.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "secrets-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/secrets-engine.yaml" + }, + { + "id": "capability.security.doctrine-review", + "name": "Security doctrine and architecture review", + "summary": "Layer rules, authority context, ASM criteria and interpretations.", + "domain": "infotech", + "status": "draft", + "owner": "gate-house", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.security.doctrine-review.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "gate-house", + "source_url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/gate-house.yaml" + }, + { + "id": "capability.security.emission-profile", + "name": "Security emission cadence validation", + "summary": "Security profile over generic emission contracts and validator.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.emission-profile.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.forge-secret-prevention", + "name": "Independent introduced-history secret prevention", + "summary": "Pinned receive adapter, lifecycle template and fail-closed scan.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.forge-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.security.human-decision-workspace", + "name": "Human security decision presentation and disposition", + "summary": "Headless lifecycle and browser workspace with exact native approval references.", + "domain": "infotech", + "status": "draft", + "owner": "informed-decision", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.security.human-decision-workspace.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "informed-decision", + "source_url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/informed-decision.yaml" + }, + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom security architecture and conformance tooling", + "summary": "Versioned IAM, layer, tenancy and credential contracts plus validators.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.maturity-claims", + "name": "Evidence-based maturity claims and gap register", + "summary": "SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory.", + "domain": "infotech", + "status": "draft", + "owner": "maturity-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.maturity-claims.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "maturity-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/maturity-engine.yaml" + }, + { + "id": "capability.security.policy-publication", + "name": "Policy publication with source provenance", + "summary": "Generated immutable publication, source currency and stable policy URLs.", + "domain": "infotech", + "status": "draft", + "owner": "policy-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.policy-publication.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "policy-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/policy-nexus.yaml" + }, + { + "id": "capability.security.posture-assessment", + "name": "Security posture assessment and response proposals", + "summary": "Normalized observation evaluator, cadence checks and secret-use snapshot adapter.", + "domain": "infotech", + "status": "draft", + "owner": "kings-guard", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-assessment.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "kings-guard", + "source_url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kings-guard.yaml" + }, + { + "id": "capability.security.posture-feedback", + "name": "Deterministic posture feedback", + "summary": "CLI evaluates evidence age and posture into owner-routed findings.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-feedback.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.practice-canon", + "name": "Security practice and authority vocabulary", + "summary": "Versioned SEC-DSM and Mode of Authority documents.", + "domain": "infotech", + "status": "draft", + "owner": "security-canon", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.security.practice-canon.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "security-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/security-canon.yaml" + }, + { + "id": "capability.security.repository-secret-prevention", + "name": "Repository metadata and staged-secret prevention", + "summary": "Repository observation plus pinned staged-blob scanner and hook integration.", + "domain": "infotech", + "status": "draft", + "owner": "repo-manager", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.repository-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "repo-manager", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-manager.yaml" + }, + { + "id": "capability.security.risk-register", + "name": "Security risk and exception review register", + "summary": "Markdown findings and Python review, verification and due-work reports.", + "domain": "infotech", + "status": "draft", + "owner": "risk-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.risk-register.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "risk-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/risk-nexus.yaml" + }, + { + "id": "capability.security.scenario-compose", + "name": "Deterministic security scenario composition", + "summary": "CLI selects pinned providers and orders trust transitions.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.scenario-compose.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.ssh-certificate-issuance", + "name": "Decision-bound SSH certificates", + "summary": "warden sign with local and OpenBao backends and adm/agt/atm actors.", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R2", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.structure-construction", + "name": "Reviewed security structure construction", + "summary": "Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.", + "domain": "infotech", + "status": "draft", + "owner": "ops-mason", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.structure-construction.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-mason", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-mason.yaml" + }, + { + "id": "capability.security.zone-reference", + "name": "Zone membership reference conformance", + "summary": "Offline resolution, exception and lineage checks.", + "domain": "infotech", + "status": "draft", + "owner": "zone-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.zone-reference.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "zone-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/zone-engine.yaml" + }, + { + "id": "capability.statehub.progress-log", + "name": "Progress and work evidence indexing", + "summary": "REST progress and task evidence references.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "progress", + "coordination", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R3", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Cross-repository work tracking", + "summary": "File-derived workplans, tasks, dependencies, decisions and coordination views.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "coordination", + "workplans", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R2", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.wiki.adapter-contract", + "name": "Capability-Aware Shard Adapter Contract", + "summary": "A versioned backend interface where each binding declares a verified capability profile, so federation ops degrade by capability.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.adapter-contract.md", + "tags": [ + "wiki", + "adapter", + "capability", + "contract", + "conformance", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.coordination-journal", + "name": "Event-Sourced Coordination Journal", + "summary": "An append-only, totally-ordered-per-space decision log whose current state is a derived fold; git-addressable history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.coordination-journal.md", + "tags": [ + "wiki", + "event-sourcing", + "coordination", + "git", + "journal", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.derived-views", + "name": "Wiki Derived Views", + "summary": "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges, AllPages, SiteMap, and (delegate-or-derive) Search \u2014 carrying provenance.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.derived-views.md", + "tags": [ + "wiki", + "derived-views", + "backlinks", + "recentchanges", + "search", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.engine-typed-extensions", + "name": "Wiki Engine with Typed Extensions", + "summary": "A small-core wiki engine realizing a typed-extension framework that addresses all wiki use cases and lets each shard activate only the features it needs.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.engine-typed-extensions.md", + "tags": [ + "wiki", + "engine", + "typed-extensions", + "feature-activation", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.federation-models", + "name": "Selectable Federation-Model Taxonomy", + "summary": "Federation as a plural, composable coordination axis (fork+journal, VCS-replication, query-join, feed, activity-streams, engine-mirror) selected per space.", + "vector": "D4 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.federation-models.md", + "tags": [ + "wiki", + "federation", + "taxonomy", + "composable", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.overlay", + "name": "Overlay-Before-Mutation Write Path", + "summary": "Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only or limited backends be edited safely without silent remote mutation.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.overlay.md", + "tags": [ + "wiki", + "overlay", + "patch", + "write-path", + "conflict", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.page-model", + "name": "Backend-Neutral Wiki Page Model", + "summary": "A Markdown-first but stretchable page model with stable identity separate from placement and layered provenance.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.page-model.md", + "tags": [ + "wiki", + "page-model", + "identity", + "provenance", + "markdown", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.shard-orchestration", + "name": "Wiki Shard Orchestration", + "summary": "Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.shard-orchestration.md", + "tags": [ + "wiki", + "federation", + "orchestration", + "union", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + } + ], + "composed_at": "2026-10-15T00:17:38+00:00", + "stale": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-after-owner-consent.json b/docs/assessments/netkingdom-2026-10-14/hosted-after-owner-consent.json new file mode 100644 index 00000000..f9b8ee66 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-after-owner-consent.json @@ -0,0 +1,3023 @@ +{ + "version": 1, + "updated": "2026-10-14", + "domain": "helix_forge", + "collision_policy": "warn", + "sources": [ + { + "repo": "access-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/access-engine.yaml" + }, + { + "repo": "activity-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/activity-core.yaml" + }, + { + "repo": "agentic-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/agentic-resources.yaml" + }, + { + "repo": "approval-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/approval-engine.yaml" + }, + { + "repo": "artifact-store", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/artifact-store.yaml" + }, + { + "repo": "audit-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/audit-core.yaml" + }, + { + "repo": "can-you-assist", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/can-you-assist.yaml" + }, + { + "repo": "citation-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-engine.yaml" + }, + { + "repo": "citation-evidence", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-evidence.yaml" + }, + { + "repo": "citation-work", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-work.yaml" + }, + { + "repo": "commerce-canon", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/commerce-canon.yaml" + }, + { + "repo": "config-atlas", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/config-atlas.yaml" + }, + { + "repo": "coordination-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/coordination-engine.yaml" + }, + { + "repo": "core-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/core-hub.yaml" + }, + { + "repo": "domain-tree", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/domain-tree.yaml" + }, + { + "repo": "email-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/email-connect.yaml" + }, + { + "repo": "emergent-security", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/emergent-security.yaml" + }, + { + "repo": "evidence-anchor", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-anchor.yaml" + }, + { + "repo": "evidence-binder", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-binder.yaml" + }, + { + "repo": "evidence-source", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-source.yaml" + }, + { + "repo": "feature-control", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/feature-control.yaml" + }, + { + "repo": "fin-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/fin-hub.yaml" + }, + { + "repo": "gate-house", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/gate-house.yaml" + }, + { + "repo": "glas-harness", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/glas-harness.yaml" + }, + { + "repo": "guide-board", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/guide-board.yaml" + }, + { + "repo": "helix-forge", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/helix-forge.yaml" + }, + { + "repo": "hub-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/hub-core.yaml" + }, + { + "repo": "human-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/human-resources.yaml" + }, + { + "repo": "ihp-railiance-probe", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ihp-railiance-probe.yaml" + }, + { + "repo": "info-tech-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/info-tech-canon.yaml" + }, + { + "repo": "informed-decision", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/informed-decision.yaml" + }, + { + "repo": "infospace-bench", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/infospace-bench.yaml" + }, + { + "repo": "issue-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/issue-core.yaml" + }, + { + "repo": "kaizen-agentic", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kaizen-agentic.yaml" + }, + { + "repo": "key-cape", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/key-cape.yaml" + }, + { + "repo": "kings-guard", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kings-guard.yaml" + }, + { + "repo": "kontextual-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kontextual-engine.yaml" + }, + { + "repo": "llm-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/llm-connect.yaml" + }, + { + "repo": "markitect-filter", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-filter.yaml" + }, + { + "repo": "markitect-main", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-main.yaml" + }, + { + "repo": "markitect-quarkdown", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-quarkdown.yaml" + }, + { + "repo": "markitect-tool", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-tool.yaml" + }, + { + "repo": "maturity-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/maturity-engine.yaml" + }, + { + "repo": "net-kingdom", + "count": 6, + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/net-kingdom.yaml" + }, + { + "repo": "open-cmis-tck", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-cmis-tck.yaml" + }, + { + "repo": "open-reuse", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-reuse.yaml" + }, + { + "repo": "ops-bridge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-bridge.yaml" + }, + { + "repo": "ops-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-hub.yaml" + }, + { + "repo": "ops-mason", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-mason.yaml" + }, + { + "repo": "ops-warden", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-warden.yaml" + }, + { + "repo": "phase-memory", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/phase-memory.yaml" + }, + { + "repo": "policy-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/policy-nexus.yaml" + }, + { + "repo": "rail-knative", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rail-knative.yaml" + }, + { + "repo": "rail-kubernetes", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rail-kubernetes.yaml" + }, + { + "repo": "railiance-apps", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-apps.yaml" + }, + { + "repo": "railiance-bootstrap", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-bootstrap.yaml" + }, + { + "repo": "railiance-cluster", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-cluster.yaml" + }, + { + "repo": "railiance-enablement", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-enablement.yaml" + }, + { + "repo": "railiance-fabric", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-fabric.yaml" + }, + { + "repo": "railiance-forge", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-forge.yaml" + }, + { + "repo": "railiance-infra", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-infra.yaml" + }, + { + "repo": "railiance-master", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-master.yaml" + }, + { + "repo": "railiance-platform", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-platform.yaml" + }, + { + "repo": "railiance-telemetry", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-telemetry.yaml" + }, + { + "repo": "rapp-playwright", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rapp-playwright.yaml" + }, + { + "repo": "reef-railiance", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reef-railiance.yaml" + }, + { + "repo": "rein-aharness", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rein-aharness.yaml" + }, + { + "repo": "rein-openweights", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rein-openweights.yaml" + }, + { + "repo": "repo-manager", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-manager.yaml" + }, + { + "repo": "repo-scoping", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-scoping.yaml" + }, + { + "repo": "repo-seed", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-seed.yaml" + }, + { + "repo": "resource-control", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/resource-control.yaml" + }, + { + "repo": "reuse-surface", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reuse-surface.yaml" + }, + { + "repo": "risk-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/risk-nexus.yaml" + }, + { + "repo": "role-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/role-engine.yaml" + }, + { + "repo": "runbook-tutorials", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/runbook-tutorials.yaml" + }, + { + "repo": "sand-boxer", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/sand-boxer.yaml" + }, + { + "repo": "sbom-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/sbom-nexus.yaml" + }, + { + "repo": "secrets-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/secrets-engine.yaml" + }, + { + "repo": "security-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/security-canon.yaml" + }, + { + "repo": "shard-wiki", + "count": 8, + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/shard-wiki.yaml" + }, + { + "repo": "state-hub", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/state-hub.yaml" + }, + { + "repo": "tegwick-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tegwick-control.yaml" + }, + { + "repo": "tenant-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tenant-engine.yaml" + }, + { + "repo": "the-custodian", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/the-custodian.yaml" + }, + { + "repo": "user-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/user-engine.yaml" + }, + { + "repo": "vantage-point", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vantage-point.yaml" + }, + { + "repo": "vergabe-teilnahme", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "repo": "whitehat-security", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whitehat-security.yaml" + }, + { + "repo": "whynot-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-control.yaml" + }, + { + "repo": "whynot-design", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-design.yaml" + }, + { + "repo": "zone-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/zone-engine.yaml" + } + ], + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Durable automation and bounded operations", + "summary": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "tags": [ + "activity", + "coordination", + "automation", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "activity-core", + "source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/activity-core.yaml" + }, + { + "id": "capability.agents.cli-assistant", + "name": "Console-Native LLM Assistant (cya)", + "summary": "Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "can-you-assist", + "path": "registry/capabilities/capability.agents.cli-assistant.md", + "tags": [ + "cli", + "assistant", + "llm", + "safety" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "can-you-assist", + "source_url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/can-you-assist.yaml" + }, + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Generic agent runtime and repository tooling", + "summary": "Agent runtime modules and repository classification tooling.", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "tags": [ + "agents", + "runtime", + "classification", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "the-custodian", + "source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/the-custodian.yaml" + }, + { + "id": "capability.agents.kaizen-framework", + "name": "Kaizen Agentic Framework", + "summary": "AI agency framework providing 20 deployable agent instruction sets, project memory, metrics, role and engagement contracts, and scheduled preparation for governed execution.", + "vector": "D3 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "kaizen-agentic", + "path": "registry/capabilities/capability.agents.kaizen-framework.md", + "tags": [ + "agents", + "memory", + "coordination", + "metrics", + "scheduling", + "engagements" + ], + "consumption_modes": [ + "cli", + "library import", + "file contracts" + ], + "source_repo": "kaizen-agentic", + "source_url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kaizen-agentic.yaml" + }, + { + "id": "capability.agents.llm-connector", + "name": "Pluggable LLM Adapter Library (llm-connect)", + "summary": "Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers.", + "vector": "D3 / A2 / C2 / R1", + "domain": "agents", + "status": "draft", + "owner": "llm-connect", + "path": "registry/capabilities/capability.agents.llm-connector.md", + "tags": [ + "llm", + "adapter", + "provider-neutral" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "llm-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/llm-connect.yaml" + }, + { + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "summary": "Capture sessions, curate patterns, distribute lessons and measure outcomes.", + "domain": "infotech", + "status": "draft", + "owner": "agentic-resources", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.performance-learning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "agentic-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/agentic-resources.yaml" + }, + { + "id": "capability.agents.repo-scoping-service", + "name": "Repository Scoping Service", + "summary": "Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "repo-scoping", + "path": "registry/capabilities/capability.agents.repo-scoping-service.md", + "tags": [ + "classification", + "scoping", + "registry" + ], + "consumption_modes": [ + "http api", + "library import", + "ui" + ], + "source_repo": "repo-scoping", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-scoping.yaml" + }, + { + "id": "capability.audit.event-retain", + "name": "Independent audit custody", + "summary": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.", + "domain": "infotech", + "status": "draft", + "owner": "audit-core", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C3 / R2", + "path": "registry/capabilities/capability.audit.event-retain.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "audit-core", + "source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/audit-core.yaml" + }, + { + "id": "capability.authorization.policy-evaluate", + "name": "Policy evaluation and decision evidence", + "summary": "Check, batch, list-allowed, explain, binding, lifetime and decision records.", + "domain": "helix_forge", + "status": "draft", + "owner": "access-engine", + "tags": [ + "authorization", + "policy", + "flex-auth", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "access-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/access-engine.yaml" + }, + { + "id": "capability.cmis.tck", + "name": "OpenCMIS Conformance-Preparation Extension", + "summary": "CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "open-cmis-tck", + "path": "registry/capabilities/capability.cmis.tck.md", + "tags": [ + "cmis", + "compliance", + "guide-board-extension" + ], + "consumption_modes": [ + "library import (guide-board extension)" + ], + "source_repo": "open-cmis-tck", + "source_url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-cmis-tck.yaml" + }, + { + "id": "capability.communication.compliance-evidence-framework", + "name": "Certification And Compliance Evidence Framework", + "summary": "Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture.", + "vector": "D2 / A2 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "guide-board", + "path": "registry/capabilities/capability.communication.compliance-evidence-framework.md", + "tags": [ + "compliance", + "certification", + "evidence", + "extensions" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "guide-board", + "source_url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/guide-board.yaml" + }, + { + "id": "capability.communication.context-engine", + "name": "Kontextual Engine (Knowledge Operations Runtime)", + "summary": "Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge.", + "vector": "D4 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "kontextual-engine", + "path": "registry/capabilities/capability.communication.context-engine.md", + "tags": [ + "knowledge", + "context", + "runtime" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "kontextual-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kontextual-engine.yaml" + }, + { + "id": "capability.communication.infospace-workspace", + "name": "Infospace Workspace And Evaluation Bench", + "summary": "Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main.", + "vector": "D3 / A1 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "infospace-bench", + "path": "registry/capabilities/capability.communication.infospace-workspace.md", + "tags": [ + "infospace", + "knowledge", + "evaluation" + ], + "consumption_modes": [ + "cli", + "library import (consumed by info-tech-canon)" + ], + "source_repo": "infospace-bench", + "source_url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/infospace-bench.yaml" + }, + { + "id": "capability.communication.markitect-legacy-platform", + "name": "MarkiTect Legacy Platform", + "summary": "Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-main", + "path": "registry/capabilities/capability.communication.markitect-legacy-platform.md", + "tags": [ + "markitect", + "markdown", + "legacy" + ], + "consumption_modes": [ + "application (legacy, not recommended for new integration)" + ], + "source_repo": "markitect-main", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-main.yaml" + }, + { + "id": "capability.communication.markitect-quarkdown-adapter", + "name": "Markitect Quarkdown Render Adapter", + "summary": "Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-quarkdown", + "path": "registry/capabilities/capability.communication.markitect-quarkdown-adapter.md", + "tags": [ + "markitect", + "quarkdown", + "adapter" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-quarkdown", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-quarkdown.yaml" + }, + { + "id": "capability.communication.markitect-source-adapters", + "name": "Markitect Source-Format Adapters", + "summary": "Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-filter", + "path": "registry/capabilities/capability.communication.markitect-source-adapters.md", + "tags": [ + "markitect", + "adapter", + "document-conversion" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-filter", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-filter.yaml" + }, + { + "id": "capability.communication.markitect-toolkit", + "name": "Markitect Markdown Toolkit And CLI", + "summary": "Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main.", + "vector": "D4 / A2 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "markitect-tool", + "path": "registry/capabilities/capability.communication.markitect-toolkit.md", + "tags": [ + "markitect", + "markdown", + "cli", + "toolkit" + ], + "consumption_modes": [ + "cli", + "library import" + ], + "source_repo": "markitect-tool", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-tool.yaml" + }, + { + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "summary": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime.", + "domain": "infotech", + "status": "draft", + "owner": "coordination-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.coordination.cross-owner-work.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "coordination-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/coordination-engine.yaml" + }, + { + "id": "capability.design.whynot-system", + "name": "Whynot Design System", + "summary": "Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters.", + "vector": "D3 / A2 / C2 / R1", + "domain": "consumer", + "status": "draft", + "owner": "whynot-design", + "path": "registry/capabilities/capability.design.whynot-system.md", + "tags": [ + "design-system", + "web-components", + "frontend" + ], + "consumption_modes": [ + "library import (npm)", + "cli", + "django template adapter" + ], + "source_repo": "whynot-design", + "source_url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whynot-design.yaml" + }, + { + "id": "capability.evidence.binding", + "name": "Evidence-to-Target Binding", + "summary": "Links evidence items to structured targets with relation, status, and confidence metadata, bidirectional queries, active-state coordination, and canonical engine events.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.binding.md", + "tags": [ + "evidence", + "binding", + "evidence-link", + "form-field", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React provider" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.evidence.rect-registry", + "name": "Visual-Guide Rect Registry", + "summary": "Coordinates field, evidence-card, and highlight rectangles from independent renderers so an SVG overlay can draw the active visual guide without polling.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.rect-registry.md", + "tags": [ + "rect-registry", + "visual-guide", + "overlay", + "active-state", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React component" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.execution.openweight-rein", + "name": "Bounded open-weight agent execution", + "summary": "Tool loop, path guards, turn/budget limits and verified-commit result.", + "domain": "infotech", + "status": "draft", + "owner": "rein-openweights", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.execution.openweight-rein.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rein-openweights", + "source_url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rein-openweights.yaml" + }, + { + "id": "capability.execution.profile-harness", + "name": "Profile-bound agent execution lifecycle", + "summary": "Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration.", + "domain": "infotech", + "status": "draft", + "owner": "glas-harness", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.execution.profile-harness.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "glas-harness", + "source_url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/glas-harness.yaml" + }, + { + "id": "capability.execution.sandbox-provision", + "name": "Sandbox establishment and lifecycle", + "summary": "Profiles, extensions, provision, checkpoints, TTL teardown and telemetry.", + "domain": "infotech", + "status": "draft", + "owner": "sand-boxer", + "tags": [ + "sandbox", + "isolation", + "provision", + "e2e", + "agentic", + "execution", + "profile", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D5 / A5 / C5 / R0", + "path": "registry/capabilities/execution.sandbox-provision.md", + "consumption_modes": [ + "containerized service", + "CLI" + ], + "source_repo": "sand-boxer", + "source_url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/sand-boxer.yaml" + }, + { + "id": "capability.execution.scheduled-agent-rein", + "name": "Scheduled agent intake and harness routing", + "summary": "Activity Core lease claim/heartbeat and Glas profile execution.", + "domain": "infotech", + "status": "draft", + "owner": "rein-aharness", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.execution.scheduled-agent-rein.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rein-aharness", + "source_url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rein-aharness.yaml" + }, + { + "id": "capability.feature-control.evaluate", + "name": "Feature Availability Evaluation", + "summary": "Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context.", + "vector": "D5 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.evaluate.md", + "tags": [ + "feature-control", + "evaluation", + "sdk" + ], + "consumption_modes": [ + "SDK", + "service API" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.rollout", + "name": "Feature Rollout Control", + "summary": "Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.rollout.md", + "tags": [ + "feature-control", + "rollout", + "planning" + ], + "consumption_modes": [ + "source module", + "SDK" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.visibility", + "name": "Feature Visibility Control", + "summary": "Control whether features are visible or hidden for subjects without changing entitlement or authorization.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.visibility.md", + "tags": [ + "feature-control", + "visibility" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.finance.security-budget-evidence", + "name": "Budget and cost evidence for security operations", + "summary": "Budget, commitment, spend attribution and planning-evidence consumption.", + "domain": "infotech", + "status": "draft", + "owner": "fin-hub", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.finance.security-budget-evidence.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "fin-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/fin-hub.yaml" + }, + { + "id": "capability.graph.nbgm-spec", + "name": "Network-Based Graph Model (NBGM) Specification", + "summary": "Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains.", + "vector": "D2 / A0 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "vantage-point", + "path": "registry/capabilities/capability.graph.nbgm-spec.md", + "tags": [ + "graph", + "nbgm", + "specification" + ], + "consumption_modes": [ + "informational (specification only)" + ], + "source_repo": "vantage-point", + "source_url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vantage-point.yaml" + }, + { + "id": "capability.hr.workflow-catalog", + "name": "HR Workflow Catalog", + "summary": "Markdown-first registry of HR planning workflows with an iterative assessment loop tied to INTENT phases.", + "vector": "D3 / A1 / C1 / R0", + "domain": "consumer", + "status": "draft", + "owner": "human-resources", + "path": "registry/capabilities/capability.hr.workflow-catalog.md", + "tags": [ + "hr", + "workflows", + "assessment", + "planning" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "human-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/human-resources.yaml" + }, + { + "id": "capability.iam.key-cape", + "name": "OIDC identity and assurance", + "summary": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.iam.key-cape.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "key-cape", + "source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/key-cape.yaml" + }, + { + "id": "capability.identity.subject-resolution", + "name": "Identity Subject Resolution", + "summary": "Resolve who or what is acting by mapping principals, accounts, actors, and identifiers to a stable subject model.", + "vector": "D3 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.subject-resolution.md", + "tags": [ + "identity", + "subject", + "architecture" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.identity.tenant-facts", + "name": "Tenant lifecycle and guardrail facts", + "summary": "Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.", + "domain": "infotech", + "status": "draft", + "owner": "tenant-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.identity.tenant-facts.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "tenant-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/tenant-engine.yaml" + }, + { + "id": "capability.identity.user-engine", + "name": "User lifecycle and account journeys", + "summary": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog.", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "tags": [ + "identity", + "user-management", + "multi-tenant", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R0", + "path": "registry/capabilities/capability.identity.user-engine.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "user-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/user-engine.yaml" + }, + { + "id": "capability.identity.vocabulary-canonicalize", + "name": "Identity Vocabulary Canonicalization", + "summary": "Define an implementation-neutral vocabulary for identity-related concepts across overlapping domains.", + "vector": "D4 / A0 / C2 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.vocabulary-canonicalize.md", + "tags": [ + "identity", + "terminology", + "research" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.infotech.artifact-store", + "name": "Artifact Registry And Storage Gateway", + "summary": "Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "artifact-store", + "path": "registry/capabilities/capability.infotech.artifact-store.md", + "tags": [ + "artifact", + "storage", + "provenance", + "registry" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "artifact-store", + "source_url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/artifact-store.yaml" + }, + { + "id": "capability.infotech.canon-service", + "name": "Shared semantic contracts and validation", + "summary": "Markdown canon with library, CLI and read-only API.", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "tags": [ + "canon", + "infospace", + "service", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "info-tech-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/info-tech-canon.yaml" + }, + { + "id": "capability.infotech.citation-engine", + "name": "Citation Evidence Domain Engine", + "summary": "Core domain model and engine services for the citation-evidence ecosystem \u2014 shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-engine", + "path": "registry/capabilities/capability.infotech.citation-engine.md", + "tags": [ + "citation", + "evidence", + "domain-model" + ], + "consumption_modes": [ + "library import (workspace link)" + ], + "source_repo": "citation-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-engine.yaml" + }, + { + "id": "capability.infotech.citation-evidence-workspace", + "name": "Citation Evidence Workspace", + "summary": "Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations \u2014 the umbrella application over the citation-evidence six-package design.", + "vector": "D4 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-evidence", + "path": "registry/capabilities/capability.infotech.citation-evidence-workspace.md", + "tags": [ + "citation", + "evidence", + "workspace" + ], + "consumption_modes": [ + "application (local dev server)" + ], + "source_repo": "citation-evidence", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-evidence.yaml" + }, + { + "id": "capability.infotech.config-surface-atlas", + "name": "Configuration Surface Atlas", + "summary": "Read-first, cross-kind map and evidence layer for configuration surfaces \u2014 what configures a system, who owns it, its scope, and where the source of truth lives.", + "vector": "D5 / A0 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "config-atlas", + "path": "registry/capabilities/capability.infotech.config-surface-atlas.md", + "tags": [ + "configuration", + "registry", + "control-plane", + "effective-config", + "evidence" + ], + "consumption_modes": [ + "informational", + "source module" + ], + "source_repo": "config-atlas", + "source_url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/config-atlas.yaml" + }, + { + "id": "capability.infotech.core-hub", + "name": "Core Hub Production Interaction Framework", + "summary": "Contract-first framework for cross-domain state, agent coordination, evidence, registries, workplans, and operator interaction surfaces.", + "vector": "D3 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "core-hub", + "path": "registry/capabilities/capability.infotech.core-hub.md", + "tags": [ + "interaction-framework", + "state-hub", + "inter-hub-successor", + "agent-coordination", + "registry", + "api" + ], + "consumption_modes": [ + "informational", + "planning", + "cli" + ], + "source_repo": "core-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/core-hub.yaml" + }, + { + "id": "capability.infotech.email-connector", + "name": "Mailbox Evidence Scanner (email-connect)", + "summary": "Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "email-connect", + "path": "registry/capabilities/capability.infotech.email-connector.md", + "tags": [ + "email", + "evidence", + "coordination" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "email-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/email-connect.yaml" + }, + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.infotech.hub-core-library", + "name": "Reusable FOS Hub Core Primitives", + "summary": "Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "hub-core", + "path": "registry/capabilities/capability.infotech.hub-core-library.md", + "tags": [ + "hub", + "fastapi", + "sqlalchemy", + "mcp" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "hub-core", + "source_url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/hub-core.yaml" + }, + { + "id": "capability.infotech.issue-tracking", + "name": "External issue tracker connector", + "summary": "CLI and Python adapters for external issue systems.", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "tags": [ + "issue-tracking", + "connector", + "work-record", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "issue-core", + "source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/issue-core.yaml" + }, + { + "id": "capability.infotech.oss-integration-continuity", + "name": "Managed Continuity For OSS Integrations", + "summary": "Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "open-reuse", + "path": "registry/capabilities/capability.infotech.oss-integration-continuity.md", + "tags": [ + "oss", + "integration", + "maintenance" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "open-reuse", + "source_url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-reuse.yaml" + }, + { + "id": "capability.infotech.pdf-evidence-ingest", + "name": "Headless PDF Evidence Ingest", + "summary": "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "evidence-source", + "path": "registry/capabilities/capability.infotech.pdf-evidence-ingest.md", + "tags": [ + "pdf", + "ingest", + "fingerprint", + "canonical-text", + "evidence" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "evidence-source", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-source.yaml" + }, + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ], + "source_repo": "repo-seed", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-seed.yaml" + }, + { + "id": "capability.infotech.runbook-tutorials", + "name": "Guided administrative runbooks", + "summary": "Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.", + "domain": "infotech", + "status": "draft", + "owner": "runbook-tutorials", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "runbook-tutorials", + "source_url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/runbook-tutorials.yaml" + }, + { + "id": "capability.infotech.sbom-management", + "name": "Dependency provenance and SBOM evidence", + "summary": "Controlled archive ingest, immutable snapshots, freshness and license review.", + "domain": "infotech", + "status": "draft", + "owner": "sbom-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.sbom-management.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "sbom-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/sbom-nexus.yaml" + }, + { + "id": "capability.memory.phase-planning", + "name": "Profile-Driven Memory Phase Planning (phase-memory)", + "summary": "Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "phase-memory", + "path": "registry/capabilities/capability.memory.phase-planning.md", + "tags": [ + "memory", + "agentic", + "planning" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "phase-memory", + "source_url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/phase-memory.yaml" + }, + { + "id": "capability.observability.security-signals", + "name": "Security-relevant telemetry contracts and adapters", + "summary": "Signal contract, platform adapters, report exporter and absence/alert rules.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-telemetry", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.observability.security-signals.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-telemetry", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-telemetry.yaml" + }, + { + "id": "capability.operations.ops-hub", + "name": "Operations Hub Extension Contract", + "summary": "Versioned hub-extension package and bootstrap client for operational truth, service-catalog records, readiness evidence, and migration gates.", + "vector": "D3 / A1 / C1 / R1", + "domain": "operations", + "status": "reviewed", + "owner": "ops-hub", + "path": "registry/capabilities/capability.operations.ops-hub.md", + "tags": [ + "operations", + "service-catalog", + "readiness", + "hub-extension" + ], + "consumption_modes": [ + "contract package", + "command-line bootstrap" + ], + "source_repo": "ops-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-hub.yaml" + }, + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH tunnel lifecycle", + "summary": "Named tunnels, reconnect, health and TTL-aware cert_command.", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-bridge", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-bridge.yaml" + }, + { + "id": "capability.organization.role-catalog", + "name": "Organizational role definitions", + "summary": "Versioned documentation catalog.", + "domain": "infotech", + "status": "draft", + "owner": "role-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.organization.role-catalog.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "role-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/role-engine.yaml" + }, + { + "id": "capability.procurement.vergabe-teilnahme", + "name": "Vergabe Teilnahme (Public Procurement Participation) Application", + "summary": "Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation \u2014 Ausschreibungs- und Teilnahme-Management-System.", + "vector": "D3 / A1 / C1 / R1", + "domain": "communication", + "status": "draft", + "owner": "vergabe-teilnahme", + "path": "registry/capabilities/capability.procurement.vergabe-teilnahme.md", + "tags": [ + "procurement", + "django", + "vergabe" + ], + "consumption_modes": [ + "application (Django + Vite, local dev via docker-compose)" + ], + "source_repo": "vergabe-teilnahme", + "source_url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "id": "capability.railiance.bootstrap-sequencing", + "name": "Bootstrap sequencing contracts", + "summary": "Bare-VM to estate sequence and handoff contract.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-bootstrap", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.bootstrap-sequencing.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "railiance-bootstrap", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-bootstrap.yaml" + }, + { + "id": "capability.railiance.browser-verification", + "name": "Managed browser verification pilot", + "summary": "Bounded jobs, cancellation, artifacts, origin checks and restart receipts.", + "domain": "infotech", + "status": "draft", + "owner": "rapp-playwright", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.railiance.browser-verification.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "rapp-playwright", + "source_url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rapp-playwright.yaml" + }, + { + "id": "capability.railiance.ci-enablement", + "name": "Developer delivery and CI templates", + "summary": "Reusable CI workflows, build and deployment patterns.", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-enablement", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-enablement.yaml" + }, + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Kubernetes runtime and cluster controls", + "summary": "k3s, ingress, CNI, operators and kubeconfig/runtime checks.", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-cluster", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-cluster.yaml" + }, + { + "id": "capability.railiance.fabric-graph", + "name": "Infrastructure ownership and dependency graph", + "summary": "Schemas, validation, graph queries and State Hub exports.", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-fabric", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-fabric.yaml" + }, + { + "id": "capability.railiance.forge-infrastructure", + "name": "Source forge, registries and runner substrate", + "summary": "Forgejo operation, package registries and runner lifecycle.", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.railiance.infra-provisioning", + "name": "Host convergence and security baseline", + "summary": "Ansible inventory, firewall, SSH bootstrap and baseline verification.", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-infra", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-infra.yaml" + }, + { + "id": "capability.railiance.knative-rail", + "name": "Knative workload lifecycle", + "summary": "Derived rail for activation, revisions, traffic, scaling and rollback.", + "domain": "infotech", + "status": "draft", + "owner": "rail-knative", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.knative-rail.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rail-knative", + "source_url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rail-knative.yaml" + }, + { + "id": "capability.railiance.kubernetes-rail", + "name": "Generic Kubernetes workload lifecycle", + "summary": "Workload declaration, rollout, observe, promote and rollback surfaces.", + "domain": "infotech", + "status": "draft", + "owner": "rail-kubernetes", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.kubernetes-rail.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rail-kubernetes", + "source_url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rail-kubernetes.yaml" + }, + { + "id": "capability.railiance.platform-services", + "name": "Secret custody and platform data services", + "summary": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-platform", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-platform.yaml" + }, + { + "id": "capability.railiance.security-consumption-contracts", + "name": "Platform security consumption architecture", + "summary": "Rail/rapp/reef boundaries, exposure and security consumption contracts.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-master", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.security-consumption-contracts.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "railiance-master", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-master.yaml" + }, + { + "id": "capability.railiance.substrate-bindings", + "name": "Substrate topology and bindings", + "summary": "Grouped home-reef identity, topology and placement declarations.", + "domain": "infotech", + "status": "draft", + "owner": "reef-railiance", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.substrate-bindings.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "reef-railiance", + "source_url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reef-railiance.yaml" + }, + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Workload release configuration and guards", + "summary": "Helm/manifests, exact image pins, application runbooks and rollout/rollback.", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-apps", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-apps.yaml" + }, + { + "id": "capability.registry.register", + "name": "Capability registry and federation", + "summary": "Owner Markdown entries, indexes, federation hub and planning queries.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "governance", + "meta", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C2 / R3", + "path": "registry/capabilities/capability.registry.register.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.registry.validate", + "name": "Capability registry validation", + "summary": "Schema, index consistency and relation checks.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "validation", + "cli", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R3", + "path": "registry/capabilities/capability.registry.validate.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.resources.security-capacity", + "name": "Capacity and recovery resource planning", + "summary": "Provider-neutral inventory, procurement evidence and optimization reports.", + "domain": "infotech", + "status": "draft", + "owner": "resource-control", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.resources.security-capacity.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "resource-control", + "source_url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/resource-control.yaml" + }, + { + "id": "capability.security.access-routing", + "name": "Credential routing and contained access", + "summary": "warden route and access catalog; exact lane conduit and secret-exec routing.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.security.access-routing.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.adversarial-evidence", + "name": "Authorized adversarial evidence harness", + "summary": "Offline ASM and tenancy calibrations and engagement admission.", + "domain": "infotech", + "status": "draft", + "owner": "whitehat-security", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.adversarial-evidence.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "whitehat-security", + "source_url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whitehat-security.yaml" + }, + { + "id": "capability.security.agent-knowledge", + "name": "Verified security orientation for agents", + "summary": "Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports.", + "domain": "infotech", + "status": "draft", + "owner": "emergent-security", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.agent-knowledge.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "emergent-security", + "source_url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/emergent-security.yaml" + }, + { + "id": "capability.security.approval-lifecycle", + "name": "Bound approval lifecycle", + "summary": "Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.", + "domain": "infotech", + "status": "draft", + "owner": "approval-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.security.approval-lifecycle.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "approval-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/approval-engine.yaml" + }, + { + "id": "capability.security.bootstrap-recovery", + "name": "Guarded bootstrap and recovery preparation", + "summary": "Local identity, bootstrap console, encrypted custody handoff and caller tools.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.bootstrap-recovery.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-contracts", + "name": "Security case types and instance validation", + "summary": "Versioned types, cases and schema validation.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-contracts.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-follow-through", + "name": "Security case operational follow-through", + "summary": "KnownSecurityCase route, plan and operational receipts.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-follow-through.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.credential-lifecycle", + "name": "Cataloged credential lifecycle", + "summary": "CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.", + "domain": "infotech", + "status": "draft", + "owner": "secrets-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.credential-lifecycle.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "secrets-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/secrets-engine.yaml" + }, + { + "id": "capability.security.doctrine-review", + "name": "Security doctrine and architecture review", + "summary": "Layer rules, authority context, ASM criteria and interpretations.", + "domain": "infotech", + "status": "draft", + "owner": "gate-house", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.security.doctrine-review.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "gate-house", + "source_url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/gate-house.yaml" + }, + { + "id": "capability.security.emission-profile", + "name": "Security emission cadence validation", + "summary": "Security profile over generic emission contracts and validator.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.emission-profile.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.forge-secret-prevention", + "name": "Independent introduced-history secret prevention", + "summary": "Pinned receive adapter, lifecycle template and fail-closed scan.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.forge-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.security.human-decision-workspace", + "name": "Human security decision presentation and disposition", + "summary": "Headless lifecycle and browser workspace with exact native approval references.", + "domain": "infotech", + "status": "draft", + "owner": "informed-decision", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.security.human-decision-workspace.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "informed-decision", + "source_url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/informed-decision.yaml" + }, + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom security architecture and conformance tooling", + "summary": "Versioned IAM, layer, tenancy and credential contracts plus validators.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.maturity-claims", + "name": "Evidence-based maturity claims and gap register", + "summary": "SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory.", + "domain": "infotech", + "status": "draft", + "owner": "maturity-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.maturity-claims.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "maturity-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/maturity-engine.yaml" + }, + { + "id": "capability.security.policy-publication", + "name": "Policy publication with source provenance", + "summary": "Generated immutable publication, source currency and stable policy URLs.", + "domain": "infotech", + "status": "draft", + "owner": "policy-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.policy-publication.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "policy-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/policy-nexus.yaml" + }, + { + "id": "capability.security.posture-assessment", + "name": "Security posture assessment and response proposals", + "summary": "Normalized observation evaluator, cadence checks and secret-use snapshot adapter.", + "domain": "infotech", + "status": "draft", + "owner": "kings-guard", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-assessment.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "kings-guard", + "source_url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kings-guard.yaml" + }, + { + "id": "capability.security.posture-feedback", + "name": "Deterministic posture feedback", + "summary": "CLI evaluates evidence age and posture into owner-routed findings.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-feedback.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.practice-canon", + "name": "Security practice and authority vocabulary", + "summary": "Versioned SEC-DSM and Mode of Authority documents.", + "domain": "infotech", + "status": "draft", + "owner": "security-canon", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.security.practice-canon.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "security-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/security-canon.yaml" + }, + { + "id": "capability.security.repository-secret-prevention", + "name": "Repository metadata and staged-secret prevention", + "summary": "Repository observation plus pinned staged-blob scanner and hook integration.", + "domain": "infotech", + "status": "draft", + "owner": "repo-manager", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.repository-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "repo-manager", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-manager.yaml" + }, + { + "id": "capability.security.risk-register", + "name": "Security risk and exception review register", + "summary": "Markdown findings and Python review, verification and due-work reports.", + "domain": "infotech", + "status": "draft", + "owner": "risk-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.risk-register.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "risk-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/risk-nexus.yaml" + }, + { + "id": "capability.security.scenario-compose", + "name": "Deterministic security scenario composition", + "summary": "CLI selects pinned providers and orders trust transitions.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.scenario-compose.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.ssh-certificate-issuance", + "name": "Decision-bound SSH certificates", + "summary": "warden sign with local and OpenBao backends and adm/agt/atm actors.", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R2", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.structure-construction", + "name": "Reviewed security structure construction", + "summary": "Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.", + "domain": "infotech", + "status": "draft", + "owner": "ops-mason", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.structure-construction.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-mason", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-mason.yaml" + }, + { + "id": "capability.security.zone-reference", + "name": "Zone membership reference conformance", + "summary": "Offline resolution, exception and lineage checks.", + "domain": "infotech", + "status": "draft", + "owner": "zone-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.zone-reference.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "zone-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/zone-engine.yaml" + }, + { + "id": "capability.statehub.progress-log", + "name": "Progress and work evidence indexing", + "summary": "REST progress and task evidence references.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "progress", + "coordination", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R3", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Cross-repository work tracking", + "summary": "File-derived workplans, tasks, dependencies, decisions and coordination views.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "coordination", + "workplans", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R2", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.wiki.adapter-contract", + "name": "Capability-Aware Shard Adapter Contract", + "summary": "A versioned backend interface where each binding declares a verified capability profile, so federation ops degrade by capability.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.adapter-contract.md", + "tags": [ + "wiki", + "adapter", + "capability", + "contract", + "conformance", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.coordination-journal", + "name": "Event-Sourced Coordination Journal", + "summary": "An append-only, totally-ordered-per-space decision log whose current state is a derived fold; git-addressable history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.coordination-journal.md", + "tags": [ + "wiki", + "event-sourcing", + "coordination", + "git", + "journal", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.derived-views", + "name": "Wiki Derived Views", + "summary": "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges, AllPages, SiteMap, and (delegate-or-derive) Search \u2014 carrying provenance.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.derived-views.md", + "tags": [ + "wiki", + "derived-views", + "backlinks", + "recentchanges", + "search", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.engine-typed-extensions", + "name": "Wiki Engine with Typed Extensions", + "summary": "A small-core wiki engine realizing a typed-extension framework that addresses all wiki use cases and lets each shard activate only the features it needs.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.engine-typed-extensions.md", + "tags": [ + "wiki", + "engine", + "typed-extensions", + "feature-activation", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.federation-models", + "name": "Selectable Federation-Model Taxonomy", + "summary": "Federation as a plural, composable coordination axis (fork+journal, VCS-replication, query-join, feed, activity-streams, engine-mirror) selected per space.", + "vector": "D4 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.federation-models.md", + "tags": [ + "wiki", + "federation", + "taxonomy", + "composable", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.overlay", + "name": "Overlay-Before-Mutation Write Path", + "summary": "Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only or limited backends be edited safely without silent remote mutation.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.overlay.md", + "tags": [ + "wiki", + "overlay", + "patch", + "write-path", + "conflict", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.page-model", + "name": "Backend-Neutral Wiki Page Model", + "summary": "A Markdown-first but stretchable page model with stable identity separate from placement and layered provenance.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.page-model.md", + "tags": [ + "wiki", + "page-model", + "identity", + "provenance", + "markdown", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.shard-orchestration", + "name": "Wiki Shard Orchestration", + "summary": "Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.shard-orchestration.md", + "tags": [ + "wiki", + "federation", + "orchestration", + "union", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + } + ], + "composed_at": "2026-10-14T22:34:30+00:00", + "stale": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-after-public-registration.json b/docs/assessments/netkingdom-2026-10-14/hosted-after-public-registration.json new file mode 100644 index 00000000..6d7c3aca --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-after-public-registration.json @@ -0,0 +1,3023 @@ +{ + "version": 1, + "updated": "2026-10-14", + "domain": "helix_forge", + "collision_policy": "warn", + "sources": [ + { + "repo": "access-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/access-engine.yaml" + }, + { + "repo": "activity-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/activity-core.yaml" + }, + { + "repo": "agentic-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/agentic-resources.yaml" + }, + { + "repo": "approval-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/approval-engine.yaml" + }, + { + "repo": "artifact-store", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/artifact-store.yaml" + }, + { + "repo": "audit-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/audit-core.yaml" + }, + { + "repo": "can-you-assist", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/can-you-assist.yaml" + }, + { + "repo": "citation-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-engine.yaml" + }, + { + "repo": "citation-evidence", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-evidence.yaml" + }, + { + "repo": "citation-work", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/citation-work/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/citation-work.yaml" + }, + { + "repo": "commerce-canon", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/commerce-canon.yaml" + }, + { + "repo": "config-atlas", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/config-atlas.yaml" + }, + { + "repo": "coordination-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/coordination-engine.yaml" + }, + { + "repo": "core-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/core-hub.yaml" + }, + { + "repo": "domain-tree", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/domain-tree/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/domain-tree.yaml" + }, + { + "repo": "email-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/email-connect.yaml" + }, + { + "repo": "emergent-security", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/emergent-security.yaml" + }, + { + "repo": "evidence-anchor", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/evidence-anchor/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-anchor.yaml" + }, + { + "repo": "evidence-binder", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-binder.yaml" + }, + { + "repo": "evidence-source", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/evidence-source.yaml" + }, + { + "repo": "feature-control", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/feature-control.yaml" + }, + { + "repo": "fin-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/fin-hub.yaml" + }, + { + "repo": "gate-house", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/gate-house.yaml" + }, + { + "repo": "glas-harness", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/glas-harness.yaml" + }, + { + "repo": "guide-board", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/guide-board.yaml" + }, + { + "repo": "helix-forge", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/helix-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/helix-forge.yaml" + }, + { + "repo": "hub-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/hub-core.yaml" + }, + { + "repo": "human-resources", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/human-resources.yaml" + }, + { + "repo": "ihp-railiance-probe", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/ihp-railiance-probe/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ihp-railiance-probe.yaml" + }, + { + "repo": "info-tech-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/info-tech-canon.yaml" + }, + { + "repo": "informed-decision", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/informed-decision.yaml" + }, + { + "repo": "infospace-bench", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/infospace-bench.yaml" + }, + { + "repo": "issue-core", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/issue-core.yaml" + }, + { + "repo": "kaizen-agentic", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kaizen-agentic.yaml" + }, + { + "repo": "key-cape", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/key-cape.yaml" + }, + { + "repo": "kings-guard", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kings-guard.yaml" + }, + { + "repo": "kontextual-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/kontextual-engine.yaml" + }, + { + "repo": "llm-connect", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/llm-connect.yaml" + }, + { + "repo": "markitect-filter", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-filter.yaml" + }, + { + "repo": "markitect-main", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-main.yaml" + }, + { + "repo": "markitect-quarkdown", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-quarkdown.yaml" + }, + { + "repo": "markitect-tool", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/markitect-tool.yaml" + }, + { + "repo": "maturity-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/maturity-engine.yaml" + }, + { + "repo": "net-kingdom", + "count": 6, + "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/net-kingdom.yaml" + }, + { + "repo": "open-cmis-tck", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-cmis-tck.yaml" + }, + { + "repo": "open-reuse", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/open-reuse.yaml" + }, + { + "repo": "ops-bridge", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-bridge.yaml" + }, + { + "repo": "ops-hub", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-hub.yaml" + }, + { + "repo": "ops-mason", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-mason.yaml" + }, + { + "repo": "ops-warden", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/ops-warden.yaml" + }, + { + "repo": "phase-memory", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/phase-memory.yaml" + }, + { + "repo": "policy-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/policy-nexus.yaml" + }, + { + "repo": "rail-knative", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rail-knative.yaml" + }, + { + "repo": "rail-kubernetes", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rail-kubernetes.yaml" + }, + { + "repo": "railiance-apps", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-apps.yaml" + }, + { + "repo": "railiance-bootstrap", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-bootstrap.yaml" + }, + { + "repo": "railiance-cluster", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-cluster.yaml" + }, + { + "repo": "railiance-enablement", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-enablement.yaml" + }, + { + "repo": "railiance-fabric", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-fabric.yaml" + }, + { + "repo": "railiance-forge", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-forge.yaml" + }, + { + "repo": "railiance-infra", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-infra.yaml" + }, + { + "repo": "railiance-master", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-master.yaml" + }, + { + "repo": "railiance-platform", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-platform.yaml" + }, + { + "repo": "railiance-telemetry", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/railiance-telemetry.yaml" + }, + { + "repo": "rapp-playwright", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rapp-playwright.yaml" + }, + { + "repo": "reef-railiance", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reef-railiance.yaml" + }, + { + "repo": "rein-aharness", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rein-aharness.yaml" + }, + { + "repo": "rein-openweights", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/rein-openweights.yaml" + }, + { + "repo": "repo-manager", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-manager.yaml" + }, + { + "repo": "repo-scoping", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-scoping.yaml" + }, + { + "repo": "repo-seed", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/repo-seed.yaml" + }, + { + "repo": "resource-control", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/resource-control.yaml" + }, + { + "repo": "reuse-surface", + "count": 3, + "url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/reuse-surface.yaml" + }, + { + "repo": "risk-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/risk-nexus.yaml" + }, + { + "repo": "role-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/role-engine.yaml" + }, + { + "repo": "runbook-tutorials", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/runbook-tutorials.yaml" + }, + { + "repo": "sand-boxer", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/sand-boxer.yaml" + }, + { + "repo": "sbom-nexus", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/sbom-nexus.yaml" + }, + { + "repo": "secrets-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/secrets-engine.yaml" + }, + { + "repo": "security-canon", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/security-canon.yaml" + }, + { + "repo": "shard-wiki", + "count": 8, + "url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/shard-wiki.yaml" + }, + { + "repo": "state-hub", + "count": 2, + "url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/state-hub.yaml" + }, + { + "repo": "tegwick-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/tegwick-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tegwick-control.yaml" + }, + { + "repo": "tenant-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/tenant-engine.yaml" + }, + { + "repo": "the-custodian", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/the-custodian.yaml" + }, + { + "repo": "user-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/user-engine.yaml" + }, + { + "repo": "vantage-point", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vantage-point.yaml" + }, + { + "repo": "vergabe-teilnahme", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "repo": "whitehat-security", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whitehat-security.yaml" + }, + { + "repo": "whynot-control", + "count": 0, + "url": "https://forgejo.coulomb.social/coulomb/whynot-control/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-control.yaml" + }, + { + "repo": "whynot-design", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/whynot-design.yaml" + }, + { + "repo": "zone-engine", + "count": 1, + "url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "cache": "/data/cache/zone-engine.yaml" + } + ], + "capabilities": [ + { + "id": "capability.activity.event-coordinate", + "name": "Durable automation and bounded operations", + "summary": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.", + "domain": "helix_forge", + "status": "draft", + "owner": "activity-core", + "tags": [ + "activity", + "coordination", + "automation", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.activity.event-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "activity-core", + "source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/activity-core.yaml" + }, + { + "id": "capability.agents.cli-assistant", + "name": "Console-Native LLM Assistant (cya)", + "summary": "Console-native, backend-agnostic assistant CLI that expresses user intent in natural language and returns safe, explainable, context-aware help.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "can-you-assist", + "path": "registry/capabilities/capability.agents.cli-assistant.md", + "tags": [ + "cli", + "assistant", + "llm", + "safety" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "can-you-assist", + "source_url": "https://forgejo.coulomb.social/coulomb/can-you-assist/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/can-you-assist.yaml" + }, + { + "id": "capability.agents.custodian-runtime-tooling", + "name": "Generic agent runtime and repository tooling", + "summary": "Agent runtime modules and repository classification tooling.", + "domain": "custodian", + "status": "draft", + "owner": "the-custodian", + "tags": [ + "agents", + "runtime", + "classification", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "the-custodian", + "source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/the-custodian.yaml" + }, + { + "id": "capability.agents.kaizen-framework", + "name": "Kaizen Agentic Framework", + "summary": "AI agency framework providing 20 deployable agent instruction sets, project memory, metrics, role and engagement contracts, and scheduled preparation for governed execution.", + "vector": "D3 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "kaizen-agentic", + "path": "registry/capabilities/capability.agents.kaizen-framework.md", + "tags": [ + "agents", + "memory", + "coordination", + "metrics", + "scheduling", + "engagements" + ], + "consumption_modes": [ + "cli", + "library import", + "file contracts" + ], + "source_repo": "kaizen-agentic", + "source_url": "https://forgejo.coulomb.social/coulomb/kaizen-agentic/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kaizen-agentic.yaml" + }, + { + "id": "capability.agents.llm-connector", + "name": "Pluggable LLM Adapter Library (llm-connect)", + "summary": "Provider-neutral Python/CLI LLM adapter library supporting OpenRouter, Gemini, OpenAI, and the Claude Code CLI out of the box, with a clean abstract interface for adding new providers.", + "vector": "D3 / A2 / C2 / R1", + "domain": "agents", + "status": "draft", + "owner": "llm-connect", + "path": "registry/capabilities/capability.agents.llm-connector.md", + "tags": [ + "llm", + "adapter", + "provider-neutral" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "llm-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/llm-connect.yaml" + }, + { + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "summary": "Capture sessions, curate patterns, distribute lessons and measure outcomes.", + "domain": "infotech", + "status": "draft", + "owner": "agentic-resources", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.performance-learning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "agentic-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/agentic-resources.yaml" + }, + { + "id": "capability.agents.repo-scoping-service", + "name": "Repository Scoping Service", + "summary": "Maps repositories from usefulness to implementation (Ability -> Capability -> Feature -> Evidence -> Code location) via a Python registry core, FastAPI HTTP API, and curator UI.", + "vector": "D2 / A2 / C1 / R0", + "domain": "agents", + "status": "draft", + "owner": "repo-scoping", + "path": "registry/capabilities/capability.agents.repo-scoping-service.md", + "tags": [ + "classification", + "scoping", + "registry" + ], + "consumption_modes": [ + "http api", + "library import", + "ui" + ], + "source_repo": "repo-scoping", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-scoping/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-scoping.yaml" + }, + { + "id": "capability.audit.event-retain", + "name": "Independent audit custody", + "summary": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.", + "domain": "infotech", + "status": "draft", + "owner": "audit-core", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C3 / R2", + "path": "registry/capabilities/capability.audit.event-retain.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "audit-core", + "source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/audit-core.yaml" + }, + { + "id": "capability.authorization.policy-evaluate", + "name": "Policy evaluation and decision evidence", + "summary": "Check, batch, list-allowed, explain, binding, lifetime and decision records.", + "domain": "helix_forge", + "status": "draft", + "owner": "access-engine", + "tags": [ + "authorization", + "policy", + "flex-auth", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "access-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/access-engine.yaml" + }, + { + "id": "capability.cmis.tck", + "name": "OpenCMIS Conformance-Preparation Extension", + "summary": "CMIS conformance-preparation extension for guide-board, keeping CMIS-specific runner code, profiles, capability mappings, and workplans outside the generic compliance framework.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "open-cmis-tck", + "path": "registry/capabilities/capability.cmis.tck.md", + "tags": [ + "cmis", + "compliance", + "guide-board-extension" + ], + "consumption_modes": [ + "library import (guide-board extension)" + ], + "source_repo": "open-cmis-tck", + "source_url": "https://forgejo.coulomb.social/coulomb/open-cmis-tck/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-cmis-tck.yaml" + }, + { + "id": "capability.communication.compliance-evidence-framework", + "name": "Certification And Compliance Evidence Framework", + "summary": "Framework that turns standards, conformance, regulatory, and repository-quality claims into structured, reviewable, repeatable, comparable evidence via a pluggable extension architecture.", + "vector": "D2 / A2 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "guide-board", + "path": "registry/capabilities/capability.communication.compliance-evidence-framework.md", + "tags": [ + "compliance", + "certification", + "evidence", + "extensions" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "guide-board", + "source_url": "https://forgejo.coulomb.social/coulomb/guide-board/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/guide-board.yaml" + }, + { + "id": "capability.communication.context-engine", + "name": "Kontextual Engine (Knowledge Operations Runtime)", + "summary": "Headless knowledge-operations engine turning heterogeneous information assets into persistent, contextual, governed, retrievable, transformable, and agent-operable knowledge.", + "vector": "D4 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "kontextual-engine", + "path": "registry/capabilities/capability.communication.context-engine.md", + "tags": [ + "knowledge", + "context", + "runtime" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "kontextual-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/kontextual-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kontextual-engine.yaml" + }, + { + "id": "capability.communication.infospace-workspace", + "name": "Infospace Workspace And Evaluation Bench", + "summary": "Workspace and service for creating, developing, evaluating, and inspecting structured knowledge spaces (infospaces); application-layer successor to the infospace work begun in markitect-main.", + "vector": "D3 / A1 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "infospace-bench", + "path": "registry/capabilities/capability.communication.infospace-workspace.md", + "tags": [ + "infospace", + "knowledge", + "evaluation" + ], + "consumption_modes": [ + "cli", + "library import (consumed by info-tech-canon)" + ], + "source_repo": "infospace-bench", + "source_url": "https://forgejo.coulomb.social/coulomb/infospace-bench/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/infospace-bench.yaml" + }, + { + "id": "capability.communication.markitect-legacy-platform", + "name": "MarkiTect Legacy Platform", + "summary": "Intelligent markdown engine and information-management platform treating documents as structured, queryable information spaces with schema validation, transclusion, and LLM-driven evaluation; the legacy umbrella now being split into markitect-tool, infospace-bench, and kontextual-engine.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-main", + "path": "registry/capabilities/capability.communication.markitect-legacy-platform.md", + "tags": [ + "markitect", + "markdown", + "legacy" + ], + "consumption_modes": [ + "application (legacy, not recommended for new integration)" + ], + "source_repo": "markitect-main", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-main/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-main.yaml" + }, + { + "id": "capability.communication.markitect-quarkdown-adapter", + "name": "Markitect Quarkdown Render Adapter", + "summary": "Concrete Quarkdown render/export adapter for Markitect, mapping Markitect profiles to Quarkdown profiles and running controlled Quarkdown CLI execution plans without forking or reimplementing Quarkdown.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-quarkdown", + "path": "registry/capabilities/capability.communication.markitect-quarkdown-adapter.md", + "tags": [ + "markitect", + "quarkdown", + "adapter" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-quarkdown", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-quarkdown/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-quarkdown.yaml" + }, + { + "id": "capability.communication.markitect-source-adapters", + "name": "Markitect Source-Format Adapters", + "summary": "Concrete source-format adapters (EPUB3, PDF) converting external document formats into canonical Markitect Markdown, implementing the markitect-tool source adapter contract.", + "vector": "D2 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "markitect-filter", + "path": "registry/capabilities/capability.communication.markitect-source-adapters.md", + "tags": [ + "markitect", + "adapter", + "document-conversion" + ], + "consumption_modes": [ + "library import (plugin/entry-point)" + ], + "source_repo": "markitect-filter", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-filter/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-filter.yaml" + }, + { + "id": "capability.communication.markitect-toolkit", + "name": "Markitect Markdown Toolkit And CLI", + "summary": "Markdown-native toolkit and CLI (mkt) for turning semi-structured Markdown into structured, queryable, reusable knowledge artifacts; syntax-layer successor to markitect-main.", + "vector": "D4 / A2 / C2 / R1", + "domain": "communication", + "status": "draft", + "owner": "markitect-tool", + "path": "registry/capabilities/capability.communication.markitect-toolkit.md", + "tags": [ + "markitect", + "markdown", + "cli", + "toolkit" + ], + "consumption_modes": [ + "cli", + "library import" + ], + "source_repo": "markitect-tool", + "source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/markitect-tool.yaml" + }, + { + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "summary": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime.", + "domain": "infotech", + "status": "draft", + "owner": "coordination-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.coordination.cross-owner-work.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "coordination-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/coordination-engine.yaml" + }, + { + "id": "capability.design.whynot-system", + "name": "Whynot Design System", + "summary": "Framework-agnostic visual language for whynot prototype/market-signal artefacts: design tokens, drop-in CSS, Lit-based web components usable from React/Django/Vue/plain HTML, and Django template adapters.", + "vector": "D3 / A2 / C2 / R1", + "domain": "consumer", + "status": "draft", + "owner": "whynot-design", + "path": "registry/capabilities/capability.design.whynot-system.md", + "tags": [ + "design-system", + "web-components", + "frontend" + ], + "consumption_modes": [ + "library import (npm)", + "cli", + "django template adapter" + ], + "source_repo": "whynot-design", + "source_url": "https://forgejo.coulomb.social/coulomb/whynot-design/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whynot-design.yaml" + }, + { + "id": "capability.evidence.binding", + "name": "Evidence-to-Target Binding", + "summary": "Links evidence items to structured targets with relation, status, and confidence metadata, bidirectional queries, active-state coordination, and canonical engine events.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.binding.md", + "tags": [ + "evidence", + "binding", + "evidence-link", + "form-field", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React provider" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.evidence.rect-registry", + "name": "Visual-Guide Rect Registry", + "summary": "Coordinates field, evidence-card, and highlight rectangles from independent renderers so an SVG overlay can draw the active visual guide without polling.", + "vector": "D3 / A2 / C3 / R3", + "domain": "infotech", + "status": "draft", + "owner": "evidence-binder", + "path": "registry/capabilities/capability.evidence.rect-registry.md", + "tags": [ + "rect-registry", + "visual-guide", + "overlay", + "active-state", + "citation-evidence" + ], + "consumption_modes": [ + "source module", + "React component" + ], + "source_repo": "evidence-binder", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-binder/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-binder.yaml" + }, + { + "id": "capability.execution.openweight-rein", + "name": "Bounded open-weight agent execution", + "summary": "Tool loop, path guards, turn/budget limits and verified-commit result.", + "domain": "infotech", + "status": "draft", + "owner": "rein-openweights", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.execution.openweight-rein.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rein-openweights", + "source_url": "https://forgejo.coulomb.social/coulomb/rein-openweights/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rein-openweights.yaml" + }, + { + "id": "capability.execution.profile-harness", + "name": "Profile-bound agent execution lifecycle", + "summary": "Typed execution requests, profile/rein resolution, sandbox and cleanup orchestration.", + "domain": "infotech", + "status": "draft", + "owner": "glas-harness", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.execution.profile-harness.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "glas-harness", + "source_url": "https://forgejo.coulomb.social/coulomb/glas-harness/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/glas-harness.yaml" + }, + { + "id": "capability.execution.sandbox-provision", + "name": "Sandbox establishment and lifecycle", + "summary": "Profiles, extensions, provision, checkpoints, TTL teardown and telemetry.", + "domain": "infotech", + "status": "draft", + "owner": "sand-boxer", + "tags": [ + "sandbox", + "isolation", + "provision", + "e2e", + "agentic", + "execution", + "profile", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D5 / A5 / C5 / R0", + "path": "registry/capabilities/execution.sandbox-provision.md", + "consumption_modes": [ + "containerized service", + "CLI" + ], + "source_repo": "sand-boxer", + "source_url": "https://forgejo.coulomb.social/coulomb/sand-boxer/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/sand-boxer.yaml" + }, + { + "id": "capability.execution.scheduled-agent-rein", + "name": "Scheduled agent intake and harness routing", + "summary": "Activity Core lease claim/heartbeat and Glas profile execution.", + "domain": "infotech", + "status": "draft", + "owner": "rein-aharness", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.execution.scheduled-agent-rein.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rein-aharness", + "source_url": "https://forgejo.coulomb.social/coulomb/rein-aharness/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rein-aharness.yaml" + }, + { + "id": "capability.feature-control.evaluate", + "name": "Feature Availability Evaluation", + "summary": "Evaluate whether a feature is active, hidden, disabled, or unavailable for a subject in context.", + "vector": "D5 / A4 / C3 / R3", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.evaluate.md", + "tags": [ + "feature-control", + "evaluation", + "sdk" + ], + "consumption_modes": [ + "SDK", + "service API" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.rollout", + "name": "Feature Rollout Control", + "summary": "Gradually expose features to subjects across tenants, domains, groups, or cohorts using rollout rules.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.rollout.md", + "tags": [ + "feature-control", + "rollout", + "planning" + ], + "consumption_modes": [ + "source module", + "SDK" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.feature-control.visibility", + "name": "Feature Visibility Control", + "summary": "Control whether features are visible or hidden for subjects without changing entitlement or authorization.", + "vector": "D4 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "feature-control", + "path": "registry/capabilities/capability.feature-control.visibility.md", + "tags": [ + "feature-control", + "visibility" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "feature-control", + "source_url": "https://forgejo.coulomb.social/coulomb/feature-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/feature-control.yaml" + }, + { + "id": "capability.finance.security-budget-evidence", + "name": "Budget and cost evidence for security operations", + "summary": "Budget, commitment, spend attribution and planning-evidence consumption.", + "domain": "infotech", + "status": "draft", + "owner": "fin-hub", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.finance.security-budget-evidence.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "fin-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/fin-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/fin-hub.yaml" + }, + { + "id": "capability.graph.nbgm-spec", + "name": "Network-Based Graph Model (NBGM) Specification", + "summary": "Generic system and versioned protocol specification for exploring dependency structures as network-based graph models (NBGM), unifying entity/relationship inspection and reasoning across arbitrary domains.", + "vector": "D2 / A0 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "vantage-point", + "path": "registry/capabilities/capability.graph.nbgm-spec.md", + "tags": [ + "graph", + "nbgm", + "specification" + ], + "consumption_modes": [ + "informational (specification only)" + ], + "source_repo": "vantage-point", + "source_url": "https://forgejo.coulomb.social/coulomb/vantage-point/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vantage-point.yaml" + }, + { + "id": "capability.hr.workflow-catalog", + "name": "HR Workflow Catalog", + "summary": "Markdown-first registry of HR planning workflows with an iterative assessment loop tied to INTENT phases.", + "vector": "D3 / A1 / C1 / R0", + "domain": "consumer", + "status": "draft", + "owner": "human-resources", + "path": "registry/capabilities/capability.hr.workflow-catalog.md", + "tags": [ + "hr", + "workflows", + "assessment", + "planning" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "human-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/human-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/human-resources.yaml" + }, + { + "id": "capability.iam.key-cape", + "name": "OIDC identity and assurance", + "summary": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.", + "domain": "infotech", + "status": "draft", + "owner": "key-cape", + "tags": [ + "iam", + "oidc", + "netkingdom", + "security", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.iam.key-cape.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "key-cape", + "source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/key-cape.yaml" + }, + { + "id": "capability.identity.subject-resolution", + "name": "Identity Subject Resolution", + "summary": "Resolve who or what is acting by mapping principals, accounts, actors, and identifiers to a stable subject model.", + "vector": "D3 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.subject-resolution.md", + "tags": [ + "identity", + "subject", + "architecture" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.identity.tenant-facts", + "name": "Tenant lifecycle and guardrail facts", + "summary": "Cache-read, live-lookup and write APIs; PostgreSQL lifecycle store.", + "domain": "infotech", + "status": "draft", + "owner": "tenant-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.identity.tenant-facts.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "tenant-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/tenant-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/tenant-engine.yaml" + }, + { + "id": "capability.identity.user-engine", + "name": "User lifecycle and account journeys", + "summary": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog.", + "domain": "communication", + "status": "draft", + "owner": "user-engine", + "tags": [ + "identity", + "user-management", + "multi-tenant", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C2 / R0", + "path": "registry/capabilities/capability.identity.user-engine.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "user-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/user-engine.yaml" + }, + { + "id": "capability.identity.vocabulary-canonicalize", + "name": "Identity Vocabulary Canonicalization", + "summary": "Define an implementation-neutral vocabulary for identity-related concepts across overlapping domains.", + "vector": "D4 / A0 / C2 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "commerce-canon", + "path": "registry/capabilities/capability.identity.vocabulary-canonicalize.md", + "tags": [ + "identity", + "terminology", + "research" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "commerce-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/commerce-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/commerce-canon.yaml" + }, + { + "id": "capability.infotech.artifact-store", + "name": "Artifact Registry And Storage Gateway", + "summary": "Generic artifact registry and storage gateway for generated outputs, evidence packages, reports, logs, snapshots, exports, and release artifacts.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "artifact-store", + "path": "registry/capabilities/capability.infotech.artifact-store.md", + "tags": [ + "artifact", + "storage", + "provenance", + "registry" + ], + "consumption_modes": [ + "library import", + "cli" + ], + "source_repo": "artifact-store", + "source_url": "https://forgejo.coulomb.social/coulomb/artifact-store/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/artifact-store.yaml" + }, + { + "id": "capability.infotech.canon-service", + "name": "Shared semantic contracts and validation", + "summary": "Markdown canon with library, CLI and read-only API.", + "domain": "infotech", + "status": "draft", + "owner": "info-tech-canon", + "tags": [ + "canon", + "infospace", + "service", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D2 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.canon-service.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "info-tech-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/info-tech-canon.yaml" + }, + { + "id": "capability.infotech.citation-engine", + "name": "Citation Evidence Domain Engine", + "summary": "Core domain model and engine services for the citation-evidence ecosystem \u2014 shared vocabulary, in-memory repositories, orchestration services, event bus, and citation card renderers.", + "vector": "D3 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-engine", + "path": "registry/capabilities/capability.infotech.citation-engine.md", + "tags": [ + "citation", + "evidence", + "domain-model" + ], + "consumption_modes": [ + "library import (workspace link)" + ], + "source_repo": "citation-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-engine.yaml" + }, + { + "id": "capability.infotech.citation-evidence-workspace", + "name": "Citation Evidence Workspace", + "summary": "Document-centered evidence workspace for capturing, managing, presenting, and re-opening citations \u2014 the umbrella application over the citation-evidence six-package design.", + "vector": "D4 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "citation-evidence", + "path": "registry/capabilities/capability.infotech.citation-evidence-workspace.md", + "tags": [ + "citation", + "evidence", + "workspace" + ], + "consumption_modes": [ + "application (local dev server)" + ], + "source_repo": "citation-evidence", + "source_url": "https://forgejo.coulomb.social/coulomb/citation-evidence/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/citation-evidence.yaml" + }, + { + "id": "capability.infotech.config-surface-atlas", + "name": "Configuration Surface Atlas", + "summary": "Read-first, cross-kind map and evidence layer for configuration surfaces \u2014 what configures a system, who owns it, its scope, and where the source of truth lives.", + "vector": "D5 / A0 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "config-atlas", + "path": "registry/capabilities/capability.infotech.config-surface-atlas.md", + "tags": [ + "configuration", + "registry", + "control-plane", + "effective-config", + "evidence" + ], + "consumption_modes": [ + "informational", + "source module" + ], + "source_repo": "config-atlas", + "source_url": "https://forgejo.coulomb.social/coulomb/config-atlas/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/config-atlas.yaml" + }, + { + "id": "capability.infotech.core-hub", + "name": "Core Hub Production Interaction Framework", + "summary": "Contract-first framework for cross-domain state, agent coordination, evidence, registries, workplans, and operator interaction surfaces.", + "vector": "D3 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "core-hub", + "path": "registry/capabilities/capability.infotech.core-hub.md", + "tags": [ + "interaction-framework", + "state-hub", + "inter-hub-successor", + "agent-coordination", + "registry", + "api" + ], + "consumption_modes": [ + "informational", + "planning", + "cli" + ], + "source_repo": "core-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/core-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/core-hub.yaml" + }, + { + "id": "capability.infotech.email-connector", + "name": "Mailbox Evidence Scanner (email-connect)", + "summary": "Headless, provider-neutral email communication and evidence service; first slice scans a mailbox or fixture directory and produces timestamped CSV evidence reports.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "email-connect", + "path": "registry/capabilities/capability.infotech.email-connector.md", + "tags": [ + "email", + "evidence", + "coordination" + ], + "consumption_modes": [ + "cli" + ], + "source_repo": "email-connect", + "source_url": "https://forgejo.coulomb.social/coulomb/email-connect/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/email-connect.yaml" + }, + { + "id": "capability.infotech.headless-browser", + "name": "Headless Browser Automation", + "summary": "Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Published A5 local container; managed Railiance admission is pending. Download the Python 3.10+ standalone client from https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py and run `python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight`, then `python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01` with a fresh output directory. This endpoint was verified locally on 2026-10-13 and is ephemeral; it installs no browser for the caller. If unreachable, follow the local container setup in the capability card or adapt its A2 source examples; this is an availability gap on the existing capability. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.", + "vector": "D3 / A5 / C2 / R2", + "domain": "infotech", + "status": "reviewed", + "owner": "reuse-surface", + "path": "registry/capabilities/capability.infotech.headless-browser.md", + "tags": [ + "headless", + "browser", + "automation", + "playwright", + "chromium", + "testing", + "screenshots", + "extraction", + "firefox", + "webkit", + "selenium", + "puppeteer" + ], + "consumption_modes": [ + "informational", + "source adaptation", + "JavaScript library", + "Python library", + "cli", + "service API", + "container" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.infotech.hub-core-library", + "name": "Reusable FOS Hub Core Primitives", + "summary": "Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State Hub for use by other FOS (Federation of Services) hubs.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "hub-core", + "path": "registry/capabilities/capability.infotech.hub-core-library.md", + "tags": [ + "hub", + "fastapi", + "sqlalchemy", + "mcp" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "hub-core", + "source_url": "https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/hub-core.yaml" + }, + { + "id": "capability.infotech.issue-tracking", + "name": "External issue tracker connector", + "summary": "CLI and Python adapters for external issue systems.", + "domain": "infotech", + "status": "draft", + "owner": "issue-core", + "tags": [ + "issue-tracking", + "connector", + "work-record", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "issue-core", + "source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/issue-core.yaml" + }, + { + "id": "capability.infotech.oss-integration-continuity", + "name": "Managed Continuity For OSS Integrations", + "summary": "Turns proven open-source integrations into structured, maintainable, continuously managed assets with clear boundaries and update loops, so they remain robust and transparent as upstream evolves.", + "vector": "D2 / A1 / C1 / R0", + "domain": "infotech", + "status": "draft", + "owner": "open-reuse", + "path": "registry/capabilities/capability.infotech.oss-integration-continuity.md", + "tags": [ + "oss", + "integration", + "maintenance" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "open-reuse", + "source_url": "https://forgejo.coulomb.social/coulomb/open-reuse/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/open-reuse.yaml" + }, + { + "id": "capability.infotech.pdf-evidence-ingest", + "name": "Headless PDF Evidence Ingest", + "summary": "Turns raw PDF bytes into an engine-shaped Document + DocumentRepresentation \u2014 SHA-256 fingerprint, canonical text, page map, and gap-free offset map \u2014 as a runtime-agnostic library with no viewer, persistence, or React coupling.", + "vector": "D2 / A1 / C1 / R1", + "domain": "infotech", + "status": "draft", + "owner": "evidence-source", + "path": "registry/capabilities/capability.infotech.pdf-evidence-ingest.md", + "tags": [ + "pdf", + "ingest", + "fingerprint", + "canonical-text", + "evidence" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "evidence-source", + "source_url": "https://forgejo.coulomb.social/coulomb/evidence-source/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/evidence-source.yaml" + }, + { + "id": "capability.infotech.repo-template", + "name": "Coulomb Repository Template", + "summary": "Bootstrap new git repositories with agent instructions, registry scaffold, and State Hub onboarding conventions.", + "vector": "D3 / A3 / C2 / R2", + "domain": "infotech", + "status": "draft", + "owner": "repo-seed", + "path": "registry/capabilities/capability.infotech.repo-template.md", + "tags": [ + "template", + "bootstrap", + "state-hub", + "onboarding" + ], + "consumption_modes": [ + "git clone", + "informational" + ], + "source_repo": "repo-seed", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-seed/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-seed.yaml" + }, + { + "id": "capability.infotech.runbook-tutorials", + "name": "Guided administrative runbooks", + "summary": "Pack schema, loader, local UI/CLI, gates, verification and rollback evidence.", + "domain": "infotech", + "status": "draft", + "owner": "runbook-tutorials", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.infotech.runbook-tutorials.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "runbook-tutorials", + "source_url": "https://forgejo.coulomb.social/coulomb/runbook-tutorials/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/runbook-tutorials.yaml" + }, + { + "id": "capability.infotech.sbom-management", + "name": "Dependency provenance and SBOM evidence", + "summary": "Controlled archive ingest, immutable snapshots, freshness and license review.", + "domain": "infotech", + "status": "draft", + "owner": "sbom-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.sbom-management.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "sbom-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/sbom-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/sbom-nexus.yaml" + }, + { + "id": "capability.memory.phase-planning", + "name": "Profile-Driven Memory Phase Planning (phase-memory)", + "summary": "Interprets Markitect memory profiles as runtime plans, modeling memory phases and producing deterministic dry-run actions for retention, refresh, compaction, stabilization, and activation.", + "vector": "D3 / A1 / C1 / R0", + "domain": "communication", + "status": "draft", + "owner": "phase-memory", + "path": "registry/capabilities/capability.memory.phase-planning.md", + "tags": [ + "memory", + "agentic", + "planning" + ], + "consumption_modes": [ + "library import" + ], + "source_repo": "phase-memory", + "source_url": "https://forgejo.coulomb.social/coulomb/phase-memory/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/phase-memory.yaml" + }, + { + "id": "capability.observability.security-signals", + "name": "Security-relevant telemetry contracts and adapters", + "summary": "Signal contract, platform adapters, report exporter and absence/alert rules.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-telemetry", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.observability.security-signals.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-telemetry", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-telemetry/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-telemetry.yaml" + }, + { + "id": "capability.operations.ops-hub", + "name": "Operations Hub Extension Contract", + "summary": "Versioned hub-extension package and bootstrap client for operational truth, service-catalog records, readiness evidence, and migration gates.", + "vector": "D3 / A1 / C1 / R1", + "domain": "operations", + "status": "reviewed", + "owner": "ops-hub", + "path": "registry/capabilities/capability.operations.ops-hub.md", + "tags": [ + "operations", + "service-catalog", + "readiness", + "hub-extension" + ], + "consumption_modes": [ + "contract package", + "command-line bootstrap" + ], + "source_repo": "ops-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-hub.yaml" + }, + { + "id": "capability.ops.tunnel-bridge", + "name": "SSH tunnel lifecycle", + "summary": "Named tunnels, reconnect, health and TTL-aware cert_command.", + "domain": "infotech", + "status": "draft", + "owner": "ops-bridge", + "tags": [ + "ssh", + "tunnel", + "ops", + "connectivity", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-bridge", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-bridge.yaml" + }, + { + "id": "capability.organization.role-catalog", + "name": "Organizational role definitions", + "summary": "Versioned documentation catalog.", + "domain": "infotech", + "status": "draft", + "owner": "role-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.organization.role-catalog.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "role-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/role-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/role-engine.yaml" + }, + { + "id": "capability.procurement.vergabe-teilnahme", + "name": "Vergabe Teilnahme (Public Procurement Participation) Application", + "summary": "Django application (with a Vite/Tailwind frontend) for managing German public-procurement (Vergabe) tender participation \u2014 Ausschreibungs- und Teilnahme-Management-System.", + "vector": "D3 / A1 / C1 / R1", + "domain": "communication", + "status": "draft", + "owner": "vergabe-teilnahme", + "path": "registry/capabilities/capability.procurement.vergabe-teilnahme.md", + "tags": [ + "procurement", + "django", + "vergabe" + ], + "consumption_modes": [ + "application (Django + Vite, local dev via docker-compose)" + ], + "source_repo": "vergabe-teilnahme", + "source_url": "https://forgejo.coulomb.social/coulomb/vergabe-teilnahme/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/vergabe-teilnahme.yaml" + }, + { + "id": "capability.railiance.bootstrap-sequencing", + "name": "Bootstrap sequencing contracts", + "summary": "Bare-VM to estate sequence and handoff contract.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-bootstrap", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.bootstrap-sequencing.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "railiance-bootstrap", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-bootstrap/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-bootstrap.yaml" + }, + { + "id": "capability.railiance.browser-verification", + "name": "Managed browser verification pilot", + "summary": "Bounded jobs, cancellation, artifacts, origin checks and restart receipts.", + "domain": "infotech", + "status": "draft", + "owner": "rapp-playwright", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.railiance.browser-verification.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "rapp-playwright", + "source_url": "https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rapp-playwright.yaml" + }, + { + "id": "capability.railiance.ci-enablement", + "name": "Developer delivery and CI templates", + "summary": "Reusable CI workflows, build and deployment patterns.", + "domain": "financials", + "status": "draft", + "owner": "railiance-enablement", + "tags": [ + "railiance", + "ci-cd", + "developer-enablement", + "forgejo", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-enablement", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-enablement.yaml" + }, + { + "id": "capability.railiance.cluster-bootstrap", + "name": "Kubernetes runtime and cluster controls", + "summary": "k3s, ingress, CNI, operators and kubeconfig/runtime checks.", + "domain": "financials", + "status": "draft", + "owner": "railiance-cluster", + "tags": [ + "railiance", + "kubernetes", + "iac", + "bootstrap", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-cluster", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-cluster.yaml" + }, + { + "id": "capability.railiance.fabric-graph", + "name": "Infrastructure ownership and dependency graph", + "summary": "Schemas, validation, graph queries and State Hub exports.", + "domain": "financials", + "status": "draft", + "owner": "railiance-fabric", + "tags": [ + "railiance", + "graph", + "ownership", + "discovery", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-fabric", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-fabric.yaml" + }, + { + "id": "capability.railiance.forge-infrastructure", + "name": "Source forge, registries and runner substrate", + "summary": "Forgejo operation, package registries and runner lifecycle.", + "domain": "financials", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "railiance", + "forgejo", + "forge", + "ci-runner", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.railiance.infra-provisioning", + "name": "Host convergence and security baseline", + "summary": "Ansible inventory, firewall, SSH bootstrap and baseline verification.", + "domain": "financials", + "status": "draft", + "owner": "railiance-infra", + "tags": [ + "railiance", + "terraform", + "ansible", + "infrastructure", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-infra", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-infra.yaml" + }, + { + "id": "capability.railiance.knative-rail", + "name": "Knative workload lifecycle", + "summary": "Derived rail for activation, revisions, traffic, scaling and rollback.", + "domain": "infotech", + "status": "draft", + "owner": "rail-knative", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.knative-rail.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rail-knative", + "source_url": "https://forgejo.coulomb.social/coulomb/rail-knative/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rail-knative.yaml" + }, + { + "id": "capability.railiance.kubernetes-rail", + "name": "Generic Kubernetes workload lifecycle", + "summary": "Workload declaration, rollout, observe, promote and rollback surfaces.", + "domain": "infotech", + "status": "draft", + "owner": "rail-kubernetes", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.kubernetes-rail.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "rail-kubernetes", + "source_url": "https://forgejo.coulomb.social/coulomb/rail-kubernetes/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/rail-kubernetes.yaml" + }, + { + "id": "capability.railiance.platform-services", + "name": "Secret custody and platform data services", + "summary": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.", + "domain": "financials", + "status": "draft", + "owner": "railiance-platform", + "tags": [ + "railiance", + "platform", + "secrets", + "postgres", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.platform-services.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-platform", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-platform.yaml" + }, + { + "id": "capability.railiance.security-consumption-contracts", + "name": "Platform security consumption architecture", + "summary": "Rail/rapp/reef boundaries, exposure and security consumption contracts.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-master", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.security-consumption-contracts.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "railiance-master", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-master/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-master.yaml" + }, + { + "id": "capability.railiance.substrate-bindings", + "name": "Substrate topology and bindings", + "summary": "Grouped home-reef identity, topology and placement declarations.", + "domain": "infotech", + "status": "draft", + "owner": "reef-railiance", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.railiance.substrate-bindings.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "reef-railiance", + "source_url": "https://forgejo.coulomb.social/coulomb/reef-railiance/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reef-railiance.yaml" + }, + { + "id": "capability.railiance.workload-deployment-tooling", + "name": "Workload release configuration and guards", + "summary": "Helm/manifests, exact image pins, application runbooks and rollout/rollback.", + "domain": "financials", + "status": "draft", + "owner": "railiance-apps", + "tags": [ + "railiance", + "kubernetes", + "helm", + "deployment", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-apps", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-apps.yaml" + }, + { + "id": "capability.registry.register", + "name": "Capability registry and federation", + "summary": "Owner Markdown entries, indexes, federation hub and planning queries.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "governance", + "meta", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C2 / R3", + "path": "registry/capabilities/capability.registry.register.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.registry.validate", + "name": "Capability registry validation", + "summary": "Schema, index consistency and relation checks.", + "domain": "helix_forge", + "status": "draft", + "owner": "reuse-surface", + "tags": [ + "registry", + "validation", + "cli", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R3", + "path": "registry/capabilities/capability.registry.validate.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "reuse-surface", + "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/reuse-surface.yaml" + }, + { + "id": "capability.resources.security-capacity", + "name": "Capacity and recovery resource planning", + "summary": "Provider-neutral inventory, procurement evidence and optimization reports.", + "domain": "infotech", + "status": "draft", + "owner": "resource-control", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.resources.security-capacity.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "resource-control", + "source_url": "https://forgejo.coulomb.social/coulomb/resource-control/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/resource-control.yaml" + }, + { + "id": "capability.security.access-routing", + "name": "Credential routing and contained access", + "summary": "warden route and access catalog; exact lane conduit and secret-exec routing.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.security.access-routing.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.adversarial-evidence", + "name": "Authorized adversarial evidence harness", + "summary": "Offline ASM and tenancy calibrations and engagement admission.", + "domain": "infotech", + "status": "draft", + "owner": "whitehat-security", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.adversarial-evidence.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "whitehat-security", + "source_url": "https://forgejo.coulomb.social/coulomb/whitehat-security/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/whitehat-security.yaml" + }, + { + "id": "capability.security.agent-knowledge", + "name": "Verified security orientation for agents", + "summary": "Versioned source-pinned cards, read-only CLI, provider adapters and sealed exports.", + "domain": "infotech", + "status": "draft", + "owner": "emergent-security", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.agent-knowledge.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "emergent-security", + "source_url": "https://forgejo.coulomb.social/coulomb/emergent-security/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/emergent-security.yaml" + }, + { + "id": "capability.security.approval-lifecycle", + "name": "Bound approval lifecycle", + "summary": "Authenticated issue, claim, revoke, supersede and atomic consume API with outbox.", + "domain": "infotech", + "status": "draft", + "owner": "approval-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.security.approval-lifecycle.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "approval-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/approval-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/approval-engine.yaml" + }, + { + "id": "capability.security.bootstrap-recovery", + "name": "Guarded bootstrap and recovery preparation", + "summary": "Local identity, bootstrap console, encrypted custody handoff and caller tools.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.bootstrap-recovery.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-contracts", + "name": "Security case types and instance validation", + "summary": "Versioned types, cases and schema validation.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-contracts.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-follow-through", + "name": "Security case operational follow-through", + "summary": "KnownSecurityCase route, plan and operational receipts.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-follow-through.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.credential-lifecycle", + "name": "Cataloged credential lifecycle", + "summary": "CLI catalog, plan, exact OpenBao metadata apply, provisioning, verification, delivery and revoke.", + "domain": "infotech", + "status": "draft", + "owner": "secrets-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.credential-lifecycle.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "secrets-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/secrets-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/secrets-engine.yaml" + }, + { + "id": "capability.security.doctrine-review", + "name": "Security doctrine and architecture review", + "summary": "Layer rules, authority context, ASM criteria and interpretations.", + "domain": "infotech", + "status": "draft", + "owner": "gate-house", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.security.doctrine-review.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "gate-house", + "source_url": "https://forgejo.coulomb.social/coulomb/gate-house/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/gate-house.yaml" + }, + { + "id": "capability.security.emission-profile", + "name": "Security emission cadence validation", + "summary": "Security profile over generic emission contracts and validator.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.emission-profile.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.forge-secret-prevention", + "name": "Independent introduced-history secret prevention", + "summary": "Pinned receive adapter, lifecycle template and fail-closed scan.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.forge-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.security.human-decision-workspace", + "name": "Human security decision presentation and disposition", + "summary": "Headless lifecycle and browser workspace with exact native approval references.", + "domain": "infotech", + "status": "draft", + "owner": "informed-decision", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.security.human-decision-workspace.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "informed-decision", + "source_url": "https://forgejo.coulomb.social/coulomb/informed-decision/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/informed-decision.yaml" + }, + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom security architecture and conformance tooling", + "summary": "Versioned IAM, layer, tenancy and credential contracts plus validators.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "iam", + "kubernetes", + "conformance", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.maturity-claims", + "name": "Evidence-based maturity claims and gap register", + "summary": "SQLite library and CLI for ladders, evidence expiry, compute, explain and stance inventory.", + "domain": "infotech", + "status": "draft", + "owner": "maturity-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.maturity-claims.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "maturity-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/maturity-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/maturity-engine.yaml" + }, + { + "id": "capability.security.policy-publication", + "name": "Policy publication with source provenance", + "summary": "Generated immutable publication, source currency and stable policy URLs.", + "domain": "infotech", + "status": "draft", + "owner": "policy-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.policy-publication.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "policy-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/policy-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/policy-nexus.yaml" + }, + { + "id": "capability.security.posture-assessment", + "name": "Security posture assessment and response proposals", + "summary": "Normalized observation evaluator, cadence checks and secret-use snapshot adapter.", + "domain": "infotech", + "status": "draft", + "owner": "kings-guard", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-assessment.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "kings-guard", + "source_url": "https://forgejo.coulomb.social/coulomb/kings-guard/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/kings-guard.yaml" + }, + { + "id": "capability.security.posture-feedback", + "name": "Deterministic posture feedback", + "summary": "CLI evaluates evidence age and posture into owner-routed findings.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-feedback.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.practice-canon", + "name": "Security practice and authority vocabulary", + "summary": "Versioned SEC-DSM and Mode of Authority documents.", + "domain": "infotech", + "status": "draft", + "owner": "security-canon", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A0 / C1 / R0", + "path": "registry/capabilities/capability.security.practice-canon.md", + "consumption_modes": [ + "informational" + ], + "source_repo": "security-canon", + "source_url": "https://forgejo.coulomb.social/coulomb/security-canon/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/security-canon.yaml" + }, + { + "id": "capability.security.repository-secret-prevention", + "name": "Repository metadata and staged-secret prevention", + "summary": "Repository observation plus pinned staged-blob scanner and hook integration.", + "domain": "infotech", + "status": "draft", + "owner": "repo-manager", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.repository-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "repo-manager", + "source_url": "https://forgejo.coulomb.social/coulomb/repo-manager/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/repo-manager.yaml" + }, + { + "id": "capability.security.risk-register", + "name": "Security risk and exception review register", + "summary": "Markdown findings and Python review, verification and due-work reports.", + "domain": "infotech", + "status": "draft", + "owner": "risk-nexus", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.risk-register.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "risk-nexus", + "source_url": "https://forgejo.coulomb.social/coulomb/risk-nexus/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/risk-nexus.yaml" + }, + { + "id": "capability.security.scenario-compose", + "name": "Deterministic security scenario composition", + "summary": "CLI selects pinned providers and orders trust transitions.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.scenario-compose.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.ssh-certificate-issuance", + "name": "Decision-bound SSH certificates", + "summary": "warden sign with local and OpenBao backends and adm/agt/atm actors.", + "domain": "helix_forge", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "ssh", + "certificate", + "ca", + "ops-warden", + "openbao", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A3 / C3 / R2", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.structure-construction", + "name": "Reviewed security structure construction", + "summary": "Digest-bound OpenBao AppRole and Kubernetes-auth plans and guarded apply.", + "domain": "infotech", + "status": "draft", + "owner": "ops-mason", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.structure-construction.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-mason", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-mason/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-mason.yaml" + }, + { + "id": "capability.security.zone-reference", + "name": "Zone membership reference conformance", + "summary": "Offline resolution, exception and lineage checks.", + "domain": "infotech", + "status": "draft", + "owner": "zone-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.zone-reference.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "zone-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/zone-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/zone-engine.yaml" + }, + { + "id": "capability.statehub.progress-log", + "name": "Progress and work evidence indexing", + "summary": "REST progress and task evidence references.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "progress", + "coordination", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R3", + "path": "registry/capabilities/capability.statehub.progress-log.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.statehub.workstream-coordinate", + "name": "Cross-repository work tracking", + "summary": "File-derived workplans, tasks, dependencies, decisions and coordination views.", + "domain": "helix_forge", + "status": "draft", + "owner": "state-hub", + "tags": [ + "state-hub", + "coordination", + "workplans", + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D4 / A4 / C3 / R2", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", + "consumption_modes": [ + "HTTP API", + "source" + ], + "source_repo": "state-hub", + "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/state-hub.yaml" + }, + { + "id": "capability.wiki.adapter-contract", + "name": "Capability-Aware Shard Adapter Contract", + "summary": "A versioned backend interface where each binding declares a verified capability profile, so federation ops degrade by capability.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.adapter-contract.md", + "tags": [ + "wiki", + "adapter", + "capability", + "contract", + "conformance", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.coordination-journal", + "name": "Event-Sourced Coordination Journal", + "summary": "An append-only, totally-ordered-per-space decision log whose current state is a derived fold; git-addressable history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.coordination-journal.md", + "tags": [ + "wiki", + "event-sourcing", + "coordination", + "git", + "journal", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.derived-views", + "name": "Wiki Derived Views", + "summary": "Recomputable views over a wiki union \u2014 BackLinks, RecentChanges, AllPages, SiteMap, and (delegate-or-derive) Search \u2014 carrying provenance.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.derived-views.md", + "tags": [ + "wiki", + "derived-views", + "backlinks", + "recentchanges", + "search", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.engine-typed-extensions", + "name": "Wiki Engine with Typed Extensions", + "summary": "A small-core wiki engine realizing a typed-extension framework that addresses all wiki use cases and lets each shard activate only the features it needs.", + "vector": "D3 / A0 / C0 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.engine-typed-extensions.md", + "tags": [ + "wiki", + "engine", + "typed-extensions", + "feature-activation", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.federation-models", + "name": "Selectable Federation-Model Taxonomy", + "summary": "Federation as a plural, composable coordination axis (fork+journal, VCS-replication, query-join, feed, activity-streams, engine-mirror) selected per space.", + "vector": "D4 / A0 / C1 / R0", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.federation-models.md", + "tags": [ + "wiki", + "federation", + "taxonomy", + "composable", + "shard-wiki" + ], + "consumption_modes": [ + "informational" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.overlay", + "name": "Overlay-Before-Mutation Write Path", + "summary": "Non-destructive edits (draft -> patch -> apply-under-drift) that let read-only or limited backends be edited safely without silent remote mutation.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.overlay.md", + "tags": [ + "wiki", + "overlay", + "patch", + "write-path", + "conflict", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.page-model", + "name": "Backend-Neutral Wiki Page Model", + "summary": "A Markdown-first but stretchable page model with stable identity separate from placement and layered provenance.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.page-model.md", + "tags": [ + "wiki", + "page-model", + "identity", + "provenance", + "markdown", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + }, + { + "id": "capability.wiki.shard-orchestration", + "name": "Wiki Shard Orchestration", + "summary": "Present a union of pages across heterogeneous wiki-shaped shards while preserving each shard's provenance, capabilities, and history.", + "vector": "D5 / A2 / C2 / R1", + "domain": "helix_forge", + "status": "draft", + "owner": "shard-wiki", + "path": "registry/capabilities/capability.wiki.shard-orchestration.md", + "tags": [ + "wiki", + "federation", + "orchestration", + "union", + "shard-wiki" + ], + "consumption_modes": [ + "source module" + ], + "source_repo": "shard-wiki", + "source_url": "https://forgejo.coulomb.social/coulomb/shard-wiki/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/shard-wiki.yaml" + } + ], + "composed_at": "2026-10-14T22:19:54+00:00", + "stale": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json b/docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json index bbe29695..5c084b1e 100644 --- a/docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json +++ b/docs/assessments/netkingdom-2026-10-14/hosted-before-federated.json @@ -18,7 +18,7 @@ }, { "repo": "agentic-resources", - "count": 0, + "count": 1, "url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", "cache": "/data/cache/agentic-resources.yaml" }, @@ -72,7 +72,7 @@ }, { "repo": "coordination-engine", - "count": 0, + "count": 1, "url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", "cache": "/data/cache/coordination-engine.yaml" }, @@ -216,7 +216,7 @@ }, { "repo": "net-kingdom", - "count": 1, + "count": 6, "url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", "cache": "/data/cache/net-kingdom.yaml" }, @@ -246,7 +246,7 @@ }, { "repo": "ops-warden", - "count": 1, + "count": 3, "url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", "cache": "/data/cache/ops-warden.yaml" }, @@ -282,7 +282,7 @@ }, { "repo": "railiance-forge", - "count": 1, + "count": 2, "url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", "cache": "/data/cache/railiance-forge.yaml" }, @@ -374,20 +374,24 @@ "capabilities": [ { "id": "capability.activity.event-coordinate", - "name": "Organizational Event Coordination", - "summary": "Coordinate structured responses to cross-domain events through activity workflows and automation.", - "vector": "D3 / A1 / C1 / R0", + "name": "Durable automation and bounded operations", + "summary": "Temporal/NATS/webhook/manual trigger, validated definitions and evidence/runtime sinks.", "domain": "helix_forge", "status": "draft", "owner": "activity-core", - "path": "registry/capabilities/capability.activity.event-coordinate.md", "tags": [ "activity", "coordination", - "automation" + "automation", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A4 / C1 / R0", + "path": "registry/capabilities/capability.activity.event-coordinate.md", "consumption_modes": [ - "informational" + "HTTP API", + "source" ], "source_repo": "activity-core", "source_url": "https://forgejo.coulomb.social/coulomb/activity-core/raw/branch/main/registry/indexes/capabilities.yaml", @@ -417,21 +421,24 @@ }, { "id": "capability.agents.custodian-runtime-tooling", - "name": "Custodian Runtime And Repo-Classification Tooling", - "summary": "Generic tooling from The Custodian's runtime and ecosystem-management surface: an agent runtime framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across the workstation's 61 repos.", - "vector": "D2 / A1 / C1 / R0", + "name": "Generic agent runtime and repository tooling", + "summary": "Agent runtime modules and repository classification tooling.", "domain": "custodian", "status": "draft", "owner": "the-custodian", - "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", "tags": [ "agents", "runtime", - "classification" + "classification", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D2 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.custodian-runtime-tooling.md", "consumption_modes": [ - "library import (runtime/)", - "cli (tools/ scripts)" + "CLI", + "source" ], "source_repo": "the-custodian", "source_url": "https://forgejo.coulomb.social/coulomb/the-custodian/raw/branch/main/registry/indexes/capabilities.yaml", @@ -485,6 +492,28 @@ "source_url": "https://forgejo.coulomb.social/coulomb/llm-connect/raw/branch/main/registry/indexes/capabilities.yaml", "source_index": "/data/cache/llm-connect.yaml" }, + { + "id": "capability.agents.performance-learning", + "name": "Agent performance learning", + "summary": "Capture sessions, curate patterns, distribute lessons and measure outcomes.", + "domain": "infotech", + "status": "draft", + "owner": "agentic-resources", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.agents.performance-learning.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "agentic-resources", + "source_url": "https://forgejo.coulomb.social/coulomb/agentic-resources/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/agentic-resources.yaml" + }, { "id": "capability.agents.repo-scoping-service", "name": "Repository Scoping Service", @@ -510,23 +539,21 @@ }, { "id": "capability.audit.event-retain", - "name": "Audit Event Retention", - "summary": "Collect, normalize, retain, and search audit events with integrity evidence across tenants.", - "joins": "operations.audit", - "provision": "data/capability/audit-core-operational.json", - "vector": "D4 provision / A4 / C3 / R2", + "name": "Independent audit custody", + "summary": "Tenant-aware event ingestion, chain integrity, heartbeat and reconciliation.", "domain": "infotech", - "status": "production", + "status": "draft", "owner": "audit-core", - "path": "registry/capabilities/capability.audit.event-retain.md", "tags": [ - "audit", - "retention", - "compliance" + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A4 / C3 / R2", + "path": "registry/capabilities/capability.audit.event-retain.md", "consumption_modes": [ - "http ingest", - "source module" + "HTTP API", + "source" ], "source_repo": "audit-core", "source_url": "https://forgejo.coulomb.social/coulomb/audit-core/raw/branch/main/registry/indexes/capabilities.yaml", @@ -534,20 +561,24 @@ }, { "id": "capability.authorization.policy-evaluate", - "name": "Authorization Policy Evaluation", - "summary": "Evaluate access decisions from policy-as-code rules for subjects, resources, and actions.", - "vector": "D4 / A2 / C2 / R1", + "name": "Policy evaluation and decision evidence", + "summary": "Check, batch, list-allowed, explain, binding, lifetime and decision records.", "domain": "helix_forge", "status": "draft", - "owner": "flex-auth", - "path": "registry/capabilities/capability.authorization.policy-evaluate.md", + "owner": "access-engine", "tags": [ "authorization", "policy", - "flex-auth" + "flex-auth", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.authorization.policy-evaluate.md", "consumption_modes": [ - "source module" + "HTTP API", + "source" ], "source_repo": "access-engine", "source_url": "https://forgejo.coulomb.social/coulomb/access-engine/raw/branch/main/registry/indexes/capabilities.yaml", @@ -725,6 +756,28 @@ "source_url": "https://forgejo.coulomb.social/coulomb/markitect-tool/raw/branch/main/registry/indexes/capabilities.yaml", "source_index": "/data/cache/markitect-tool.yaml" }, + { + "id": "capability.coordination.cross-owner-work", + "name": "Cross-owner coordination lifecycle", + "summary": "Observation, lease, wake-up, checkpoint and receipt contracts/runtime.", + "domain": "infotech", + "status": "draft", + "owner": "coordination-engine", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.coordination.cross-owner-work.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "coordination-engine", + "source_url": "https://forgejo.coulomb.social/coulomb/coordination-engine/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/coordination-engine.yaml" + }, { "id": "capability.design.whynot-system", "name": "Whynot Design System", @@ -905,21 +958,23 @@ }, { "id": "capability.iam.key-cape", - "name": "KeyCape Lightweight IAM (NetKingdom Profile)", - "summary": "Lightweight-mode implementation of the NetKingdom IAM Profile (versioned OIDC/PKCE contract), orchestrating Authelia, LLDAP, and privacyIDEA so applications integrate against the profile, not against implementation internals.", - "vector": "D4 / A2 / C2 / R1", + "name": "OIDC identity and assurance", + "summary": "OIDC code with PKCE, service tokens, JWKS, MFA and caller CLI.", "domain": "infotech", "status": "draft", "owner": "key-cape", - "path": "registry/capabilities/capability.iam.key-cape.md", "tags": [ "iam", "oidc", "netkingdom", - "security" + "security", + "framework-reuse" ], + "vector": "D4 / A4 / C2 / R1", + "path": "registry/capabilities/capability.iam.key-cape.md", "consumption_modes": [ - "service (self-hosted deployment)" + "HTTP API", + "source" ], "source_repo": "key-cape", "source_url": "https://forgejo.coulomb.social/coulomb/key-cape/raw/branch/main/registry/indexes/capabilities.yaml", @@ -948,20 +1003,24 @@ }, { "id": "capability.identity.user-engine", - "name": "Headless Multi-Tenant User Engine", - "summary": "Headless, multi-application, multi-tenant user management engine covering registration, identity/factor models, entitlement claims, hats/realms/services/assets access profiles, and onboarding journeys.", - "vector": "D4 / A1 / C2 / R0", + "name": "User lifecycle and account journeys", + "summary": "Accounts, identity links, membership, MFA and recovery portal, advisory catalog.", "domain": "communication", "status": "draft", "owner": "user-engine", - "path": "registry/capabilities/capability.identity.user-engine.md", "tags": [ "identity", "user-management", - "multi-tenant" + "multi-tenant", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A4 / C2 / R0", + "path": "registry/capabilities/capability.identity.user-engine.md", "consumption_modes": [ - "library import" + "HTTP API", + "source" ], "source_repo": "user-engine", "source_url": "https://forgejo.coulomb.social/coulomb/user-engine/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1013,22 +1072,24 @@ }, { "id": "capability.infotech.canon-service", - "name": "InfoTechCanon Service Surface", - "summary": "Concrete service surface (CLI, importable functions, read-only local HTTP API) over the InfoTechCanon information-processing infospace, backed by infospace-bench.", - "vector": "D2 / A2 / C1 / R0", + "name": "Shared semantic contracts and validation", + "summary": "Markdown canon with library, CLI and read-only API.", "domain": "infotech", "status": "draft", "owner": "info-tech-canon", - "path": "registry/capabilities/capability.infotech.canon-service.md", "tags": [ "canon", "infospace", - "service" + "service", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D2 / A4 / C1 / R0", + "path": "registry/capabilities/capability.infotech.canon-service.md", "consumption_modes": [ - "cli", - "library import", - "http api (read-only, local)" + "HTTP API", + "source" ], "source_repo": "info-tech-canon", "source_url": "https://forgejo.coulomb.social/coulomb/info-tech-canon/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1207,21 +1268,24 @@ }, { "id": "capability.infotech.issue-tracking", - "name": "Universal Issue Tracking Coordination", - "summary": "Unified Python/CLI interface for issue tracking across Forgejo, GitHub, and GitLab, preventing direct platform API usage and credential sprawl for coordinating agents.", - "vector": "D4 / A2 / C2 / R1", + "name": "External issue tracker connector", + "summary": "CLI and Python adapters for external issue systems.", "domain": "infotech", "status": "draft", "owner": "issue-core", - "path": "registry/capabilities/capability.infotech.issue-tracking.md", "tags": [ "issue-tracking", - "coordination", - "multi-platform" + "connector", + "work-record", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.infotech.issue-tracking.md", "consumption_modes": [ - "cli", - "library import" + "CLI", + "source" ], "source_repo": "issue-core", "source_url": "https://forgejo.coulomb.social/coulomb/issue-core/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1340,21 +1404,25 @@ }, { "id": "capability.ops.tunnel-bridge", - "name": "SSH Reverse Tunnel Lifecycle Manager (ops-bridge)", - "summary": "CLI that manages named SSH reverse tunnels keeping remote execution environments connected to the local Custodian State Hub, with auto-reconnect, health checks, and structured audit events.", - "vector": "D3 / A2 / C2 / R1", + "name": "SSH tunnel lifecycle", + "summary": "Named tunnels, reconnect, health and TTL-aware cert_command.", "domain": "infotech", "status": "draft", "owner": "ops-bridge", - "path": "registry/capabilities/capability.ops.tunnel-bridge.md", "tags": [ "ssh", "tunnel", "ops", - "connectivity" + "connectivity", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.ops.tunnel-bridge.md", "consumption_modes": [ - "cli" + "CLI", + "source" ], "source_repo": "ops-bridge", "source_url": "https://forgejo.coulomb.social/coulomb/ops-bridge/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1383,22 +1451,25 @@ }, { "id": "capability.railiance.ci-enablement", - "name": "Railiance Developer Enablement And CI/CD Templates", - "summary": "S4 Developer Enablement layer of the Railiance OAS Stack \u2014 reusable CI/CD workflow templates, developer portal paths, platform templates, SDKs, and buildpacks, using forge capabilities without owning forge runtime.", - "vector": "D3 / A2 / C2 / R1", + "name": "Developer delivery and CI templates", + "summary": "Reusable CI workflows, build and deployment patterns.", "domain": "financials", "status": "draft", "owner": "railiance-enablement", - "path": "registry/capabilities/capability.railiance.ci-enablement.md", "tags": [ "railiance", "ci-cd", "developer-enablement", - "forgejo" + "forgejo", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.ci-enablement.md", "consumption_modes": [ - "ci workflow template (copy/reference)", - "cli (promote-repo-to-forgejo.sh)" + "CLI", + "source" ], "source_repo": "railiance-enablement", "source_url": "https://forgejo.coulomb.social/coulomb/railiance-enablement/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1406,22 +1477,25 @@ }, { "id": "capability.railiance.cluster-bootstrap", - "name": "Railiance Cluster Runtime Bootstrap", - "summary": "Cluster runtime entry point of the Railiance Infrastructure-as-Code framework: from two bare Linux servers, a Git repo, and credentials, rebuilds a fully automated Kubernetes-based environment.", - "vector": "D3 / A2 / C1 / R0", + "name": "Kubernetes runtime and cluster controls", + "summary": "k3s, ingress, CNI, operators and kubeconfig/runtime checks.", "domain": "financials", "status": "draft", "owner": "railiance-cluster", - "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", "tags": [ "railiance", "kubernetes", "iac", - "bootstrap" + "bootstrap", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.cluster-bootstrap.md", "consumption_modes": [ - "cli", - "ansible playbook" + "CLI", + "source" ], "source_repo": "railiance-cluster", "source_url": "https://forgejo.coulomb.social/coulomb/railiance-cluster/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1429,22 +1503,25 @@ }, { "id": "capability.railiance.fabric-graph", - "name": "Railiance Fabric Ecosystem Graph", - "summary": "Models the durable infrastructure-responsibility graph of the Railiance netkingdom: schemas, discovery tools, registry services, graph queries, and State Hub export contracts for services, machines, repos, deployables, endpoints, ownership, dependencies, and bindings.", - "vector": "D3 / A1 / C1 / R0", + "name": "Infrastructure ownership and dependency graph", + "summary": "Schemas, validation, graph queries and State Hub exports.", "domain": "financials", "status": "draft", "owner": "railiance-fabric", - "path": "registry/capabilities/capability.railiance.fabric-graph.md", "tags": [ "railiance", "graph", "ownership", - "discovery" + "discovery", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.fabric-graph.md", "consumption_modes": [ - "library import", - "cli (validation)" + "CLI", + "source" ], "source_repo": "railiance-fabric", "source_url": "https://forgejo.coulomb.social/coulomb/railiance-fabric/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1452,22 +1529,25 @@ }, { "id": "capability.railiance.forge-infrastructure", - "name": "Railiance Forge And Artifact Infrastructure", - "summary": "Source forge, registry, and automation-runner infrastructure for Railiance, separated out from railiance-apps/railiance-enablement; covers current Gitea operation, the Forgejo migration, container/package registries, and Actions runner substrate.", - "vector": "D3 / A1 / C1 / R0", + "name": "Source forge, registries and runner substrate", + "summary": "Forgejo operation, package registries and runner lifecycle.", "domain": "financials", "status": "draft", "owner": "railiance-forge", - "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", "tags": [ "railiance", "forgejo", "forge", - "ci-runner" + "ci-runner", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.forge-infrastructure.md", "consumption_modes": [ - "cli (operator tooling)", - "documentation/runbooks" + "CLI", + "source" ], "source_repo": "railiance-forge", "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1475,22 +1555,25 @@ }, { "id": "capability.railiance.infra-provisioning", - "name": "RailianceHosts Infrastructure Provisioning", - "summary": "Git-driven server provisioning and convergence for Hosteurope/Hetzner Cloud using Terraform, cloud-init, and Ansible, with SOPS+age encrypted in-repo secrets and a servers.yaml inventory as source of truth.", - "vector": "D4 / A2 / C2 / R1", + "name": "Host convergence and security baseline", + "summary": "Ansible inventory, firewall, SSH bootstrap and baseline verification.", "domain": "financials", "status": "draft", "owner": "railiance-infra", - "path": "registry/capabilities/capability.railiance.infra-provisioning.md", "tags": [ "railiance", "terraform", "ansible", - "infrastructure" + "infrastructure", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A2 / C2 / R1", + "path": "registry/capabilities/capability.railiance.infra-provisioning.md", "consumption_modes": [ - "cli (terraform/ansible)", - "gitops" + "CLI", + "source" ], "source_repo": "railiance-infra", "source_url": "https://forgejo.coulomb.social/coulomb/railiance-infra/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1498,21 +1581,25 @@ }, { "id": "capability.railiance.platform-services", - "name": "Railiance Platform Services", - "summary": "S3 Platform Services layer of the Railiance OAS Stack \u2014 shared cluster services: PostgreSQL HA, Valkey cache, secret management, identity integration, and object storage.", - "vector": "D3 / A2 / C1 / R0", + "name": "Secret custody and platform data services", + "summary": "OpenBao policy/custody, consumer grants, secret delivery and database/backup contracts.", "domain": "financials", "status": "draft", "owner": "railiance-platform", - "path": "registry/capabilities/capability.railiance.platform-services.md", "tags": [ "railiance", "platform", "secrets", - "postgres" + "postgres", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.railiance.platform-services.md", "consumption_modes": [ - "cli (shell/python scripts)" + "CLI", + "source" ], "source_repo": "railiance-platform", "source_url": "https://forgejo.coulomb.social/coulomb/railiance-platform/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1520,22 +1607,25 @@ }, { "id": "capability.railiance.workload-deployment-tooling", - "name": "Railiance Application Workload Deployment Tooling", - "summary": "S5 Workloads and Experience Endpoints layer of the Railiance OAS Stack \u2014 application Helm releases, Kubernetes workload manifests, deployment guardrails, and smoke-test/check tooling for user-facing services.", - "vector": "D3 / A2 / C1 / R1", + "name": "Workload release configuration and guards", + "summary": "Helm/manifests, exact image pins, application runbooks and rollout/rollback.", "domain": "financials", "status": "draft", "owner": "railiance-apps", - "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", "tags": [ "railiance", "kubernetes", "helm", - "deployment" + "deployment", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.railiance.workload-deployment-tooling.md", "consumption_modes": [ - "cli (shell scripts)", - "helm/kubernetes deployment" + "CLI", + "source" ], "source_repo": "railiance-apps", "source_url": "https://forgejo.coulomb.social/coulomb/railiance-apps/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1543,23 +1633,24 @@ }, { "id": "capability.registry.register", - "name": "Capability Registration", - "summary": "Register a new capability so it becomes visible for planning and implementation reuse.", - "vector": "D3 / A4 / C2 / R3", + "name": "Capability registry and federation", + "summary": "Owner Markdown entries, indexes, federation hub and planning queries.", "domain": "helix_forge", "status": "draft", "owner": "reuse-surface", - "path": "registry/capabilities/capability.registry.register.md", "tags": [ "registry", "governance", - "meta" + "meta", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A3 / C2 / R3", + "path": "registry/capabilities/capability.registry.register.md", "consumption_modes": [ - "informational", - "markdown authoring", - "cli", - "service API" + "library", + "CLI" ], "source_repo": "reuse-surface", "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1567,43 +1658,225 @@ }, { "id": "capability.registry.validate", - "name": "Registry Entry Validation", - "summary": "Validate capability registry entries against schema, index consistency, and relation integrity.", - "vector": "D4 / A3 / C3 / R3", + "name": "Capability registry validation", + "summary": "Schema, index consistency and relation checks.", "domain": "helix_forge", "status": "draft", "owner": "reuse-surface", - "path": "registry/capabilities/capability.registry.validate.md", "tags": [ "registry", "validation", - "cli" + "cli", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A3 / C3 / R3", + "path": "registry/capabilities/capability.registry.validate.md", "consumption_modes": [ - "cli" + "library", + "CLI" ], "source_repo": "reuse-surface", "source_url": "https://forgejo.coulomb.social/coulomb/reuse-surface/raw/branch/main/registry/indexes/capabilities.yaml", "source_index": "/data/cache/reuse-surface.yaml" }, { - "id": "capability.security.iam-tooling-suite", - "name": "NetKingdom Security/IAM Tooling Suite", - "summary": "Canonical security architecture and executable reference tooling for IAM, bootstrap, posture validation, deterministic plan-only security scenario composition, and proposal-only posture feedback.", - "vector": "D3 / A2 / C1 / R1", + "id": "capability.security.access-routing", + "name": "Credential routing and contained access", + "summary": "warden route and access catalog; exact lane conduit and secret-exec routing.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A3 / C1 / R0", + "path": "registry/capabilities/capability.security.access-routing.md", + "consumption_modes": [ + "library", + "CLI" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.bootstrap-recovery", + "name": "Guarded bootstrap and recovery preparation", + "summary": "Local identity, bootstrap console, encrypted custody handoff and caller tools.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.bootstrap-recovery.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-contracts", + "name": "Security case types and instance validation", + "summary": "Versioned types, cases and schema validation.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-contracts.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.case-follow-through", + "name": "Security case operational follow-through", + "summary": "KnownSecurityCase route, plan and operational receipts.", + "domain": "infotech", + "status": "draft", + "owner": "ops-warden", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.case-follow-through.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "ops-warden", + "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/ops-warden.yaml" + }, + { + "id": "capability.security.emission-profile", + "name": "Security emission cadence validation", + "summary": "Security profile over generic emission contracts and validator.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.emission-profile.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.forge-secret-prevention", + "name": "Independent introduced-history secret prevention", + "summary": "Pinned receive adapter, lifecycle template and fail-closed scan.", + "domain": "infotech", + "status": "draft", + "owner": "railiance-forge", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.forge-secret-prevention.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "railiance-forge", + "source_url": "https://forgejo.coulomb.social/coulomb/railiance-forge/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/railiance-forge.yaml" + }, + { + "id": "capability.security.iam-tooling-suite", + "name": "NetKingdom security architecture and conformance tooling", + "summary": "Versioned IAM, layer, tenancy and credential contracts plus validators.", "domain": "infotech", "status": "draft", "owner": "net-kingdom", - "path": "registry/capabilities/capability.security.iam-tooling-suite.md", "tags": [ "security", "iam", "kubernetes", - "conformance" + "conformance", + "netkingdom", + "framework-reuse" ], + "vector": "D3 / A2 / C1 / R1", + "path": "registry/capabilities/capability.security.iam-tooling-suite.md", "consumption_modes": [ - "cli", - "local web ui" + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.posture-feedback", + "name": "Deterministic posture feedback", + "summary": "CLI evaluates evidence age and posture into owner-routed findings.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.posture-feedback.md", + "consumption_modes": [ + "CLI", + "source" + ], + "source_repo": "net-kingdom", + "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", + "source_index": "/data/cache/net-kingdom.yaml" + }, + { + "id": "capability.security.scenario-compose", + "name": "Deterministic security scenario composition", + "summary": "CLI selects pinned providers and orders trust transitions.", + "domain": "infotech", + "status": "draft", + "owner": "net-kingdom", + "tags": [ + "security", + "netkingdom", + "framework-reuse" + ], + "vector": "D3 / A2 / C1 / R0", + "path": "registry/capabilities/capability.security.scenario-compose.md", + "consumption_modes": [ + "CLI", + "source" ], "source_repo": "net-kingdom", "source_url": "https://forgejo.coulomb.social/coulomb/net-kingdom/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1611,24 +1884,26 @@ }, { "id": "capability.security.ssh-certificate-issuance", - "name": "SSH Certificate Issuance", - "summary": "Issue short-lived CA-signed SSH certificates for adm, agt, and atm actors through a stable cert_command CLI interface; steward NetKingdom operational access routing.", - "vector": "D4 / A3 / C3 / R2", + "name": "Decision-bound SSH certificates", + "summary": "warden sign with local and OpenBao backends and adm/agt/atm actors.", "domain": "helix_forge", "status": "draft", "owner": "ops-warden", - "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", "tags": [ "ssh", "certificate", "ca", "ops-warden", "openbao", - "security" + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A3 / C3 / R2", + "path": "registry/capabilities/capability.security.ssh-certificate-issuance.md", "consumption_modes": [ - "CLI", - "cert_command subprocess" + "library", + "CLI" ], "source_repo": "ops-warden", "source_url": "https://forgejo.coulomb.social/coulomb/ops-warden/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1636,20 +1911,24 @@ }, { "id": "capability.statehub.progress-log", - "name": "Work Progress Logging", - "summary": "Record progress events, decisions, and session notes against workstreams and tasks in State Hub.", - "vector": "D4 / A4 / C3 / R3", + "name": "Progress and work evidence indexing", + "summary": "REST progress and task evidence references.", "domain": "helix_forge", "status": "draft", "owner": "state-hub", - "path": "registry/capabilities/capability.statehub.progress-log.md", "tags": [ "state-hub", "progress", - "coordination" + "coordination", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A4 / C3 / R3", + "path": "registry/capabilities/capability.statehub.progress-log.md", "consumption_modes": [ - "service API" + "HTTP API", + "source" ], "source_repo": "state-hub", "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1657,21 +1936,24 @@ }, { "id": "capability.statehub.workstream-coordinate", - "name": "Workstream And Task Coordination", - "summary": "Track active workstreams, tasks, progress, and consistency across domain repositories.", - "vector": "D4 / A4 / C3 / R2", + "name": "Cross-repository work tracking", + "summary": "File-derived workplans, tasks, dependencies, decisions and coordination views.", "domain": "helix_forge", "status": "draft", "owner": "state-hub", - "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", "tags": [ "state-hub", "coordination", - "workplans" + "workplans", + "security", + "netkingdom", + "framework-reuse" ], + "vector": "D4 / A4 / C3 / R2", + "path": "registry/capabilities/capability.statehub.workstream-coordinate.md", "consumption_modes": [ - "service API", - "HTTP REST" + "HTTP API", + "source" ], "source_repo": "state-hub", "source_url": "https://forgejo.coulomb.social/coulomb/state-hub/raw/branch/main/registry/indexes/capabilities.yaml", @@ -1867,6 +2149,6 @@ "source_index": "/data/cache/shard-wiki.yaml" } ], - "composed_at": "2026-10-14T00:17:44+00:00", + "composed_at": "2026-10-14T18:17:44+00:00", "stale": false } diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-owner-consent-verification.json b/docs/assessments/netkingdom-2026-10-14/hosted-owner-consent-verification.json new file mode 100644 index 00000000..48e9c558 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-owner-consent-verification.json @@ -0,0 +1,17 @@ +{ + "checked_at": "2026-10-14T22:34:23.499101+00:00", + "expected": 70, + "present": 63, + "missing": [ + "capability.railiance.openbao-package", + "capability.railiance.policy-publication-package", + "capability.railiance.postgres-isolation-recovery", + "capability.railiance.sbom-runtime-package", + "capability.railiance.telemetry-package", + "capability.railiance.tenant-engine-package", + "capability.railiance.user-engine-package" + ], + "duplicates": [], + "composed_at": "2026-10-14T22:34:30+00:00", + "stale": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/hosted-post-all-clear-check.json b/docs/assessments/netkingdom-2026-10-14/hosted-post-all-clear-check.json new file mode 100644 index 00000000..0fd31a87 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hosted-post-all-clear-check.json @@ -0,0 +1,108 @@ +{ + "all_clear_message_id": "e6cbec92-af64-456b-8ee6-9b69913c03c3", + "checked_at": "2026-10-14T21:38:16.627522+00:00", + "hub": { + "composed_at": "2026-10-14T18:17:44+00:00", + "federated_capability_records": 76, + "registrations": 64, + "sources": 61, + "stale": false + }, + "public_plan": { + "absent": [ + "approval-engine", + "emergent-security", + "fin-hub", + "gate-house", + "glas-harness", + "informed-decision", + "kings-guard", + "maturity-engine", + "ops-mason", + "policy-nexus", + "rail-knative", + "rail-kubernetes", + "railiance-bootstrap", + "railiance-master", + "railiance-telemetry", + "rapp-playwright", + "reef-railiance", + "rein-aharness", + "rein-openweights", + "repo-manager", + "resource-control", + "risk-nexus", + "role-engine", + "runbook-tutorials", + "sand-boxer", + "sbom-nexus", + "secrets-engine", + "security-canon", + "tenant-engine", + "whitehat-security", + "zone-engine" + ], + "already_matching": [], + "conflicting": [], + "count": 31, + "plan_sha256": "768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b", + "proposal_id": "CUST81-REUSE-PUBLIC-REGISTRATION-R1", + "proposal_sha256": "84811121ae8d00970927b97bd6125b6a91989cce46dbe6b75a24592e15c16ca1", + "revision": 1 + }, + "registration_attempt": "OIDC login timed out waiting for provider; Warden and helper were not invoked; no hub writes occurred.", + "reviewed_inventory": { + "duplicate_ids": [], + "expected_ids": 70, + "missing_ids": [ + "capability.execution.openweight-rein", + "capability.execution.profile-harness", + "capability.execution.sandbox-provision", + "capability.execution.scheduled-agent-rein", + "capability.finance.security-budget-evidence", + "capability.identity.tenant-facts", + "capability.infotech.runbook-tutorials", + "capability.infotech.sbom-management", + "capability.observability.security-signals", + "capability.organization.role-catalog", + "capability.railiance.bootstrap-sequencing", + "capability.railiance.browser-verification", + "capability.railiance.knative-rail", + "capability.railiance.kubernetes-rail", + "capability.railiance.openbao-package", + "capability.railiance.policy-publication-package", + "capability.railiance.postgres-isolation-recovery", + "capability.railiance.sbom-runtime-package", + "capability.railiance.security-consumption-contracts", + "capability.railiance.substrate-bindings", + "capability.railiance.telemetry-package", + "capability.railiance.tenant-engine-package", + "capability.railiance.user-engine-package", + "capability.resources.security-capacity", + "capability.security.adversarial-evidence", + "capability.security.agent-knowledge", + "capability.security.approval-lifecycle", + "capability.security.credential-lifecycle", + "capability.security.doctrine-review", + "capability.security.human-decision-workspace", + "capability.security.maturity-claims", + "capability.security.policy-publication", + "capability.security.posture-assessment", + "capability.security.practice-canon", + "capability.security.repository-secret-prevention", + "capability.security.risk-register", + "capability.security.structure-construction", + "capability.security.zone-reference" + ], + "present_ids": 32 + }, + "schema": "custodian.netkingdom-hosted-registration-check.v1", + "write_attempted": false, + "writer_access": { + "CCR": "CCR-2026-0044", + "member_receipt": "/home/worsch/ops-mason/docs/evidence/2026-10-14-reuse-surface-hub-writer-member.txt", + "non_member_receipt": "/home/worsch/ops-mason/docs/evidence/2026-10-14-reuse-surface-hub-writer-non-member.txt", + "result": "both passed; member token revoked", + "status": "applied" + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/hub-private-registration-preparation-r1.json b/docs/assessments/netkingdom-2026-10-14/hub-private-registration-preparation-r1.json new file mode 100644 index 00000000..b1850475 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hub-private-registration-preparation-r1.json @@ -0,0 +1,155 @@ +{ + "id": "CUST81-PRIVATE-REGISTRATION-PREPARATION-R1", + "revision": 1, + "created_at": "2026-10-14T22:34:23.499101+00:00", + "status": "prepared; not executable until platform auth_env and native fetch receipts are bound", + "disclosure_consent_receipt": "private-source-owner-consent-r1.json", + "disclosure_proposal_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35", + "actions": [ + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-openbao", + "url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124", + "domain": "infotech", + "enabled": true, + "required": false, + "auth_env": null, + "auth_header": "Authorization" + }, + "capability_ids": [ + "capability.railiance.openbao-package" + ], + "consented_commit": "35672be138036c8433a5ac5de91e068c03c2b124", + "native_fetch_receipt": null, + "proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN" + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-policy-nexus", + "url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", + "domain": "infotech", + "enabled": true, + "required": false, + "auth_env": null, + "auth_header": "Authorization" + }, + "capability_ids": [ + "capability.railiance.policy-publication-package" + ], + "consented_commit": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", + "native_fetch_receipt": null, + "proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN" + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-postgres", + "url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "domain": "infotech", + "enabled": true, + "required": false, + "auth_env": null, + "auth_header": "Authorization" + }, + "capability_ids": [ + "capability.railiance.postgres-isolation-recovery" + ], + "consented_commit": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "native_fetch_receipt": null, + "proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN" + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-sbom-nexus", + "url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1", + "domain": "infotech", + "enabled": true, + "required": false, + "auth_env": null, + "auth_header": "Authorization" + }, + "capability_ids": [ + "capability.railiance.sbom-runtime-package" + ], + "consented_commit": "adbedd349e8df97be43a1f57db7095af45ff29d1", + "native_fetch_receipt": null, + "proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN" + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-telemetry", + "url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5", + "domain": "infotech", + "enabled": true, + "required": false, + "auth_env": null, + "auth_header": "Authorization" + }, + "capability_ids": [ + "capability.railiance.telemetry-package" + ], + "consented_commit": "f158307e24b86bab88a1af4830ff6b4f85afdeb5", + "native_fetch_receipt": null, + "proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN" + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-tenant-engine", + "url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557", + "domain": "infotech", + "enabled": true, + "required": false, + "auth_env": null, + "auth_header": "Authorization" + }, + "capability_ids": [ + "capability.railiance.tenant-engine-package" + ], + "consented_commit": "9bdc86572728783a5ed94266f04f7b12d414c557", + "native_fetch_receipt": null, + "proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN" + }, + { + "method": "POST", + "path": "/v1/repos", + "body": { + "repo": "rapp-user-engine", + "url": "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738", + "domain": "infotech", + "enabled": true, + "required": false, + "auth_env": null, + "auth_header": "Authorization" + }, + "capability_ids": [ + "capability.railiance.user-engine-package" + ], + "consented_commit": "f35108f9e1b8702fb6c526fe42b2fec5ca032738", + "native_fetch_receipt": null, + "proposed_auth_env": "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN" + } + ], + "gates": [ + "Exact consented index and entry hashes must match native hub-side fetched bytes", + "Independent technical reviews and reviewed platform credential delivery must be recorded", + "Replace null auth_env only with the platform-confirmed environment variable name; retain a new executable proposal digest", + "Read existing registrations; reject conflicts without overwrite", + "After registration force native hosted refresh and prove all 70 reviewed IDs exactly once", + "Use consented-commit pinned raw API URLs; mutable main must not automatically publish unreviewed future metadata." + ], + "reader_proposal": { + "path": "private-reader-provisioning-preparation-r1.json", + "sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99" + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/hub-private-registration-r1.lock b/docs/assessments/netkingdom-2026-10-14/hub-private-registration-r1.lock new file mode 100644 index 00000000..e69de29b diff --git a/docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json b/docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json index af6b3430..3e9db88b 100644 --- a/docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json +++ b/docs/assessments/netkingdom-2026-10-14/hub-private-source-pending.json @@ -1,5 +1,5 @@ { - "reason": "Anonymous source fetch returns 404; hub-side read credential or separately approved metadata publication is needed. Do not change repository visibility.", + "reason": "Owner disclosure consent recorded for all seven exact source revisions; restricted hub-side reader, independent technical reviews and native authenticated index/entry fetch verification remain pending. Repositories stay private.", "repos": [ "rapp-openbao", "rapp-policy-nexus", @@ -98,7 +98,8 @@ "needed_fields": [ "auth_env name for an already admitted hub-side source-read credential", "proof that the credential is limited to the intended repository read scope", - "successful hub-side index fetch without value disclosure", - "owner consent to metadata appearing in public federation" - ] + "successful hub-side index fetch without value disclosure" + ], + "consent_receipt": "private-source-owner-consent-r1.json", + "registration_preparation": "hub-private-registration-preparation-r1.json" } diff --git a/docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl b/docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl new file mode 100644 index 00000000..6656f364 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/hub-public-resume-receipts.jsonl @@ -0,0 +1,125 @@ +{"at":"2026-10-14T21:55:44.707164+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"} +{"at":"2026-10-14T21:55:44.709724+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"} +{"at":"2026-10-14T21:55:44.712173+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"} +{"at":"2026-10-14T21:55:44.714415+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"} +{"at":"2026-10-14T21:55:44.716362+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"} +{"at":"2026-10-14T21:55:44.718351+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"} +{"at":"2026-10-14T21:55:44.720385+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"} +{"at":"2026-10-14T21:55:44.722486+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"} +{"at":"2026-10-14T21:55:44.724716+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"} +{"at":"2026-10-14T21:55:44.727047+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"} +{"at":"2026-10-14T21:55:44.729015+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"} +{"at":"2026-10-14T21:55:44.730901+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"} +{"at":"2026-10-14T21:55:44.732745+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"} +{"at":"2026-10-14T21:55:44.735376+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"} +{"at":"2026-10-14T21:55:44.737359+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"} +{"at":"2026-10-14T21:55:44.739539+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"} +{"at":"2026-10-14T21:55:44.741686+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"} +{"at":"2026-10-14T21:55:44.743806+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"} +{"at":"2026-10-14T21:55:44.746032+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"} +{"at":"2026-10-14T21:55:44.748361+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"} +{"at":"2026-10-14T21:55:44.750542+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"} +{"at":"2026-10-14T21:55:44.752378+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"} +{"at":"2026-10-14T21:55:44.754465+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"} +{"at":"2026-10-14T21:55:44.756568+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"} +{"at":"2026-10-14T21:55:44.758526+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"} +{"at":"2026-10-14T21:55:44.760477+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"} +{"at":"2026-10-14T21:55:44.762377+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"} +{"at":"2026-10-14T21:55:44.764325+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"} +{"at":"2026-10-14T21:55:44.766244+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"} +{"at":"2026-10-14T21:55:44.768233+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"} +{"at":"2026-10-14T21:55:44.770217+00:00","attempt_id":"372bd02c-2891-4c0e-bbbb-1550e981d378","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"} +{"at":"2026-10-14T22:11:13.307878+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"} +{"at":"2026-10-14T22:11:13.311161+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"} +{"at":"2026-10-14T22:11:13.313775+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"} +{"at":"2026-10-14T22:11:13.317225+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"} +{"at":"2026-10-14T22:11:13.320078+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"} +{"at":"2026-10-14T22:11:13.322597+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"} +{"at":"2026-10-14T22:11:13.325032+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"} +{"at":"2026-10-14T22:11:13.327383+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"} +{"at":"2026-10-14T22:11:13.329639+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"} +{"at":"2026-10-14T22:11:13.332961+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"} +{"at":"2026-10-14T22:11:13.335882+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"} +{"at":"2026-10-14T22:11:13.338252+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"} +{"at":"2026-10-14T22:11:13.340768+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"} +{"at":"2026-10-14T22:11:13.342993+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"} +{"at":"2026-10-14T22:11:13.344988+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"} +{"at":"2026-10-14T22:11:13.347525+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"} +{"at":"2026-10-14T22:11:13.349658+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"} +{"at":"2026-10-14T22:11:13.351939+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"} +{"at":"2026-10-14T22:11:13.354038+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"} +{"at":"2026-10-14T22:11:13.356052+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"} +{"at":"2026-10-14T22:11:13.358055+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"} +{"at":"2026-10-14T22:11:13.360086+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"} +{"at":"2026-10-14T22:11:13.362568+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"} +{"at":"2026-10-14T22:11:13.365022+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"} +{"at":"2026-10-14T22:11:13.367367+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"} +{"at":"2026-10-14T22:11:13.369443+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"} +{"at":"2026-10-14T22:11:13.371507+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"} +{"at":"2026-10-14T22:11:13.373667+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"} +{"at":"2026-10-14T22:11:13.376203+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"} +{"at":"2026-10-14T22:11:13.378859+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"} +{"at":"2026-10-14T22:11:13.380873+00:00","attempt_id":"a6e2c26e-4457-4275-a215-b493639f7e45","outcome":"would_create","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"} +{"at":"2026-10-14T22:19:19.969383+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"} +{"at":"2026-10-14T22:19:19.969383+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"approval-engine"} +{"at":"2026-10-14T22:19:20.096237+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"} +{"at":"2026-10-14T22:19:20.096237+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"emergent-security"} +{"at":"2026-10-14T22:19:20.201945+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"} +{"at":"2026-10-14T22:19:20.201945+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"fin-hub"} +{"at":"2026-10-14T22:19:20.311948+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"} +{"at":"2026-10-14T22:19:20.311948+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"gate-house"} +{"at":"2026-10-14T22:19:20.417470+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"} +{"at":"2026-10-14T22:19:20.417470+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"glas-harness"} +{"at":"2026-10-14T22:19:20.516965+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"} +{"at":"2026-10-14T22:19:20.516965+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"informed-decision"} +{"at":"2026-10-14T22:19:20.627189+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"} +{"at":"2026-10-14T22:19:20.627189+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"kings-guard"} +{"at":"2026-10-14T22:19:20.738432+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"} +{"at":"2026-10-14T22:19:20.738432+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"maturity-engine"} +{"at":"2026-10-14T22:19:20.852933+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"} +{"at":"2026-10-14T22:19:20.852933+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"ops-mason"} +{"at":"2026-10-14T22:19:20.955682+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"} +{"at":"2026-10-14T22:19:20.955682+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"policy-nexus"} +{"at":"2026-10-14T22:19:21.063571+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"} +{"at":"2026-10-14T22:19:21.063571+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-kubernetes"} +{"at":"2026-10-14T22:19:21.172865+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"} +{"at":"2026-10-14T22:19:21.172865+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-bootstrap"} +{"at":"2026-10-14T22:19:24.202084+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"} +{"at":"2026-10-14T22:19:24.202084+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-master"} +{"at":"2026-10-14T22:19:24.304744+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"} +{"at":"2026-10-14T22:19:24.304744+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"railiance-telemetry"} +{"at":"2026-10-14T22:19:24.404162+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"} +{"at":"2026-10-14T22:19:24.404162+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rapp-playwright"} +{"at":"2026-10-14T22:19:24.501978+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"} +{"at":"2026-10-14T22:19:24.501978+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"reef-railiance"} +{"at":"2026-10-14T22:19:24.598482+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"} +{"at":"2026-10-14T22:19:24.598482+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-aharness"} +{"at":"2026-10-14T22:19:24.716900+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"} +{"at":"2026-10-14T22:19:24.716900+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rein-openweights"} +{"at":"2026-10-14T22:19:24.815553+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"} +{"at":"2026-10-14T22:19:24.815553+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"repo-manager"} +{"at":"2026-10-14T22:19:24.921586+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"} +{"at":"2026-10-14T22:19:24.921586+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"resource-control"} +{"at":"2026-10-14T22:19:25.034921+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"} +{"at":"2026-10-14T22:19:25.034921+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"risk-nexus"} +{"at":"2026-10-14T22:19:25.143690+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"} +{"at":"2026-10-14T22:19:25.143690+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"role-engine"} +{"at":"2026-10-14T22:19:25.247740+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"} +{"at":"2026-10-14T22:19:25.247740+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"runbook-tutorials"} +{"at":"2026-10-14T22:19:25.351093+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"} +{"at":"2026-10-14T22:19:25.351093+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sand-boxer"} +{"at":"2026-10-14T22:19:25.454641+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"} +{"at":"2026-10-14T22:19:25.454641+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"sbom-nexus"} +{"at":"2026-10-14T22:19:25.558997+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"} +{"at":"2026-10-14T22:19:25.558997+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"secrets-engine"} +{"at":"2026-10-14T22:19:25.659662+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"} +{"at":"2026-10-14T22:19:25.659662+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"security-canon"} +{"at":"2026-10-14T22:19:25.769760+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"} +{"at":"2026-10-14T22:19:25.769760+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"tenant-engine"} +{"at":"2026-10-14T22:19:25.879033+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"} +{"at":"2026-10-14T22:19:25.879033+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"whitehat-security"} +{"at":"2026-10-14T22:19:25.974741+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"} +{"at":"2026-10-14T22:19:25.974741+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"zone-engine"} +{"at":"2026-10-14T22:19:26.069099+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"post_intent","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"} +{"at":"2026-10-14T22:19:26.069099+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","http_status":201,"outcome":"applied","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo":"rail-knative"} +{"at":"2026-10-14T22:19:26.261887+00:00","attempt_id":"64044e01-2f96-4e63-bbba-ad53b1617f0c","outcome":"readback_verified","plan_sha256":"768449eaec05f38c6820f2747a2ef388b10b57a341dc01768218646499aaf39b","repo_count":31} diff --git a/docs/assessments/netkingdom-2026-10-14/live-authenticated-source-inventory-r1.json b/docs/assessments/netkingdom-2026-10-14/live-authenticated-source-inventory-r1.json new file mode 100644 index 00000000..b6633b91 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/live-authenticated-source-inventory-r1.json @@ -0,0 +1,14 @@ +{ + "checked_at": "2026-10-14T23:01:13.254261+00:00", + "target_node_ip": "92.205.62.239", + "pod": "reuse-surface-54fb694b9-tv59j", + "helper_sha256": "42eed5513db090d338daec39258b89a4ce2e9369d175c3c8312904ed68867ee1", + "read_only": true, + "raw_output_discarded": true, + "credentials_read": false, + "secrets_or_environment_dumped": false, + "previous_deployment_target_attempt": "refused_or_unavailable; preserved; direct verified pod probe succeeded", + "status": "verified", + "authenticated_source_count": 0, + "sources": [] +} diff --git a/docs/assessments/netkingdom-2026-10-14/live-native-federation-source-r1.json b/docs/assessments/netkingdom-2026-10-14/live-native-federation-source-r1.json new file mode 100644 index 00000000..f9bb7d35 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/live-native-federation-source-r1.json @@ -0,0 +1,8 @@ +{ + "checked_at": "2026-10-14T23:18:45.427267+00:00", + "pod": "reuse-surface-54fb694b9-tv59j", + "read_only": true, + "raw_output_discarded": true, + "status": "verified", + "native_source_sha256": "b6bde1e0942189e422f0c87f226ae28027f0dff1a29887a55eb88c8eaafe58ce" +} diff --git a/docs/assessments/netkingdom-2026-10-14/oidc-diagnostic-finding-correction-r1.json b/docs/assessments/netkingdom-2026-10-14/oidc-diagnostic-finding-correction-r1.json new file mode 100644 index 00000000..17768c1d --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/oidc-diagnostic-finding-correction-r1.json @@ -0,0 +1,11 @@ +{ + "id": "CUST81-OIDC-DIAGNOSTIC-FINDING-CORRECTION-R1", + "checked_at": "2026-10-15T02:18:32.162341+00:00", + "earlier_finding": "Appending -format=json after role= was characterized as functional format parsing bug.", + "corrected_evidence": "Bao command/main.go setupEnv scans all argv for global format before commandparser. The trailingflag selectsJSONoutput even though flag.FlagSet leaves it in authdata; OIDC ignoresunknownkey.", + "disposition": "Defensive argumentordering improvement, not proven functional bug or121secondcause.", + "still_confirmed_gap": "Warden fallback tokenrecoveryregex omits estate s. token shape.", + "server_correlation": "Sparse whitelisted events insufficient to prove authsuccess/failure/issuance/revocation.", + "actual_timeout_cause": "unproven", + "next_evidence": "Fixed value outputdiagnostic category on next attendedattempt or founderfinalpage clarification; noallowlist relaxation." +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-access-gate.json b/docs/assessments/netkingdom-2026-10-14/owner-access-gate.json index 514edc14..fd27ebd4 100644 --- a/docs/assessments/netkingdom-2026-10-14/owner-access-gate.json +++ b/docs/assessments/netkingdom-2026-10-14/owner-access-gate.json @@ -3,16 +3,16 @@ "id": "5cd22087-e5d8-5d5e-a252-610a6ac13653", "topic_id": "cee7bedf-2b48-46ef-8601-006474f2ad7a", "title": "Complete scoped owner provisioning for reuse-surface discovery", - "description": "Execution/evidence gate for CUST-WP-0081-T02. The user selected Arrange scoped owner access; that direction is already recorded and is not being requested again. railiance-platform must confirm caller admission through reuse-surface-hub-write-token (the actual attempt was denied by OpenBao 403), and provide the non-secret hub auth_env reference plus scoped-read and metadata-publication admission evidence for rapp-openbao, rapp-policy-nexus, rapp-postgres, rapp-sbom-nexus, rapp-telemetry, rapp-tenant-engine and rapp-user-engine. Exact requirements: docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json. No secret values in this record. Resolve on verified provisioning receipts; resolution alone is not a runtime credential grant. Do not attach to the already-resolved general October 11 provisioning decision or mark completed based on user intent.", + "description": "Execution/evidence gate for CUST-WP-0081-T02. Public batch applied and verified (63/70 hosted). Founder metadata disclosure consent for all seven private source revisions recorded separately as decision d8f8f216-ac94-4295-97f3-825fd21254ea; do not request it again. Remaining: independent technical reviews, restricted hub-only repository reader through railiance-platform reviewed custody/ESO delivery, sanitized auth_env and native fetch receipts, seven registrations and final all-70 audit. This gate stays open until verified provisioning; metadata consent is not a credential or rollout grant. See docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json and scoped-access-handoff.json.", "decision_type": "pending", "status": "open", - "rationale": "All 70 owner capability records are established locally and published; hosted discovery remains 32/70. The remaining 38 registrations need this owner setup.", + "rationale": "All 70 owner records published; 63/70 verified hosted. Owner disclosure consent satisfied; seven-source reader and native fetch evidence pending.", "decided_by": null, "decided_at": null, "deadline": null, "escalation_note": null, "superseded_by": null, "created_at": "2026-10-14T07:51:34.426143Z", - "updated_at": "2026-10-14T07:51:34.426143Z", + "updated_at": "2026-10-14T22:31:45.188478Z", "workstream_id": "e8992815-389a-5c40-8569-a2b0ee3945f0" } diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json new file mode 100644 index 00000000..1d71e6e2 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/active-phase-a-source-declaration-r1.json @@ -0,0 +1,23 @@ +{ + "id": "CUST81-APPS-ACTIVE-PHASE-A-SOURCE-DECLARATION-R1", + "decision_id": "9833715e-a22a-45c0-ab6c-881f0f4f1a0e", + "approved_combined_proposal_digest_prefix": "704a9c", + "effect": "existing founder-approved phase A exact effect declared in normal production values, preventing later make reapply from restoring vulnerable image", + "path": "helm/reuse-surface-values.yaml", + "predecessor_sha256": "sha256:1b69c76629c8a938ca372f64d20513bbb9a59dcf12bb84f69b29228bc2bd2f60", + "new_sha256": "sha256:56c776b6f9c371c252f788058c16c678c47c5d1ef9e8666601897a22a91b272f", + "old_prod_plus_approved_overlay_semantics_equal": true, + "entire_normal_chart_render_equals_approved_phase_a_objects": true, + "image_digest": "sha256:2364b7e7859daccf9340a063654e2b09eed1bc27e0adf7b23cbb4b30135a7db0", + "allowlist_url_count": 14, + "other_value_semantics_unchanged": true, + "live_apply_performed": false, + "credential_or_eso_change": false, + "bound_preparation_artifacts_changed": false, + "status": "published_primary_reconciled", + "commit": "91f828b3c167c72ab9a0cec1263467345a7ab63c", + "remote_main": "91f828b3c167c72ab9a0cec1263467345a7ab63c", + "primary_derived_commit": "91f828b3c167c72ab9a0cec1263467345a7ab63c", + "normal_rmgr_status": "applied", + "primary_instance": "railiance01" +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/exact-execution-proposal-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/exact-execution-proposal-r1.json new file mode 100644 index 00000000..e840ec31 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/exact-execution-proposal-r1.json @@ -0,0 +1,53 @@ +{ + "id": "CUST81-APPS-PHASE-A-EXECUTION-PROPOSAL-R1", + "status": "prepared_not_executed", + "requires_founder_live_change_approval": true, + "release": "reuse", + "namespace": "reuse", + "source_commit": "05f654e20f7ea68471e586d7892e25441c65875d", + "source_archive_command": [ + "git", + "-C", + "/home/worsch/railiance-apps", + "archive", + "--format=tar.gz", + "-o", + "/tmp/cust81-apps-05f654e.tar.gz", + "05f654e20f7ea68471e586d7892e25441c65875d", + "charts/reuse-surface", + "helm/reuse-surface-values.yaml", + "docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml" + ], + "node_preparation_commands": [ + "ssh railiance01 'mkdir -p /tmp/cust81-phase-a-05f654e'", + "scp /tmp/cust81-apps-05f654e.tar.gz railiance01:/tmp/cust81-phase-a-05f654e/source.tar.gz", + "ssh railiance01 'tar -xzf /tmp/cust81-phase-a-05f654e/source.tar.gz -C /tmp/cust81-phase-a-05f654e'" + ], + "exact_deploy_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml helm upgrade reuse /tmp/cust81-phase-a-05f654e/charts/reuse-surface --namespace reuse -f /tmp/cust81-phase-a-05f654e/helm/reuse-surface-values.yaml -f /tmp/cust81-phase-a-05f654e/docs/assessments/cust81-private-reader/phase-a-local-image-r1/phase-a-values.proposed.yaml --atomic --wait --timeout 5m'", + "phase_a_rollback_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml helm rollback reuse 10 --namespace reuse --wait --timeout 5m'", + "rollback_gate": "valid only before reader delivery; after phase B revoke/remove reader and verify absence before old image restore", + "last_deployed_revision": 10, + "pre_execution_recheck": [ + "node92.205.62.239 and100m/256Mi surge capacity", + "authenticated registrations remain0", + "current Helm revision10/deployed and no pending operation", + "no reader ESO delivery performed", + "published manifest digest2364b7e... matches approval", + "database backup recovery receipt fresh enough for planned change and abort owner identified" + ], + "safe_output_contract": "Executor captures/discards raw Helm/kubectl stdout/stderr and emits only whitelisted status/target/digest/readiness fields; never prints Secrets/env/annotations/rawerrors", + "database_recovery_receipt": { + "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/reuse-database-recovery-preflight-r2.json", + "sha256": "c27c99cae46e7f1f0fb26fca91fdaec860d241966177432b3d55d391d10de84e" + }, + "incremental_infrastructure_cost_eur": 0, + "credible_loss_bound_eur": null, + "risk": "supervised qualitative service/SQLite recovery risk; no autopilot grant", + "post_deploy_checks": [ + "running imageID matches publisheddigest", + "Ready API/landing andhealth", + "native credential-routing refusals remain effective", + "fresh federation contains all63 public reviewed IDs exactlyonce", + "phaseBnotstarted until phaseAverificationreceipt" + ] +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/helm-recovery-revision-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/helm-recovery-revision-r1.json new file mode 100644 index 00000000..7c4c9e5f --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/helm-recovery-revision-r1.json @@ -0,0 +1,49 @@ +{ + "release": "reuse", + "namespace": "reuse", + "last_deployed_revision": 10, + "revisions": [ + { + "revision": 1, + "status": "superseded" + }, + { + "revision": 2, + "status": "superseded" + }, + { + "revision": 3, + "status": "superseded" + }, + { + "revision": 4, + "status": "superseded" + }, + { + "revision": 5, + "status": "superseded" + }, + { + "revision": 6, + "status": "superseded" + }, + { + "revision": 7, + "status": "superseded" + }, + { + "revision": 8, + "status": "superseded" + }, + { + "revision": 9, + "status": "superseded" + }, + { + "revision": 10, + "status": "deployed" + } + ], + "raw_descriptions_values_stdout_stderr_discarded": true, + "live_change": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/semantic-diff-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/semantic-diff-r1.json new file mode 100644 index 00000000..96a27656 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/semantic-diff-r1.json @@ -0,0 +1,53 @@ +{ + "status": "verified_intended_changes_only", + "kubectl_diff_exit": 1, + "changes": [ + { + "object_name": "reuse-surface", + "direction": "removed", + "field": "generation", + "classification": "server_managed_generation_increment", + "expected_value_verified": true + }, + { + "object_name": "reuse-surface", + "direction": "added", + "field": "generation", + "classification": "server_managed_generation_increment", + "expected_value_verified": true + }, + { + "object_name": "reuse-surface", + "direction": "added", + "field": "- name", + "classification": "intended_allowlist_env_name", + "expected_value_verified": true + }, + { + "object_name": "reuse-surface", + "direction": "added", + "field": "value", + "classification": "intended_exact14_allowlist_env_value", + "expected_value_verified": true + }, + { + "object_name": "reuse-surface", + "direction": "removed", + "field": "image", + "classification": "prior_image", + "expected_value_verified": true + }, + { + "object_name": "reuse-surface", + "direction": "added", + "field": "image", + "classification": "intended_image", + "expected_value_verified": true + } + ], + "raw_values_annotations_stderr_discarded": true, + "live_changes": false, + "custom_external_parser_attempt": "did not yield receipt, no semantic claim inferred", + "generation_before": 6, + "generation_after_dry_run": 7 +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/server-preflight-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/server-preflight-r1.json new file mode 100644 index 00000000..eab49c39 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/server-preflight-r1.json @@ -0,0 +1,110 @@ +{ + "checked_at": "2026-10-14T23:45:06.197843+00:00", + "target_node_ip": "92.205.62.239", + "release": "reuse", + "namespace": "reuse", + "render_sha256": "36c20c3e16757d3e888a3db02853032b33e791aa04a6055fe001121254345b81", + "reviewed_objects": [ + { + "kind": "ConfigMap", + "name": "reuse-surface-landing" + }, + { + "kind": "PersistentVolumeClaim", + "name": "reuse-surface-data" + }, + { + "kind": "Service", + "name": "reuse-surface-landing" + }, + { + "kind": "Service", + "name": "reuse-surface" + }, + { + "kind": "Deployment", + "name": "reuse-surface" + }, + { + "kind": "Deployment", + "name": "reuse-surface-landing" + }, + { + "kind": "Ingress", + "name": "reuse-surface" + }, + { + "kind": "Ingress", + "name": "reuse-surface-landing" + }, + { + "kind": "Ingress", + "name": "reuse-surface-http-redirect" + }, + { + "kind": "Middleware", + "name": "reuse-surface-redirect-https" + } + ], + "results": [ + { + "operation": "server_dry_run", + "exit_code": 0, + "known_failure_categories": [], + "whitelisted_actions": [ + { + "name": "reuse-surface-landing", + "action": "configured" + }, + { + "name": "reuse-surface-data", + "action": "configured" + }, + { + "name": "reuse-surface-landing", + "action": "configured" + }, + { + "name": "reuse-surface", + "action": "configured" + }, + { + "name": "reuse-surface", + "action": "configured" + }, + { + "name": "reuse-surface-landing", + "action": "configured" + }, + { + "name": "reuse-surface", + "action": "configured" + }, + { + "name": "reuse-surface-landing", + "action": "configured" + }, + { + "name": "reuse-surface-http-redirect", + "action": "configured" + }, + { + "name": "reuse-surface-redirect-https", + "action": "configured" + } + ], + "raw_stdout_stderr_discarded": true + }, + { + "operation": "client_diff", + "exit_code": 1, + "known_failure_categories": [], + "whitelisted_actions": [], + "raw_stdout_stderr_discarded": true + } + ], + "live_changes_performed": false, + "secrets_or_env_read": false, + "prior_target_check": "ExternalIP-only expectation failed though kubectl exit0; corrected to documented InternalIP/ExternalIP address matching without restarting any live process", + "status": "server_accepted_diff_review_pending" +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/source-publication-r3.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/source-publication-r3.json new file mode 100644 index 00000000..27d239ab --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-a-current/source-publication-r3.json @@ -0,0 +1,25 @@ +{ + "id": "CUST81-APPS-SOURCE-PUBLICATION-R3", + "status": "published_and_primary_reconciled", + "commit": "05f654e20f7ea68471e586d7892e25441c65875d", + "source_commit": "fb7d56d", + "uuid_commit": "05f654e", + "remote_main_verified": "05f654e20f7ea68471e586d7892e25441c65875d", + "primary_instance": "railiance01", + "primary_derived_commit": "05f654e20f7ea68471e586d7892e25441c65875d", + "normal_route": "uv run --project /home/worsch/repo-manager rmgr sync --path /home/worsch/railiance-apps --push --no-commit-identifiers", + "scanner_gate": "unchanged accepted normal push", + "original_backup_ref": "custody/cust81-apps-unpublished-r2", + "original_commits": [ + "4e8e0f5", + "6a8a54d" + ], + "unrelated_staged_preserved": [ + ".custodian-brief.md" + ], + "unrelated_dirty_preserved": [ + "WORK-RECORDS.md" + ], + "production_values_eso_unchanged": true, + "live_change": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/apps-owner-phase-b-review.md b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/apps-owner-phase-b-review.md new file mode 100644 index 00000000..bb0ae37b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/apps-owner-phase-b-review.md @@ -0,0 +1,53 @@ +# Apps phase B delivery preparation review + +Disposition: `approved` for exact bounded preparation only. No founder credential, +source-activation or production rollout authorization is inferred. Own workitem +RAPPS-WP-0017-T03; INTENT basis is release contracts, explicit S3 handoffs, +repeatable recovery and evidence before confidence. + +Full ExternalSecret server dry-run accepted and client diff verified only the +single new reader item plus native remoteRef defaults. Both old fields, existing +store, target and all other source spec/metadata are unchanged. The first strict +live equality check correctly refused on native ESO defaults, with no apply; +subsequent projection explicitly verified those defaults. The approved source +replacement is distinct from the current active file and must replace it only +after consent, then pass normal owner source publication before live apply. +Server acceptance does not prove the dedicated KV field or ESO read policy exists. + +Phase B must follow verified phase A *and* terminal verified platform provisioning +under the exact approved CCR. Verify current API pod ready, spec image index and +imageID against published OCI index or its linux/amd64 child (exclude attestation +manifest), source federation/private verification module hashes and exact14 URL +allowlist. Confirm ESO Ready and selected reader-key presence only, then controlled +restart with fresh headroom/PVC readiness and capture-only output. No token or env +value enters argv, source, receipts or logs. + +The native proof wrapper consumes only three exact-byte non-secret packets via +stdin, verifies their compiled hashes and module/source hashes, verifies the +complete14 URL allowlist, and invokes the application's native fetch path without +cache. Temporary packet files are0600 and removed. Four local refusal fixtures +passed; no real credentials or network requests were used. Its output must be +combined with separately verified API pod UID/readiness/image metadata; a +process receipt alone does not prove the target pod identity. Any missing, +mis-hashed, non-exact scope or native fetch outcome refuses success. Native +proof requires all7 sources and14 metadata fetches before registrations/final70. + +Rollback ordering is explicit: revoke dedicated Forgejo PAT and verify; restore +source-controlled two-field ESO mapping to stop rematerialization; remove only +the materialized reader key through a captured exact JSON patch; restart the +current hardened deployment and verify reader absence in new pod/materialized +Secret plus issuer revocation. Only then may an independently approved rollback +to vulnerable Helm revision10 occur. No old-token fallback, default DB restore, +credential re-mint or Secret/env dump is proposed. + +All exact predecessor/replacement digests, SSH delivery/restart/removal commands, +proof hashes/packet paths and gate schema are in phase-b-execution-proposal-r1.json. +No credential creation, ESO apply, Secret mutation, restart or deploy was executed. + +Revision2 of the same proposal corrects malformed shell quoting in the original +reader-removal command. Original proposal/review/manifest remain archived. +The replacement is structured SSH argv with `shlex.join` over exact remote +kubectl argv and compact JSON patch. Offline shell parsing roundtrips exactly +one removal operation at `/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN`; no +other key is touched. This refinement is not another successful trial. +Disposition remains approved preparation only, never founder live authority. diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/command-parser-check-r2.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/command-parser-check-r2.json new file mode 100644 index 00000000..54dfab45 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/command-parser-check-r2.json @@ -0,0 +1,13 @@ +{ + "id": "CUST81-PHASE-B-COMMAND-PARSER-CHECK-R2", + "status": "passed", + "proposal_revision": 2, + "original_proposal_sha256": "sha256:572af68fcf56072c1fd846101a76611885acd6efedfe5dba10d96d9f77f701e0", + "ssh_argv_count": 3, + "remote_argv_roundtrip": true, + "patch_operation_count": 1, + "patch_op": "remove", + "patch_path": "/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN", + "other_field_changes": false, + "live_command_executed": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/eso-preflight-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/eso-preflight-r1.json new file mode 100644 index 00000000..db58a9df --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/eso-preflight-r1.json @@ -0,0 +1,31 @@ +{ + "id": "CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1", + "checked_at": "2026-10-14T23:55:29.993576+00:00", + "target_node_ip": "92.205.62.239", + "status": "verified_preparation", + "active_predecessor_path": "/home/worsch/railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml", + "active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47", + "proposed_replacement_path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml", + "proposed_replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5", + "old_two_fields_retained": true, + "existing_store_unchanged": true, + "live_spec_projected_matches_predecessor": true, + "native_remoteRef_defaults_verified": true, + "previous_attempt": "full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained", + "results": [ + { + "operation": "server_dry_run", + "exit_code": 0, + "raw_stdout_stderr_discarded": true + }, + { + "operation": "client_diff", + "exit_code": 1, + "exact_new_reader_item_plus_native_defaults_only": true, + "raw_values_annotations_stderr_discarded": true + } + ], + "credentials_provisioned": false, + "live_apply_performed": false, + "limitation": "server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted" +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/manifest.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/manifest.json new file mode 100644 index 00000000..3cbd15d6 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/manifest.json @@ -0,0 +1,18 @@ +{ + "proposal_id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1", + "revision": 2, + "owner": "railiance-apps", + "disposition": "approved", + "approved_scope": "bounded source preparation only; no active ESO or live action", + "founder_live_approval": false, + "refinement_or_rescue": true, + "files": { + "apps-owner-phase-b-review.md": "sha256:496c842f4a284d6b2904c027dfd1e8aab85567f19fa74a228f27c4cc578ce026", + "command-parser-check-r2.json": "sha256:5080bdd2ece186200aec1a37b4450c99a50d435444f0f850277b82252516d6e1", + "eso-preflight-r1.json": "sha256:e39f07427af80fd036e6eec21202efe194fff2db67b8523bb07052e1388d8fab", + "native-proof-wrapper-local-checks-r1.json": "sha256:c5fcee128f7b4653ecfc0c455aab57a7efa8f6a9de382af69d447d8065091bab", + "native_runtime_proof_stdin.py": "sha256:1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933", + "phase-b-execution-proposal-r1.json": "sha256:13f19158e09b0693a64ff400ecbc3e5ec09d28673731e87733d1e2fad9bd3222", + "run_eso_preflight.py": "sha256:fd42789518e9a6c1305fc3828bf1afb8c9a4e8238b4eeed30f7e7ec05656f09b" + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native-proof-wrapper-local-checks-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native-proof-wrapper-local-checks-r1.json new file mode 100644 index 00000000..43cd703c --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native-proof-wrapper-local-checks-r1.json @@ -0,0 +1,15 @@ +{ + "id": "CUST81-NATIVE-RUNTIME-PROOF-PREPARATION-CHECKS-R1", + "status": "passed", + "wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933", + "fixture_cases": [ + "missing_reader", + "malformed_allowlist", + "tampered_packet", + "native_refusal" + ], + "native_network_requests": 0, + "real_credentials_used": false, + "failure_output_sentinel_excluded": true, + "scope_refusal_before_any_fetch": true +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native_runtime_proof_stdin.py b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native_runtime_proof_stdin.py new file mode 100644 index 00000000..8b76d09e --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/native_runtime_proof_stdin.py @@ -0,0 +1,38 @@ +"""Approved preparation only: execute in verified hardened API pod after phase B. +stdin envelope contains only three base64-encoded hash-bound non-secret packets. +No token accepted; native module consumes its reviewed runtime source credential. +""" +import base64,hashlib,json,os,tempfile +from pathlib import Path +import sys +from reuse_surface import federation, private_source_verify as native +EXPECTED={'proposal':'7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99','disclosure':'46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35','consent':'4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52'} +FEDI='dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd' +NATIVE='c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c' +receipt={'id':'CUST81-NATIVE-RUNTIME-PROOF-R1','status':'unverified','raw_errors_or_values_emitted':False} +try: + source_sha=hashlib.sha256(Path(federation.__file__).read_bytes()).hexdigest() + helper_sha=hashlib.sha256(Path(native.__file__).read_bytes()).hexdigest() + assert source_sha==FEDI and helper_sha==NATIVE + envelope=json.loads(sys.stdin.buffer.read(1048576)) + assert set(envelope)==set(EXPECTED) + with tempfile.TemporaryDirectory(prefix='cust81-native-packets-') as temporary: + paths={} + for name,digest in EXPECTED.items(): + content=base64.b64decode(envelope[name],validate=True) + assert hashlib.sha256(content).hexdigest()==digest + p=Path(temporary)/(name+'.json');p.write_bytes(content);p.chmod(0o600);paths[name]=p + sources=list(native._prepared_sources(paths['proposal'],paths['disclosure'],paths['consent'])) + expected_urls={native._raw_url(source['repo'],source['consented_commit'],path) for source,files in sources for path in files} + allow=json.loads(os.environ.get('REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST','{}')) + assert set(allow)=={native.AUTH_ENV} and len(allow[native.AUTH_ENV])==14 and set(allow[native.AUTH_ENV])==expected_urls + # Presence only: never print/read the secret value here. Native acquisition + # is subsequently performed only at its reviewed exact URL routing boundary. + key_present=native.AUTH_ENV in os.environ + assert key_present + result=native.verify(paths['proposal'],paths['disclosure'],paths['consent']) + receipt.update(source_sha256=source_sha,helper_sha256=helper_sha,packet_sha256=EXPECTED,runtime_allowlist_exact14=True,reader_key_present=True,native_fetch=result,status='verified' if result['all_verified'] else 'native_fetch_failed') +except Exception: + receipt.update(status='runtime_or_native_proof_refused',error='hash_scope_or_native_validation_failed') +print(json.dumps(receipt,sort_keys=True)) +raise SystemExit(0 if receipt['status']=='verified' else 1) diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-execution-proposal-r1.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-execution-proposal-r1.json new file mode 100644 index 00000000..34d390a4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-execution-proposal-r1.json @@ -0,0 +1,88 @@ +{ + "id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1", + "disposition": "approved", + "approved_scope": "bounded preparation only; founder live go still required", + "status": "prepared_not_executed", + "workitem": "RAPPS-WP-0017-T03", + "active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47", + "replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5", + "preconditions": [ + "verified phase A current API pod ready pinned hardened image/source hashes", + "platform provisioner terminal verified and approved CCR revision executed", + "Forgejo exact7 readonly grants and PAT receipt verified", + "native ESO path-read policy/store issuer receipt verified", + "founder consent to exact phase B source update and delivery" + ], + "source_update_after_consent": { + "command": "cp docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml manifests/reuse-surface-runtime-externalsecret.yaml", + "publication": "owner commits only exact replacement and normal rmgr sync --push; verify primary exact source commit before liveapply", + "not_executed": true + }, + "apply_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply -f /tmp/cust81-phase-b/reuse-surface-runtime-externalsecret.yaml'", + "sync_verify_before_restart": "wait for ESO Ready and selected reader-key-presence boolean via reviewed captured-output wrapper; never raw Secret/annotation/env output", + "restart_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout restart deployment/reuse-surface --namespace reuse'", + "restart_wait_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout status deployment/reuse-surface --namespace reuse --timeout=300s'", + "headroom_gate": "recheck100m/256Mi surge headroom/PVC and actual hardened deployment before restart", + "cleanup_order": [ + "credential owner revokes exact dedicated Forgejo PAT and verifies revocation; no oldtoken fallback", + "restore reviewed two-field ESO manifest through source-controlled owner lane and apply, stops rematerialization", + "remove only REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN from reuse/reuse-surface-env with captured-output exact JSON patch", + "restart/wait current hardened deployment, verify reader-key absence boolean in new pod and materialized Secret plus exact token revocation", + "only then may separately approved Helm rollback reuse10 restore vulnerable priorimage; do not restore DB by default" + ], + "raw_output_contract": "all mutating/proof child stdout/stderr captured/discarded; only whitelisted outcome/proof JSON may reach receipts", + "runtime_proof": { + "pod_metadata_schema": [ + "verified API pod name and UID", + "Ready true", + "expected spec image OCI indexsha2364b7e...", + "actual imageID equals index or linux/amd64childsha1a69354af2bc87d4baaecc4b02e13fda468efd3746024f440cc6d138beeee2ab", + "node92.205.62.239", + "source/header-routing/native helper hashes verified", + "exact14 allowlist boolean", + "reader-key presence boolean", + "native14fetch/7consentedhashall_verified" + ], + "wrapper_path": "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py", + "wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933", + "packets": { + "proposal": { + "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-reader-provisioning-preparation-r1.json", + "sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99" + }, + "disclosure": { + "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-disclosure-proposal-r1.json", + "sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35" + }, + "consent": { + "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json", + "sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52" + } + }, + "invocation": "capture kubectl --kubeconfig -n reuse exec -i -c reuse-surface -- python3 -c ; stdin JSON envelope {proposal:base64(exactbytes),disclosure:base64(exactbytes),consent:base64(exactbytes)}; no token/credential in argv or stdin; wrapper writes/removes only temporary nonsecret packet files", + "exit_success_required": true + }, + "no_live_credential_or_apply_action": true, + "revision": 2, + "refinement_or_rescue": true, + "original_revision_sha256": "sha256:572af68fcf56072c1fd846101a76611885acd6efedfe5dba10d96d9f77f701e0", + "reader_key_removal_ssh_argv": [ + "ssh", + "railiance01", + "env KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl patch secret reuse-surface-env --namespace reuse --type=json -p '[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]'" + ], + "reader_key_removal_remote_argv": [ + "env", + "KUBECONFIG=/etc/rancher/k3s/k3s.yaml", + "kubectl", + "patch", + "secret", + "reuse-surface-env", + "--namespace", + "reuse", + "--type=json", + "-p", + "[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]" + ], + "reader_key_removal_offline_check": "passed shell roundtrip exact single remove op on only selected reader key; no other data field/annotation/spec touched" +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-preparation.patch b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-preparation.patch new file mode 100644 index 00000000..a9bc0867 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/phase-b-preparation.patch @@ -0,0 +1,283 @@ +diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md +new file mode 100644 +index 0000000..57e022a +--- /dev/null ++++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md +@@ -0,0 +1,45 @@ ++# Apps phase B delivery preparation review ++ ++Disposition: `approved` for exact bounded preparation only. No founder credential, ++source-activation or production rollout authorization is inferred. Own workitem ++RAPPS-WP-0017-T03; INTENT basis is release contracts, explicit S3 handoffs, ++repeatable recovery and evidence before confidence. ++ ++Full ExternalSecret server dry-run accepted and client diff verified only the ++single new reader item plus native remoteRef defaults. Both old fields, existing ++store, target and all other source spec/metadata are unchanged. The first strict ++live equality check correctly refused on native ESO defaults, with no apply; ++subsequent projection explicitly verified those defaults. The approved source ++replacement is distinct from the current active file and must replace it only ++after consent, then pass normal owner source publication before live apply. ++Server acceptance does not prove the dedicated KV field or ESO read policy exists. ++ ++Phase B must follow verified phase A *and* terminal verified platform provisioning ++under the exact approved CCR. Verify current API pod ready, spec image index and ++imageID against published OCI index or its linux/amd64 child (exclude attestation ++manifest), source federation/private verification module hashes and exact14 URL ++allowlist. Confirm ESO Ready and selected reader-key presence only, then controlled ++restart with fresh headroom/PVC readiness and capture-only output. No token or env ++value enters argv, source, receipts or logs. ++ ++The native proof wrapper consumes only three exact-byte non-secret packets via ++stdin, verifies their compiled hashes and module/source hashes, verifies the ++complete14 URL allowlist, and invokes the application's native fetch path without ++cache. Temporary packet files are0600 and removed. Four local refusal fixtures ++passed; no real credentials or network requests were used. Its output must be ++combined with separately verified API pod UID/readiness/image metadata; a ++process receipt alone does not prove the target pod identity. Any missing, ++mis-hashed, non-exact scope or native fetch outcome refuses success. Native ++proof requires all7 sources and14 metadata fetches before registrations/final70. ++ ++Rollback ordering is explicit: revoke dedicated Forgejo PAT and verify; restore ++source-controlled two-field ESO mapping to stop rematerialization; remove only ++the materialized reader key through a captured exact JSON patch; restart the ++current hardened deployment and verify reader absence in new pod/materialized ++Secret plus issuer revocation. Only then may an independently approved rollback ++to vulnerable Helm revision10 occur. No old-token fallback, default DB restore, ++credential re-mint or Secret/env dump is proposed. ++ ++All exact predecessor/replacement digests, SSH delivery/restart/removal commands, ++proof hashes/packet paths and gate schema are in phase-b-execution-proposal-r1.json. ++No credential creation, ESO apply, Secret mutation, restart or deploy was executed. +diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/eso-preflight-r1.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/eso-preflight-r1.json +new file mode 100644 +index 0000000..db58a9d +--- /dev/null ++++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/eso-preflight-r1.json +@@ -0,0 +1,31 @@ ++{ ++ "id": "CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1", ++ "checked_at": "2026-10-14T23:55:29.993576+00:00", ++ "target_node_ip": "92.205.62.239", ++ "status": "verified_preparation", ++ "active_predecessor_path": "/home/worsch/railiance-apps/manifests/reuse-surface-runtime-externalsecret.yaml", ++ "active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47", ++ "proposed_replacement_path": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml", ++ "proposed_replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5", ++ "old_two_fields_retained": true, ++ "existing_store_unchanged": true, ++ "live_spec_projected_matches_predecessor": true, ++ "native_remoteRef_defaults_verified": true, ++ "previous_attempt": "full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained", ++ "results": [ ++ { ++ "operation": "server_dry_run", ++ "exit_code": 0, ++ "raw_stdout_stderr_discarded": true ++ }, ++ { ++ "operation": "client_diff", ++ "exit_code": 1, ++ "exact_new_reader_item_plus_native_defaults_only": true, ++ "raw_values_annotations_stderr_discarded": true ++ } ++ ], ++ "credentials_provisioned": false, ++ "live_apply_performed": false, ++ "limitation": "server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted" ++} +diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native-proof-wrapper-local-checks-r1.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native-proof-wrapper-local-checks-r1.json +new file mode 100644 +index 0000000..43cd703 +--- /dev/null ++++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native-proof-wrapper-local-checks-r1.json +@@ -0,0 +1,15 @@ ++{ ++ "id": "CUST81-NATIVE-RUNTIME-PROOF-PREPARATION-CHECKS-R1", ++ "status": "passed", ++ "wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933", ++ "fixture_cases": [ ++ "missing_reader", ++ "malformed_allowlist", ++ "tampered_packet", ++ "native_refusal" ++ ], ++ "native_network_requests": 0, ++ "real_credentials_used": false, ++ "failure_output_sentinel_excluded": true, ++ "scope_refusal_before_any_fetch": true ++} +diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py +new file mode 100644 +index 0000000..8b76d09 +--- /dev/null ++++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py +@@ -0,0 +1,38 @@ ++"""Approved preparation only: execute in verified hardened API pod after phase B. ++stdin envelope contains only three base64-encoded hash-bound non-secret packets. ++No token accepted; native module consumes its reviewed runtime source credential. ++""" ++import base64,hashlib,json,os,tempfile ++from pathlib import Path ++import sys ++from reuse_surface import federation, private_source_verify as native ++EXPECTED={'proposal':'7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99','disclosure':'46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35','consent':'4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52'} ++FEDI='dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd' ++NATIVE='c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c' ++receipt={'id':'CUST81-NATIVE-RUNTIME-PROOF-R1','status':'unverified','raw_errors_or_values_emitted':False} ++try: ++ source_sha=hashlib.sha256(Path(federation.__file__).read_bytes()).hexdigest() ++ helper_sha=hashlib.sha256(Path(native.__file__).read_bytes()).hexdigest() ++ assert source_sha==FEDI and helper_sha==NATIVE ++ envelope=json.loads(sys.stdin.buffer.read(1048576)) ++ assert set(envelope)==set(EXPECTED) ++ with tempfile.TemporaryDirectory(prefix='cust81-native-packets-') as temporary: ++ paths={} ++ for name,digest in EXPECTED.items(): ++ content=base64.b64decode(envelope[name],validate=True) ++ assert hashlib.sha256(content).hexdigest()==digest ++ p=Path(temporary)/(name+'.json');p.write_bytes(content);p.chmod(0o600);paths[name]=p ++ sources=list(native._prepared_sources(paths['proposal'],paths['disclosure'],paths['consent'])) ++ expected_urls={native._raw_url(source['repo'],source['consented_commit'],path) for source,files in sources for path in files} ++ allow=json.loads(os.environ.get('REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST','{}')) ++ assert set(allow)=={native.AUTH_ENV} and len(allow[native.AUTH_ENV])==14 and set(allow[native.AUTH_ENV])==expected_urls ++ # Presence only: never print/read the secret value here. Native acquisition ++ # is subsequently performed only at its reviewed exact URL routing boundary. ++ key_present=native.AUTH_ENV in os.environ ++ assert key_present ++ result=native.verify(paths['proposal'],paths['disclosure'],paths['consent']) ++ receipt.update(source_sha256=source_sha,helper_sha256=helper_sha,packet_sha256=EXPECTED,runtime_allowlist_exact14=True,reader_key_present=True,native_fetch=result,status='verified' if result['all_verified'] else 'native_fetch_failed') ++except Exception: ++ receipt.update(status='runtime_or_native_proof_refused',error='hash_scope_or_native_validation_failed') ++print(json.dumps(receipt,sort_keys=True)) ++raise SystemExit(0 if receipt['status']=='verified' else 1) +diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json +new file mode 100644 +index 0000000..980719d +--- /dev/null ++++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json +@@ -0,0 +1,67 @@ ++{ ++ "id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1", ++ "disposition": "approved", ++ "approved_scope": "bounded preparation only; founder live go still required", ++ "status": "prepared_not_executed", ++ "workitem": "RAPPS-WP-0017-T03", ++ "active_predecessor_sha256": "e036084aec9fad3bea63cc0d591c3b40a392ab9f54d9226a2d2b3fd7194d8a47", ++ "replacement_sha256": "adfb34c0ee4d01bc602f57cd2320f1658465fb8f8660978828fffa05a5b604b5", ++ "preconditions": [ ++ "verified phase A current API pod ready pinned hardened image/source hashes", ++ "platform provisioner terminal verified and approved CCR revision executed", ++ "Forgejo exact7 readonly grants and PAT receipt verified", ++ "native ESO path-read policy/store issuer receipt verified", ++ "founder consent to exact phase B source update and delivery" ++ ], ++ "source_update_after_consent": { ++ "command": "cp docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml manifests/reuse-surface-runtime-externalsecret.yaml", ++ "publication": "owner commits only exact replacement and normal rmgr sync --push; verify primary exact source commit before liveapply", ++ "not_executed": true ++ }, ++ "apply_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply -f /tmp/cust81-phase-b/reuse-surface-runtime-externalsecret.yaml'", ++ "sync_verify_before_restart": "wait for ESO Ready and selected reader-key-presence boolean via reviewed captured-output wrapper; never raw Secret/annotation/env output", ++ "restart_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout restart deployment/reuse-surface --namespace reuse'", ++ "restart_wait_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl rollout status deployment/reuse-surface --namespace reuse --timeout=300s'", ++ "headroom_gate": "recheck100m/256Mi surge headroom/PVC and actual hardened deployment before restart", ++ "cleanup_order": [ ++ "credential owner revokes exact dedicated Forgejo PAT and verifies revocation; no oldtoken fallback", ++ "restore reviewed two-field ESO manifest through source-controlled owner lane and apply, stops rematerialization", ++ "remove only REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN from reuse/reuse-surface-env with captured-output exact JSON patch", ++ "restart/wait current hardened deployment, verify reader-key absence boolean in new pod and materialized Secret plus exact token revocation", ++ "only then may separately approved Helm rollback reuse10 restore vulnerable priorimage; do not restore DB by default" ++ ], ++ "exact_reader_key_removal_command": "ssh railiance01 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl patch secret reuse-surface-env --namespace reuse --type=json -p '''[{\"op\":\"remove\",\"path\":\"/data/REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN\"}]''''", ++ "raw_output_contract": "all mutating/proof child stdout/stderr captured/discarded; only whitelisted outcome/proof JSON may reach receipts", ++ "runtime_proof": { ++ "pod_metadata_schema": [ ++ "verified API pod name and UID", ++ "Ready true", ++ "expected spec image OCI indexsha2364b7e...", ++ "actual imageID equals index or linux/amd64childsha1a69354af2bc87d4baaecc4b02e13fda468efd3746024f440cc6d138beeee2ab", ++ "node92.205.62.239", ++ "source/header-routing/native helper hashes verified", ++ "exact14 allowlist boolean", ++ "reader-key presence boolean", ++ "native14fetch/7consentedhashall_verified" ++ ], ++ "wrapper_path": "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/native_runtime_proof_stdin.py", ++ "wrapper_sha256": "1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933", ++ "packets": { ++ "proposal": { ++ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-reader-provisioning-preparation-r1.json", ++ "sha256": "7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99" ++ }, ++ "disclosure": { ++ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-disclosure-proposal-r1.json", ++ "sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35" ++ }, ++ "consent": { ++ "path": "/home/worsch/the-custodian/docs/assessments/netkingdom-2026-10-14/private-source-owner-consent-r1.json", ++ "sha256": "4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52" ++ } ++ }, ++ "invocation": "capture kubectl --kubeconfig -n reuse exec -i -c reuse-surface -- python3 -c ; stdin JSON envelope {proposal:base64(exactbytes),disclosure:base64(exactbytes),consent:base64(exactbytes)}; no token/credential in argv or stdin; wrapper writes/removes only temporary nonsecret packet files", ++ "exit_success_required": true ++ }, ++ "no_live_credential_or_apply_action": true ++} +diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/run_eso_preflight.py b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/run_eso_preflight.py +new file mode 100644 +index 0000000..a1640b6 +--- /dev/null ++++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/run_eso_preflight.py +@@ -0,0 +1,30 @@ ++from pathlib import Path ++import subprocess,json,yaml,hashlib,datetime ++art=Path(__file__).resolve().parent ++canonical=Path('/home/worsch/railiance-apps') ++old=canonical/'manifests/reuse-surface-runtime-externalsecret.yaml';new=canonical/'docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml' ++base=yaml.safe_load(old.read_text());proposal=yaml.safe_load(new.read_text()) ++assert proposal['spec']['data'][:-1]==base['spec']['data'] ++item=proposal['spec']['data'][-1] ++assert item=={'secretKey':'REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','remoteRef':{'key':'workloads/reuse/reuse-surface/forgejo-source-read','property':'FORGEJO_SOURCE_TOKEN'}} ++assert {k:v for k,v in proposal.items() if k!='spec'}=={k:v for k,v in base.items() if k!='spec'} ++assert {k:v for k,v in proposal['spec'].items() if k!='data'}=={k:v for k,v in base['spec'].items() if k!='data'} ++kube=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01'] ++p=subprocess.run(kube+['get','nodes','-o','json'],capture_output=True,timeout=20);nodes=json.loads(p.stdout);assert p.returncode==0 and len(nodes['items'])==1 and any(a['address']=='92.205.62.239' for a in nodes['items'][0]['status']['addresses']) ++p=subprocess.run(kube+['-n','reuse','get','externalsecret','reuse-surface-runtime','-o','json'],capture_output=True,timeout=20);assert p.returncode==0;live=json.loads(p.stdout) ++rows=[{'secretKey':r['secretKey'],'remoteRef':{k:r['remoteRef'][k] for k in ('key','property')}} for r in live['spec']['data']] ++assert rows==base['spec']['data'] and live['spec']['secretStoreRef']==base['spec']['secretStoreRef'] ++assert all({k:v for k,v in r['remoteRef'].items() if k not in ('key','property')}=={'conversionStrategy':'Default','decodingStrategy':'None','metadataPolicy':'None'} for r in live['spec']['data']) ++results=[] ++for args in [['apply','--dry-run=server','-f',str(new)],['diff','-f',str(new)]]: ++ p=subprocess.run(kube+['-n','reuse']+args,capture_output=True,timeout=60) ++ if args[0]=='diff': ++ changed=[line[1:].strip() for line in p.stdout.decode(errors='replace').splitlines() if line.startswith(('+','-')) and not line.startswith(('+++','---'))] ++ intended={'- remoteRef:', 'key: workloads/reuse/reuse-surface/forgejo-source-read','property: FORGEJO_SOURCE_TOKEN','secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','conversionStrategy: Default','decodingStrategy: None','metadataPolicy: None'} ++ other=[line for line in changed if line not in intended and not line.startswith('generation:')] ++ assert not other ++ results.append({'operation':'client_diff','exit_code':p.returncode,'exact_new_reader_item_plus_native_defaults_only':True,'raw_values_annotations_stderr_discarded':True}) ++ else:results.append({'operation':'server_dry_run','exit_code':p.returncode,'raw_stdout_stderr_discarded':True}) ++assert results[0]['exit_code']==0 and results[1]['exit_code'] in (0,1) ++r={'id':'CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1','checked_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'target_node_ip':'92.205.62.239','status':'verified_preparation','active_predecessor_path':str(old),'active_predecessor_sha256':hashlib.sha256(old.read_bytes()).hexdigest(),'proposed_replacement_path':str(new),'proposed_replacement_sha256':hashlib.sha256(new.read_bytes()).hexdigest(),'old_two_fields_retained':True,'existing_store_unchanged':True,'live_spec_projected_matches_predecessor':True,'native_remoteRef_defaults_verified':True,'previous_attempt':'full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained','results':results,'credentials_provisioned':False,'live_apply_performed':False,'limitation':'server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted'} ++(art/'eso-preflight-r1.json').write_text(json.dumps(r,indent=2)+'\n');print(json.dumps(r,indent=2)) +diff --git a/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/manifest.json b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/manifest.json +new file mode 100644 +index 0000000..c96bfbc +--- /dev/null ++++ b/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/phase-b-r1/manifest.json +@@ -0,0 +1,15 @@ ++{ ++ "proposal_id": "CUST81-APPS-PHASE-B-EXECUTION-PROPOSAL-R1", ++ "owner": "railiance-apps", ++ "disposition": "approved", ++ "approved_scope": "bounded preparation only", ++ "founder_live_approval": false, ++ "files": { ++ "apps-owner-phase-b-review.md": "sha256:2ed614f22f64abbba497ca116220bd33a9985b7aa2a5608bf01cbdd18c30f863", ++ "eso-preflight-r1.json": "sha256:e39f07427af80fd036e6eec21202efe194fff2db67b8523bb07052e1388d8fab", ++ "native-proof-wrapper-local-checks-r1.json": "sha256:c5fcee128f7b4653ecfc0c455aab57a7efa8f6a9de382af69d447d8065091bab", ++ "native_runtime_proof_stdin.py": "sha256:1edc317e8563a120b62a6830eebb2875c144b45c57a491eb7da849095c5d1933", ++ "phase-b-execution-proposal-r1.json": "sha256:572af68fcf56072c1fd846101a76611885acd6efedfe5dba10d96d9f77f701e0", ++ "run_eso_preflight.py": "sha256:fd42789518e9a6c1305fc3828bf1afb8c9a4e8238b4eeed30f7e7ec05656f09b" ++ } ++} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/run_eso_preflight.py b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/run_eso_preflight.py new file mode 100644 index 00000000..a1640b63 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-current/run_eso_preflight.py @@ -0,0 +1,30 @@ +from pathlib import Path +import subprocess,json,yaml,hashlib,datetime +art=Path(__file__).resolve().parent +canonical=Path('/home/worsch/railiance-apps') +old=canonical/'manifests/reuse-surface-runtime-externalsecret.yaml';new=canonical/'docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml' +base=yaml.safe_load(old.read_text());proposal=yaml.safe_load(new.read_text()) +assert proposal['spec']['data'][:-1]==base['spec']['data'] +item=proposal['spec']['data'][-1] +assert item=={'secretKey':'REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','remoteRef':{'key':'workloads/reuse/reuse-surface/forgejo-source-read','property':'FORGEJO_SOURCE_TOKEN'}} +assert {k:v for k,v in proposal.items() if k!='spec'}=={k:v for k,v in base.items() if k!='spec'} +assert {k:v for k,v in proposal['spec'].items() if k!='data'}=={k:v for k,v in base['spec'].items() if k!='data'} +kube=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01'] +p=subprocess.run(kube+['get','nodes','-o','json'],capture_output=True,timeout=20);nodes=json.loads(p.stdout);assert p.returncode==0 and len(nodes['items'])==1 and any(a['address']=='92.205.62.239' for a in nodes['items'][0]['status']['addresses']) +p=subprocess.run(kube+['-n','reuse','get','externalsecret','reuse-surface-runtime','-o','json'],capture_output=True,timeout=20);assert p.returncode==0;live=json.loads(p.stdout) +rows=[{'secretKey':r['secretKey'],'remoteRef':{k:r['remoteRef'][k] for k in ('key','property')}} for r in live['spec']['data']] +assert rows==base['spec']['data'] and live['spec']['secretStoreRef']==base['spec']['secretStoreRef'] +assert all({k:v for k,v in r['remoteRef'].items() if k not in ('key','property')}=={'conversionStrategy':'Default','decodingStrategy':'None','metadataPolicy':'None'} for r in live['spec']['data']) +results=[] +for args in [['apply','--dry-run=server','-f',str(new)],['diff','-f',str(new)]]: + p=subprocess.run(kube+['-n','reuse']+args,capture_output=True,timeout=60) + if args[0]=='diff': + changed=[line[1:].strip() for line in p.stdout.decode(errors='replace').splitlines() if line.startswith(('+','-')) and not line.startswith(('+++','---'))] + intended={'- remoteRef:', 'key: workloads/reuse/reuse-surface/forgejo-source-read','property: FORGEJO_SOURCE_TOKEN','secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','conversionStrategy: Default','decodingStrategy: None','metadataPolicy: None'} + other=[line for line in changed if line not in intended and not line.startswith('generation:')] + assert not other + results.append({'operation':'client_diff','exit_code':p.returncode,'exact_new_reader_item_plus_native_defaults_only':True,'raw_values_annotations_stderr_discarded':True}) + else:results.append({'operation':'server_dry_run','exit_code':p.returncode,'raw_stdout_stderr_discarded':True}) +assert results[0]['exit_code']==0 and results[1]['exit_code'] in (0,1) +r={'id':'CUST81-APPS-PHASE-B-ESO-PREFLIGHT-R1','checked_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),'target_node_ip':'92.205.62.239','status':'verified_preparation','active_predecessor_path':str(old),'active_predecessor_sha256':hashlib.sha256(old.read_bytes()).hexdigest(),'proposed_replacement_path':str(new),'proposed_replacement_sha256':hashlib.sha256(new.read_bytes()).hexdigest(),'old_two_fields_retained':True,'existing_store_unchanged':True,'live_spec_projected_matches_predecessor':True,'native_remoteRef_defaults_verified':True,'previous_attempt':'full live data equality assertion refused on native ESO defaults; no command apply executed, original refusal retained','results':results,'credentials_provisioned':False,'live_apply_performed':False,'limitation':'server acceptance does not prove dedicated KV field exists or ESO consumer policy reader path granted'} +(art/'eso-preflight-r1.json').write_text(json.dumps(r,indent=2)+'\n');print(json.dumps(r,indent=2)) diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-publication-r2.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-publication-r2.json new file mode 100644 index 00000000..4a76e479 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-phase-b-publication-r2.json @@ -0,0 +1,18 @@ +{ + "id": "CUST81-APPS-PHASE-B-SOURCE-PUBLICATION-R2", + "status": "published_primary_reconciled", + "commit": "ea2d4632a114c348c70b01d684cc5a2d4f413b91", + "remote_main": "ea2d4632a114c348c70b01d684cc5a2d4f413b91", + "primary_derived_commit": "ea2d4632a114c348c70b01d684cc5a2d4f413b91", + "normal_rmgr_status": "applied", + "primary_instance": "railiance01", + "canonical_folder": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1", + "canonical_proposal": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/phase-b-execution-proposal-r1.json", + "canonical_review": "/home/worsch/railiance-apps/docs/assessments/cust81-private-reader/phase-b-r1/apps-owner-phase-b-review.md", + "manifest_sha256": "sha256:52ec35f1e150c1e2aca21bc138b523bf74423dd391e62daca8182d1b8924ed34", + "proposal_sha256": "sha256:13f19158e09b0693a64ff400ecbc3e5ec09d28673731e87733d1e2fad9bd3222", + "active_eso_unchanged": true, + "all_bound_file_digests_verified": true, + "unrelated_staged_brief_preserved": true, + "live_actions_executed": false +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/_helpers.tpl b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/_helpers.tpl new file mode 100644 index 00000000..cdcae935 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/_helpers.tpl @@ -0,0 +1,56 @@ +{{- define "reuse.fullname" -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- printf "%s" $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "reuse.labels" -}} +app.kubernetes.io/name: {{ include "reuse.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +app.kubernetes.io/part-of: railiance-apps +helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" }} +{{- end -}} + +{{- define "reuse.selectorLabels" -}} +app.kubernetes.io/name: {{ include "reuse.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{- define "reuse.landingFullname" -}} +{{- printf "%s-landing" (include "reuse.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "reuse.redirectMiddlewareName" -}} +{{- printf "%s-redirect-https" (include "reuse.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- define "reuse.landingSelectorLabels" -}} +app.kubernetes.io/name: {{ include "reuse.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/component: landing +{{- end -}} + +{{- define "reuse.image" -}} +{{- if and .Values.authSourceAllowlist (not .Values.image.digest) -}} +{{- fail "authenticated source allowlist requires reviewed hardened image.digest" -}} +{{- end -}} +{{- if .Values.image.digest -}} +{{- if not (regexMatch "^sha256:[a-f0-9]{64}$" .Values.image.digest) -}} +{{- fail "image.digest must be sha256 plus 64 lowercase hex characters" -}} +{{- end -}} +{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}} +{{- else -}} +{{- if not .Values.image.tag -}} +{{- fail "image.tag is required - pin it in helm/reuse-surface-values.yaml" -}} +{{- end -}} +{{- printf "%s:%s" .Values.image.repository .Values.image.tag -}} +{{- end -}} +{{- end -}} + +{{- define "reuse.landingImage" -}} +{{- if not .Values.landing.image.tag -}} +{{- fail "landing.image.tag is required when landing.enabled=true" -}} +{{- end -}} +{{- printf "%s:%s" .Values.landing.image.repository .Values.landing.image.tag -}} +{{- end -}} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/deployment.yaml b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/deployment.yaml new file mode 100644 index 00000000..06b815d6 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/templates/deployment.yaml @@ -0,0 +1,87 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "reuse.fullname" . }} + labels: + {{- include "reuse.labels" . | nindent 4 }} + app.kubernetes.io/component: api +spec: + replicas: {{ .Values.replicaCount }} + selector: + matchLabels: {{- include "reuse.selectorLabels" . | nindent 6 }} + strategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + template: + metadata: + labels: + {{- include "reuse.selectorLabels" . | nindent 8 }} + app.kubernetes.io/component: api + spec: + enableServiceLinks: false + securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: reuse-surface + image: {{ include "reuse.image" . | quote }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + command: ["reuse-surface", "serve"] + securityContext: {{- toYaml .Values.securityContext | nindent 12 }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + protocol: TCP + envFrom: + - secretRef: + name: {{ .Values.envSecretName | quote }} + env: + - name: REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST + value: {{ .Values.authSourceAllowlist | toJson | quote }} + - name: REUSE_SURFACE_LISTEN_HOST + value: "0.0.0.0" + - name: REUSE_SURFACE_LISTEN_PORT + value: {{ .Values.service.targetPort | quote }} + - name: REUSE_SURFACE_DB + value: {{ printf "%s/reuse.db" .Values.persistence.mountPath | quote }} + - name: REUSE_SURFACE_CACHE_DIR + value: {{ printf "%s/cache" .Values.persistence.mountPath | quote }} + {{- if .Values.persistence.enabled }} + volumeMounts: + - name: data + mountPath: {{ .Values.persistence.mountPath }} + {{- end }} + {{- if .Values.probes.enabled }} + readinessProbe: + httpGet: + path: {{ .Values.probes.path }} + port: {{ .Values.probes.port }} + initialDelaySeconds: {{ .Values.probes.readiness.initialDelaySeconds }} + periodSeconds: {{ .Values.probes.readiness.periodSeconds }} + timeoutSeconds: {{ .Values.probes.readiness.timeoutSeconds }} + failureThreshold: {{ .Values.probes.readiness.failureThreshold }} + livenessProbe: + httpGet: + path: {{ .Values.probes.path }} + port: {{ .Values.probes.port }} + initialDelaySeconds: {{ .Values.probes.liveness.initialDelaySeconds }} + periodSeconds: {{ .Values.probes.liveness.periodSeconds }} + timeoutSeconds: {{ .Values.probes.liveness.timeoutSeconds }} + failureThreshold: {{ .Values.probes.liveness.failureThreshold }} + {{- end }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- if .Values.persistence.enabled }} + volumes: + - name: data + persistentVolumeClaim: + claimName: {{ include "reuse.fullname" . }}-data + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.schema.json b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.schema.json new file mode 100644 index 00000000..7367c10a --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.schema.json @@ -0,0 +1,30 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "type": "object", + "properties": { + "image": { + "type": "object", + "properties": { + "digest": { + "type": "string", + "pattern": "^(|sha256:[a-f0-9]{64})$" + } + } + }, + "authSourceAllowlist": { + "type": "object", + "propertyNames": { + "pattern": "^[A-Z][A-Z0-9_]*$" + }, + "additionalProperties": { + "type": "array", + "uniqueItems": true, + "items": { + "type": "string", + "pattern": "^https://[^\\s]+$" + }, + "minItems": 1 + } + } + } +} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.yaml b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.yaml new file mode 100644 index 00000000..0e520d26 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/charts/reuse-surface/values.yaml @@ -0,0 +1,106 @@ +image: + repository: forgejo.coulomb.social/coulomb/reuse-surface + tag: "" + digest: "" + pullPolicy: IfNotPresent + +replicaCount: 1 + +service: + type: ClusterIP + port: 8000 + targetPort: 8000 + +persistence: + enabled: true + size: 1Gi + mountPath: /data + storageClassName: "" + +resources: + requests: + cpu: 100m + memory: 256Mi + limits: + cpu: 500m + memory: 512Mi + +envSecretName: reuse-surface-env + +# Non-secret exact URL bindings for authenticated remote metadata fetches. +# Nonempty bindings require an immutable digest; use only a reviewed hardened image. +authSourceAllowlist: {} + +landing: + enabled: false + image: + repository: nginxinc/nginx-unprivileged + tag: "1.27-alpine" + pullPolicy: IfNotPresent + service: + port: 8080 + targetPort: 8080 + ingress: + # Explicit Traefik router priority for the landing catch-all. Traefik + # otherwise derives priority from rule-string length, where PathPrefix(`/`) + # ties with Path(`/health`) and can win. Keep this below every API route. + priority: 1 + noindex: true + title: "Railiance service endpoint" + eyebrow: "Railiance S5" + body: "This endpoint is available for automated clients and operators." + buttonLabel: "Continue" + primaryUrl: "" + redirect: + enabled: false + target: "" + delaySeconds: 5 + links: [] + html: "" + resources: + requests: + cpu: 10m + memory: 32Mi + limits: + cpu: 50m + memory: 64Mi + +ingress: + enabled: true + className: traefik + host: reuse.coulomb.social + tls: true + redirectHttp: + enabled: false + permanent: true + apiPaths: + - path: /health + pathType: Exact + - path: /v1 + pathType: Prefix + annotations: + traefik.ingress.kubernetes.io/router.entrypoints: websecure + traefik.ingress.kubernetes.io/router.tls: "true" + cert-manager.io/cluster-issuer: letsencrypt-prod + +probes: + enabled: true + path: /health + port: 8000 + liveness: + initialDelaySeconds: 15 + periodSeconds: 30 + timeoutSeconds: 5 + failureThreshold: 3 + readiness: + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + +podSecurityContext: {} +securityContext: {} + +nodeSelector: {} +tolerations: [] +affinity: {} diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/scripts/reuse_authenticated_source_inventory.py b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/scripts/reuse_authenticated_source_inventory.py new file mode 100644 index 00000000..1072c976 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/scripts/reuse_authenticated_source_inventory.py @@ -0,0 +1,61 @@ +#!/usr/bin/env python3 +"""Read-only authenticated source metadata; never read env or Kubernetes Secrets. + +Caller must first confirm the kubeconfig targets railiance01. Raw command +stdout/stderr and exception text are never emitted. No credentials are needed +beyond the caller's separately approved Kubernetes observation/exec lane. +""" +import argparse +import json +import re +import subprocess +from urllib.parse import urlsplit, parse_qs + +# SQL projects metadata only; the registration payload itself is never printed. +POD_CODE = '''import json, sqlite3 +with sqlite3.connect("file:/data/reuse.db?mode=ro", uri=True) as db: + rows=db.execute("SELECT repo, json_extract(payload, '$.auth_env'), json_extract(payload, '$.index_url') FROM registrations WHERE json_extract(payload, '$.auth_env') IS NOT NULL AND json_extract(payload, '$.auth_env') != ''").fetchall() + print(json.dumps(rows)) +''' + + +def sanitize(rows): + result = [] + for repo, name, url in rows: + if not isinstance(repo, str) or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', repo): + raise ValueError('invalid metadata') + if not isinstance(name, str) or not re.fullmatch(r'[A-Z][A-Z0-9_]{0,127}', name): + raise ValueError('invalid metadata') + parts = urlsplit(url) + # URLs are untrusted stored data; refuse userinfo/fragments and arbitrary + # query fields (which could contain credentials). Never echo invalid rows. + query = parse_qs(parts.query, keep_blank_values=True) + if (parts.scheme != 'https' or parts.username or parts.password or parts.fragment + or parts.hostname != 'forgejo.coulomb.social' or parts.port not in (None, 443) + or not re.fullmatch(r'/api/v1/repos/coulomb/[a-zA-Z0-9_.-]+/raw/registry/indexes/[a-zA-Z0-9_.-]+', parts.path) + or any(k != 'ref' for k in query) + or ('ref' in query and (len(query['ref']) != 1 or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', query['ref'][0])))): + raise ValueError('unsafe metadata') + result.append({'repo': repo, 'auth_env': name, 'index_url': url}) + return sorted(result, key=lambda row: row['repo']) + + +def main(): + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument('--kubeconfig', required=True) + args = parser.parse_args() + try: + proc = subprocess.run(['kubectl', '--kubeconfig', args.kubeconfig, '-n', 'reuse', + 'exec', 'deployment/reuse-surface', '-c', 'reuse-surface', '--', 'python3', '-c', POD_CODE], + capture_output=True, timeout=30) + if proc.returncode: + raise RuntimeError('inventory unavailable') + rows = sanitize(json.loads(proc.stdout)) + except Exception: + print(json.dumps({'status': 'refused_or_unavailable', 'raw_output_discarded': True})) + return 1 + print(json.dumps({'status': 'verified', 'authenticated_source_count': len(rows), 'sources': rows}, indent=2)) + return 0 + +if __name__ == '__main__': + raise SystemExit(main()) diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/workplans/RAPPS-WP-0017-reuse-private-reader-release.md b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/workplans/RAPPS-WP-0017-reuse-private-reader-release.md new file mode 100644 index 00000000..0363d08b --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/files/workplans/RAPPS-WP-0017-reuse-private-reader-release.md @@ -0,0 +1,57 @@ +--- +id: RAPPS-WP-0017 +type: workplan +title: "Release hardened reuse federation with seven-source metadata reader" +domain: financials +repo: railiance-apps +status: proposed +owner: codex +created: "2026-10-15" +updated: "2026-10-15" +flavor: implementation +depends_on: [RPF-WP-0058, REUSE-WP-0025] +--- + +Provisional id in isolated preparation checkout; root integration must confirm +availability. No hub registration, fix-consistency or push until integration. +Source owners approved metadata disclosure under CUST81 R1; that is not approval +for live credential issuance or workload rollout. Apps owns only S5 release. + +## Prepare bounded release contract + +```task +id: RAPPS-WP-0017-T01 +status: done +priority: high +``` + +Prepare chart allowlist/digest support, exact14 URL override and separate phase-B +ESO manifest, own preparation review and meaningful local validation. +Evidence: docs/assessments/cust81-private-reader/apps-owner-review-r1.md. + +## Verify and promote hardened runtime before reader delivery + +```task +id: RAPPS-WP-0017-T02 +status: wait +priority: high +``` + +Wait for published fully hardened image digest/source/tests plus owner reviews +and change authorization. Obtain metadata-only existing auth-source migration +inventory, live headroom/PVC evidence, exact server dry-run/diff, baseline health +and rollback receipt. Phase A deploy excludes reader ESO mapping. + +## Deliver reviewed reader and prove complete hosted discovery + +```task +id: RAPPS-WP-0017-T03 +status: wait +priority: high +``` + +After verified phase A and approved/executed platform CCR, apply phase-B ESO +mapping and restart hardened runtime through reviewed owner lane. Require +sanitized ESO/key-presence proof and reuse native14 fetch/7 entry hashes before +registration. Final CUST81 owner verifies70/70 hosted; rollback revokes/removes +reader before any vulnerable image restoration. diff --git a/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/review/apps-chart-preparation-r1.patch b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/review/apps-chart-preparation-r1.patch new file mode 100644 index 00000000..eacf0da4 --- /dev/null +++ b/docs/assessments/netkingdom-2026-10-14/owner-assembly/apps-r1/review/apps-chart-preparation-r1.patch @@ -0,0 +1,615 @@ +diff --git a/charts/reuse-surface/templates/_helpers.tpl b/charts/reuse-surface/templates/_helpers.tpl +index 1c46bdb..cdcae93 100644 +--- a/charts/reuse-surface/templates/_helpers.tpl ++++ b/charts/reuse-surface/templates/_helpers.tpl +@@ -32,11 +32,21 @@ app.kubernetes.io/component: landing + {{- end -}} + + {{- define "reuse.image" -}} ++{{- if and .Values.authSourceAllowlist (not .Values.image.digest) -}} ++{{- fail "authenticated source allowlist requires reviewed hardened image.digest" -}} ++{{- end -}} ++{{- if .Values.image.digest -}} ++{{- if not (regexMatch "^sha256:[a-f0-9]{64}$" .Values.image.digest) -}} ++{{- fail "image.digest must be sha256 plus 64 lowercase hex characters" -}} ++{{- end -}} ++{{- printf "%s@%s" .Values.image.repository .Values.image.digest -}} ++{{- else -}} + {{- if not .Values.image.tag -}} + {{- fail "image.tag is required - pin it in helm/reuse-surface-values.yaml" -}} + {{- end -}} + {{- printf "%s:%s" .Values.image.repository .Values.image.tag -}} + {{- end -}} ++{{- end -}} + + {{- define "reuse.landingImage" -}} + {{- if not .Values.landing.image.tag -}} +diff --git a/charts/reuse-surface/templates/deployment.yaml b/charts/reuse-surface/templates/deployment.yaml +index b1c47e7..06b815d 100644 +--- a/charts/reuse-surface/templates/deployment.yaml ++++ b/charts/reuse-surface/templates/deployment.yaml +@@ -36,6 +36,8 @@ spec: + - secretRef: + name: {{ .Values.envSecretName | quote }} + env: ++ - name: REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST ++ value: {{ .Values.authSourceAllowlist | toJson | quote }} + - name: REUSE_SURFACE_LISTEN_HOST + value: "0.0.0.0" + - name: REUSE_SURFACE_LISTEN_PORT +diff --git a/charts/reuse-surface/values.yaml b/charts/reuse-surface/values.yaml +index fb54e76..0e520d2 100644 +--- a/charts/reuse-surface/values.yaml ++++ b/charts/reuse-surface/values.yaml +@@ -1,6 +1,7 @@ + image: + repository: forgejo.coulomb.social/coulomb/reuse-surface + tag: "" ++ digest: "" + pullPolicy: IfNotPresent + + replicaCount: 1 +@@ -26,6 +27,10 @@ resources: + + envSecretName: reuse-surface-env + ++# Non-secret exact URL bindings for authenticated remote metadata fetches. ++# Nonempty bindings require an immutable digest; use only a reviewed hardened image. ++authSourceAllowlist: {} ++ + landing: + enabled: false + image: +diff --git a/charts/reuse-surface/values.schema.json b/charts/reuse-surface/values.schema.json +new file mode 100644 +index 0000000..7367c10 +--- /dev/null ++++ b/charts/reuse-surface/values.schema.json +@@ -0,0 +1,30 @@ ++{ ++ "$schema": "https://json-schema.org/draft-07/schema#", ++ "type": "object", ++ "properties": { ++ "image": { ++ "type": "object", ++ "properties": { ++ "digest": { ++ "type": "string", ++ "pattern": "^(|sha256:[a-f0-9]{64})$" ++ } ++ } ++ }, ++ "authSourceAllowlist": { ++ "type": "object", ++ "propertyNames": { ++ "pattern": "^[A-Z][A-Z0-9_]*$" ++ }, ++ "additionalProperties": { ++ "type": "array", ++ "uniqueItems": true, ++ "items": { ++ "type": "string", ++ "pattern": "^https://[^\\s]+$" ++ }, ++ "minItems": 1 ++ } ++ } ++ } ++} +diff --git a/scripts/reuse_authenticated_source_inventory.py b/scripts/reuse_authenticated_source_inventory.py +new file mode 100644 +index 0000000..1072c97 +--- /dev/null ++++ b/scripts/reuse_authenticated_source_inventory.py +@@ -0,0 +1,61 @@ ++#!/usr/bin/env python3 ++"""Read-only authenticated source metadata; never read env or Kubernetes Secrets. ++ ++Caller must first confirm the kubeconfig targets railiance01. Raw command ++stdout/stderr and exception text are never emitted. No credentials are needed ++beyond the caller's separately approved Kubernetes observation/exec lane. ++""" ++import argparse ++import json ++import re ++import subprocess ++from urllib.parse import urlsplit, parse_qs ++ ++# SQL projects metadata only; the registration payload itself is never printed. ++POD_CODE = '''import json, sqlite3 ++with sqlite3.connect("file:/data/reuse.db?mode=ro", uri=True) as db: ++ rows=db.execute("SELECT repo, json_extract(payload, '$.auth_env'), json_extract(payload, '$.index_url') FROM registrations WHERE json_extract(payload, '$.auth_env') IS NOT NULL AND json_extract(payload, '$.auth_env') != ''").fetchall() ++ print(json.dumps(rows)) ++''' ++ ++ ++def sanitize(rows): ++ result = [] ++ for repo, name, url in rows: ++ if not isinstance(repo, str) or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', repo): ++ raise ValueError('invalid metadata') ++ if not isinstance(name, str) or not re.fullmatch(r'[A-Z][A-Z0-9_]{0,127}', name): ++ raise ValueError('invalid metadata') ++ parts = urlsplit(url) ++ # URLs are untrusted stored data; refuse userinfo/fragments and arbitrary ++ # query fields (which could contain credentials). Never echo invalid rows. ++ query = parse_qs(parts.query, keep_blank_values=True) ++ if (parts.scheme != 'https' or parts.username or parts.password or parts.fragment ++ or parts.hostname != 'forgejo.coulomb.social' or parts.port not in (None, 443) ++ or not re.fullmatch(r'/api/v1/repos/coulomb/[a-zA-Z0-9_.-]+/raw/registry/indexes/[a-zA-Z0-9_.-]+', parts.path) ++ or any(k != 'ref' for k in query) ++ or ('ref' in query and (len(query['ref']) != 1 or not re.fullmatch(r'[a-zA-Z0-9_.-]{1,128}', query['ref'][0])))): ++ raise ValueError('unsafe metadata') ++ result.append({'repo': repo, 'auth_env': name, 'index_url': url}) ++ return sorted(result, key=lambda row: row['repo']) ++ ++ ++def main(): ++ parser = argparse.ArgumentParser(description=__doc__) ++ parser.add_argument('--kubeconfig', required=True) ++ args = parser.parse_args() ++ try: ++ proc = subprocess.run(['kubectl', '--kubeconfig', args.kubeconfig, '-n', 'reuse', ++ 'exec', 'deployment/reuse-surface', '-c', 'reuse-surface', '--', 'python3', '-c', POD_CODE], ++ capture_output=True, timeout=30) ++ if proc.returncode: ++ raise RuntimeError('inventory unavailable') ++ rows = sanitize(json.loads(proc.stdout)) ++ except Exception: ++ print(json.dumps({'status': 'refused_or_unavailable', 'raw_output_discarded': True})) ++ return 1 ++ print(json.dumps({'status': 'verified', 'authenticated_source_count': len(rows), 'sources': rows}, indent=2)) ++ return 0 ++ ++if __name__ == '__main__': ++ raise SystemExit(main()) +diff --git a/workplans/RAPPS-WP-0017-reuse-private-reader-release.md b/workplans/RAPPS-WP-0017-reuse-private-reader-release.md +new file mode 100644 +index 0000000..0363d08 +--- /dev/null ++++ b/workplans/RAPPS-WP-0017-reuse-private-reader-release.md +@@ -0,0 +1,57 @@ ++--- ++id: RAPPS-WP-0017 ++type: workplan ++title: "Release hardened reuse federation with seven-source metadata reader" ++domain: financials ++repo: railiance-apps ++status: proposed ++owner: codex ++created: "2026-10-15" ++updated: "2026-10-15" ++flavor: implementation ++depends_on: [RPF-WP-0058, REUSE-WP-0025] ++--- ++ ++Provisional id in isolated preparation checkout; root integration must confirm ++availability. No hub registration, fix-consistency or push until integration. ++Source owners approved metadata disclosure under CUST81 R1; that is not approval ++for live credential issuance or workload rollout. Apps owns only S5 release. ++ ++## Prepare bounded release contract ++ ++```task ++id: RAPPS-WP-0017-T01 ++status: done ++priority: high ++``` ++ ++Prepare chart allowlist/digest support, exact14 URL override and separate phase-B ++ESO manifest, own preparation review and meaningful local validation. ++Evidence: docs/assessments/cust81-private-reader/apps-owner-review-r1.md. ++ ++## Verify and promote hardened runtime before reader delivery ++ ++```task ++id: RAPPS-WP-0017-T02 ++status: wait ++priority: high ++``` ++ ++Wait for published fully hardened image digest/source/tests plus owner reviews ++and change authorization. Obtain metadata-only existing auth-source migration ++inventory, live headroom/PVC evidence, exact server dry-run/diff, baseline health ++and rollback receipt. Phase A deploy excludes reader ESO mapping. ++ ++## Deliver reviewed reader and prove complete hosted discovery ++ ++```task ++id: RAPPS-WP-0017-T03 ++status: wait ++priority: high ++``` ++ ++After verified phase A and approved/executed platform CCR, apply phase-B ESO ++mapping and restart hardened runtime through reviewed owner lane. Require ++sanitized ESO/key-presence proof and reuse native14 fetch/7 entry hashes before ++registration. Final CUST81 owner verifies70/70 hosted; rollback revokes/removes ++reader before any vulnerable image restoration. +diff --git a/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json b/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json +new file mode 100644 +index 0000000..edb5f74 +--- /dev/null ++++ b/docs/assessments/cust81-private-reader/runtime-auth-source-allowlist-r1.json +@@ -0,0 +1,18 @@ ++{ ++ "REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN": [ ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738", ++ "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738" ++ ] ++} +diff --git a/docs/assessments/cust81-private-reader/supervision-preparation-r1.json b/docs/assessments/cust81-private-reader/supervision-preparation-r1.json +new file mode 100644 +index 0000000..722694b +--- /dev/null ++++ b/docs/assessments/cust81-private-reader/supervision-preparation-r1.json +@@ -0,0 +1,10 @@ ++{ ++ "agent": "delegated-railiance-apps-cust81-preparation", ++ "mode": "supervised", ++ "scope": "isolated local chart/config/ESO proposal preparation, local verification only", ++ "supervisor": "root custodian coordinating founder-authorized work", ++ "promotion_evidence": null, ++ "runtime_enforcement_verified": false, ++ "authority_granted": false, ++ "live_execution_authorized": false ++} +diff --git a/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml b/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml +new file mode 100644 +index 0000000..3822799 +--- /dev/null ++++ b/docs/assessments/cust81-private-reader/reuse-surface-runtime-externalsecret.r1.yaml +@@ -0,0 +1,46 @@ ++# PROPOSAL ONLY: phase B, after hardened runtime verified and CCR approved. ++# reuse-surface hub runtime secrets from OpenBao (RAILIANCE-WP-0011 / CCR-2026-0005). ++# ++# OpenBao path (platform KV v2): workloads/reuse/reuse-surface/runtime-secrets ++# Fields: REUSE_SURFACE_TOKEN, REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET ++# ++# Prereqs on railiance01: ++# - External Secrets Operator (make eso-deploy) ++# - ClusterSecretStore openbao-reuse (railiance-platform openbao-secretstore) ++# - OpenBao policy workload-kv-read-reuse-surface-runtime + ESO token ++# (make reuse-openbao-eso-token-apply) ++apiVersion: external-secrets.io/v1beta1 ++kind: ExternalSecret ++metadata: ++ name: reuse-surface-runtime ++ namespace: reuse ++ labels: ++ app.kubernetes.io/name: reuse-surface ++ app.kubernetes.io/part-of: railiance-apps ++spec: ++ refreshInterval: 1h ++ secretStoreRef: ++ kind: ClusterSecretStore ++ name: openbao-reuse ++ target: ++ # Explicit target metadata prevents ESO copying source last-applied annotations. ++ template: ++ metadata: ++ labels: ++ app.kubernetes.io/name: reuse-surface ++ app.kubernetes.io/part-of: railiance-apps ++ name: reuse-surface-env ++ creationPolicy: Owner ++ data: ++ - secretKey: REUSE_SURFACE_TOKEN ++ remoteRef: ++ key: workloads/reuse/reuse-surface/runtime-secrets ++ property: REUSE_SURFACE_TOKEN ++ - secretKey: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET ++ remoteRef: ++ key: workloads/reuse/reuse-surface/runtime-secrets ++ property: REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET ++ - secretKey: REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN ++ remoteRef: ++ key: workloads/reuse/reuse-surface/forgejo-source-read ++ property: FORGEJO_SOURCE_TOKEN +diff --git a/docs/assessments/cust81-private-reader/apps-owner-review-r1.md b/docs/assessments/cust81-private-reader/apps-owner-review-r1.md +new file mode 100644 +index 0000000..9a51050 +--- /dev/null ++++ b/docs/assessments/cust81-private-reader/apps-owner-review-r1.md +@@ -0,0 +1,104 @@ ++# Railiance apps preparation review — CUST81 private metadata reader R1 ++ ++Reviewer: delegated railiance-apps preparation worker, supervised local preparation ++assignment. No promotion evidence or existing own-scope supervision record was ++found; the descriptive preparation record grants no runtime authority. This is ++an S5 release-contract review grounded in INTENT principles 1–5 (workloads, ++release contracts, repeatable operations, explicit S3 handoff, verified health). ++It is not a founder decision, independent platform credential review or reuse ++application source review. No live changes, commits, pushes, hub writes, image ++publishes, login or credential retrieval occurred. ++ ++Disposition: **approved for integration as local preparation only; live promotion blocked**. ++Canonical review disposition: `approved`. This accepts the bounded S5 proposal ++and its explicit runtime gates, not live execution or another owner’s review. ++ ++## Proposed changes and owner boundaries ++ ++The chart accepts an optional immutable image digest, adds a non-secret exact ++`REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST` environment binding, and fails rendering ++when a nonempty allowlist lacks an immutable digest. Schema checks enforce ++HTTPS allowlist entries and valid digest syntax. Production values continue ++using their existing `main-6cbc862` tag; production ExternalSecret is unchanged. ++The preparation override contains exactly 14 reviewed pinned metadata URLs and ++an empty digest deliberately preventing deployment. A synthetic all-zero digest ++in local tests is not an image and must never be promoted. ++ ++The proposed phase-B ExternalSecret preserves existing two keys, target metadata ++and existing `openbao-reuse` ClusterSecretStore, adding only ++`REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN` from ++`workloads/reuse/reuse-surface/forgejo-source-read:FORGEJO_SOURCE_TOKEN`. ++Platform owns the dedicated KV path/policy/store read scope, CCR-2026-0046 and ++credential issuance; apps neither provisions nor consumes an admin credential. ++ ++Digest presence cannot prove the hardened application is included. The reuse ++owner must provide published build digest, source revision, tests and review ++binding *both* authenticated redirect rejection and exact environment-name/URL ++credential routing. A reader must not reach the existing vulnerable runtime. ++ ++## Ordered promotion gates — not executed ++ ++1. Confirm own-scope supervision and founder change approval, reviewed CCR, ++ exact seven-source owner consent packet and scoped Forgejo read-only issuer ++ receipt. Integrate provisional RAPPS-WP-0017 through root owner coordination. ++2. Run metadata inventory helper with an explicitly verified railiance01 ++ kubeconfig; compare existing authenticated registrations with newly ++ fail-closed image behavior. The helper reads only SQLite registration ++ metadata, never env/Secrets, captures command errors and refuses unsafe ++ URLs. If it refuses, resolve via the source owner without emitting raw ++ objects. Any existing authenticated source requires separately reviewed ++ exact URL bindings including capability entry URLs before promotion; do not ++ silently orphan sources or broaden the 14-URL map. Missing inventory blocks ++ phase A. Store only safe names, counts and validated metadata URLs. ++3. Read live release image/revision, replica state, PVC storage/access modes and ++ readiness. Confirm node external IP `92.205.62.239`, not retired coulombcore. ++ Record requested CPU/memory headroom and pending pods before rollout. Existing ++ API requests 100m CPU/256Mi, surge1 requires that much additional allocatable ++ capacity; landing unchanged. Confirm the existing PVC supports simultaneous ++ pod scheduling/mount on this single node; stop if RWO/RWOP or mount conflicts ++ prevent it. No rollout strategy/resource/PVC changes are proposed. Do not ++ change other workloads merely to obtain capacity. ++4. Once a real reviewed digest exists, fill the preparation values; render ++ exact chart with production values plus proposal overrides. Server dry-run ++ and client diff must cover every rendered chart object and the phase-B ESO ++ manifest. Preserve stderr in memory and emit sanitized status only; never ++ print live Secrets, Helm secret values, annotations or raw API failures. ++ Existing release owner and any Argo adoption must be verified before choosing ++ owner Helm upgrade versus GitOps sync; neither is executed here. ++5. Phase A: approved release of hardened digest plus approved allowlist, with ++ existing ESO fields only. Owner Helm path must use atomic upgrade, timeout ++ and wait; verify actual running imageID matches digest, API health/probes, ++ public federation baseline63 and credential-routing refusal/redirect tests. ++ Deployment failure blocks phase B. Database/PVC remains unchanged. Collect a ++ separately approved safe backup/recovery receipt before any risky live release. ++6. Phase B: after verified phase A, execute reviewed platform credential action ++ and ESO reader mapping. Verify only ESO condition/status and key-presence ++ booleans via approved suppressing helpers, then restart/sync the hardened ++ workload so envFrom obtains the reader. Never dump Secret or process env. ++7. Reuse owner runs native exact-byte authenticated proof for all14 URLs and ++ seven capability entries using pinned consent hashes. Only then register ++ seven sources through the scoped write route and verify hosted70/70, ++ no duplicates/conflicting IDs and public federation preserves all63. ++ ++## Rollback contract ++ ++Before execution capture previous approved release revision, digest/tag and ++safe configuration, public discovery baseline and database recovery receipt. ++If phase A fails before credential delivery, atomic restore of previous release ++is safe because no reader has been supplied. After phase B, **never downgrade to ++vulnerable runtime with reader still available**: revoke the dedicated reader ++at Forgejo/OpenBao via credential owner, remove phase-B ESO mapping and materialized ++reader key through reviewed silent maintenance, restart current hardened pods, ++verify absence/revocation, then restore prior approved chart/image only if needed. ++Metadata registrations may remain inaccessible until re-established; record the ++regression explicitly. Do not roll back the PVC or use stale tokens as recovery. ++ ++## Local evidence and limitations ++ ++`helm lint charts/reuse-surface -f helm/reuse-surface-values.yaml` passed. ++`python3 docs/assessments/cust81-private-reader/verify_preparation.py` passed eight ++checks, including exact14 roundtrip, digest/schema refusal, retention of current ++strategy/resources/PVC, correct isolated ESO mapping, metadata URL sanitization ++and subprocess error suppression. `local-verification-r1.json` contains command ++statuses without raw output. No cluster inventory, resource headroom, ++server dry-run/diff, image publish, live approval or native fetch has been proven. +diff --git a/docs/assessments/cust81-private-reader/verify_preparation.py b/docs/assessments/cust81-private-reader/verify_preparation.py +new file mode 100644 +index 0000000..8523b6b +--- /dev/null ++++ b/docs/assessments/cust81-private-reader/verify_preparation.py +@@ -0,0 +1,68 @@ ++"""Local chart and non-disclosure checks only; never contacts a cluster.""" ++import hashlib ++import importlib.util ++import json ++from pathlib import Path ++import subprocess ++import yaml ++ ++ROOT = Path(__file__).resolve().parents[3] ++ARTIFACT = Path(__file__).resolve().parent ++calls = [] ++ ++def render(extra, success=True): ++ command = ['helm', 'template', 'reuse', str(ROOT / 'charts/reuse-surface'), '-f', str(ROOT / 'helm/reuse-surface-values.yaml'), *extra] ++ proc = subprocess.run(command, capture_output=True, text=True) ++ calls.append({'command': command, 'exit_code': proc.returncode, 'expected_success': success}) ++ assert (proc.returncode == 0) == success ++ return list(yaml.safe_load_all(proc.stdout)) if success else [] ++ ++def api(docs): ++ return next(d for d in docs if d and d.get('kind') == 'Deployment' and d['metadata']['name'] == 'reuse-surface') ++ ++current = api(render([])) ++assert current['spec']['template']['spec']['containers'][0]['image'].endswith(':main-6cbc862') ++assert next(e['value'] for e in current['spec']['template']['spec']['containers'][0]['env'] if e['name']=='REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST') == '{}' ++proposal = ['-f', str(ARTIFACT / 'private-reader-values.r1.yaml')] ++render(proposal, False) # unknown real digest is a hard gate ++# Synthetic digest is render-only, and expressly not promotion/build evidence. ++render(proposal+['--set', 'image.digest=sha256:bad'], False) ++render(proposal+['--set-json', 'authSourceAllowlist={"BAD":["http://attacker.invalid"]}', '--set', 'image.digest=sha256:'+'0'*64], False) ++docs = render(proposal+['--set', 'image.digest=sha256:'+'0'*64]) ++deployment = api(docs) ++container = deployment['spec']['template']['spec']['containers'][0] ++assert container['image'].endswith('@sha256:'+'0'*64) ++allowlist=json.loads(next(e['value'] for e in container['env'] if e['name']=='REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST')) ++expected = json.loads((ARTIFACT/'runtime-auth-source-allowlist-r1.json').read_text()) ++assert allowlist==expected and len(next(iter(allowlist.values())))==14 ++assert deployment['spec']['strategy'] == current['spec']['strategy'] ++assert container['resources']==current['spec']['template']['spec']['containers'][0]['resources'] ++assert deployment['spec']['template']['spec']['volumes']==current['spec']['template']['spec']['volumes'] ++assert container['volumeMounts']==current['spec']['template']['spec']['containers'][0]['volumeMounts'] ++secret=yaml.safe_load((ARTIFACT/'reuse-surface-runtime-externalsecret.r1.yaml').read_text()) ++baseline=yaml.safe_load((ROOT/'manifests/reuse-surface-runtime-externalsecret.yaml').read_text()) ++assert secret['spec']['data'][:-1]==baseline['spec']['data'] ++assert secret['spec']['secretStoreRef']==baseline['spec']['secretStoreRef'] ++assert secret['spec']['data'][-1]=={'secretKey':'REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN','remoteRef':{'key':'workloads/reuse/reuse-surface/forgejo-source-read','property':'FORGEJO_SOURCE_TOKEN'}} ++spec=importlib.util.spec_from_file_location('inventory',ROOT/'scripts/reuse_authenticated_source_inventory.py') ++mod=importlib.util.module_from_spec(spec);spec.loader.exec_module(mod) ++url=expected['REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN'][1] ++assert len(mod.sanitize([['rapp-openbao','FIXTURE_READ_TOKEN',url]]))==1 ++for bad in ['https://token@forgejo.coulomb.social/x', url+'&token=fixture-secret','http://attacker.invalid',url+'#fixture-secret']: ++ try: mod.sanitize([['rapp-openbao','FIXTURE_READ_TOKEN',bad]]) ++ except ValueError: pass ++ else: raise AssertionError('unsafe URL accepted') ++# Errors from kubectl are discarded before output; no subprocess invoked in test. ++original=mod.subprocess.run ++class Failure: ++ returncode=1;stdout=b'fixture-secret';stderr=b'fixture-secret' ++mod.subprocess.run=lambda *args,**kwargs: Failure() ++import sys,io,contextlib ++argv=sys.argv;sys.argv=['inventory','--kubeconfig','fixture-path'] ++buf=io.StringIO() ++with contextlib.redirect_stdout(buf): assert mod.main()==1 ++sys.argv=argv;mod.subprocess.run=original ++assert 'fixture-secret' not in buf.getvalue() ++result={'status':'passed','local_only':True,'real_image_digest':None,'synthetic_digest_used_only_to_check_rendering':True,'checks':['production rendering unchanged except empty fail-closed allowlist','unknown/malformed digest fails','HTTP allowlist fails schema','exact14 URLs roundtrip','strategy resources PVC retained','dedicated ESO mapping preserves current fields/store','metadata sanitizer excludes userinfo/query secrets/fragments','kubectl failure output discarded'],'helm_calls':calls} ++(ARTIFACT/'local-verification-r1.json').write_text(json.dumps(result,indent=2)+'\n') ++print(json.dumps({'status':'passed','checks':len(result['checks'])})) +diff --git a/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml b/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml +new file mode 100644 +index 0000000..70dc932 +--- /dev/null ++++ b/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml +@@ -0,0 +1,5 @@ ++# PREPARATION ONLY: empty digest deliberately prevents rendering/deployment. ++# Fill only after reuse-surface publishes and reviews the fully hardened image. ++image: ++ digest: "" ++authSourceAllowlist: {"REUSE_SURFACE_FORGEJO_SOURCE_READ_TOKEN": ["https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/capabilities/capability.railiance.openbao-package.md?ref=35672be138036c8433a5ac5de91e068c03c2b124", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-openbao/raw/registry/indexes/capabilities.yaml?ref=35672be138036c8433a5ac5de91e068c03c2b124", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/capabilities/capability.railiance.policy-publication-package.md?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-policy-nexus/raw/registry/indexes/capabilities.yaml?ref=088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/capabilities/capability.railiance.postgres-isolation-recovery.md?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-postgres/raw/registry/indexes/capabilities.yaml?ref=a9f569c96d74aa384ac8d3ac4aa960e4061550b5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/capabilities/capability.railiance.sbom-runtime-package.md?ref=adbedd349e8df97be43a1f57db7095af45ff29d1", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-sbom-nexus/raw/registry/indexes/capabilities.yaml?ref=adbedd349e8df97be43a1f57db7095af45ff29d1", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/capabilities/capability.railiance.telemetry-package.md?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-telemetry/raw/registry/indexes/capabilities.yaml?ref=f158307e24b86bab88a1af4830ff6b4f85afdeb5", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/capabilities/capability.railiance.tenant-engine-package.md?ref=9bdc86572728783a5ed94266f04f7b12d414c557", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-tenant-engine/raw/registry/indexes/capabilities.yaml?ref=9bdc86572728783a5ed94266f04f7b12d414c557", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/capabilities/capability.railiance.user-engine-package.md?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738", "https://forgejo.coulomb.social/api/v1/repos/coulomb/rapp-user-engine/raw/registry/indexes/capabilities.yaml?ref=f35108f9e1b8702fb6c526fe42b2fec5ca032738"]} +diff --git a/docs/assessments/cust81-private-reader/local-verification-r1.json b/docs/assessments/cust81-private-reader/local-verification-r1.json +new file mode 100644 +index 0000000..531488b +--- /dev/null ++++ b/docs/assessments/cust81-private-reader/local-verification-r1.json +@@ -0,0 +1,94 @@ ++{ ++ "status": "passed", ++ "local_only": true, ++ "real_image_digest": null, ++ "synthetic_digest_used_only_to_check_rendering": true, ++ "checks": [ ++ "production rendering unchanged except empty fail-closed allowlist", ++ "unknown/malformed digest fails", ++ "HTTP allowlist fails schema", ++ "exact14 URLs roundtrip", ++ "strategy resources PVC retained", ++ "dedicated ESO mapping preserves current fields/store", ++ "metadata sanitizer excludes userinfo/query secrets/fragments", ++ "kubectl failure output discarded" ++ ], ++ "helm_calls": [ ++ { ++ "command": [ ++ "helm", ++ "template", ++ "reuse", ++ "/tmp/cust81-apps-reader-owner/charts/reuse-surface", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml" ++ ], ++ "exit_code": 0, ++ "expected_success": true ++ }, ++ { ++ "command": [ ++ "helm", ++ "template", ++ "reuse", ++ "/tmp/cust81-apps-reader-owner/charts/reuse-surface", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml" ++ ], ++ "exit_code": 1, ++ "expected_success": false ++ }, ++ { ++ "command": [ ++ "helm", ++ "template", ++ "reuse", ++ "/tmp/cust81-apps-reader-owner/charts/reuse-surface", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml", ++ "--set", ++ "image.digest=sha256:bad" ++ ], ++ "exit_code": 1, ++ "expected_success": false ++ }, ++ { ++ "command": [ ++ "helm", ++ "template", ++ "reuse", ++ "/tmp/cust81-apps-reader-owner/charts/reuse-surface", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml", ++ "--set-json", ++ "authSourceAllowlist={\"BAD\":[\"http://attacker.invalid\"]}", ++ "--set", ++ "image.digest=sha256:0000000000000000000000000000000000000000000000000000000000000000" ++ ], ++ "exit_code": 1, ++ "expected_success": false ++ }, ++ { ++ "command": [ ++ "helm", ++ "template", ++ "reuse", ++ "/tmp/cust81-apps-reader-owner/charts/reuse-surface", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/helm/reuse-surface-values.yaml", ++ "-f", ++ "/tmp/cust81-apps-reader-owner/docs/assessments/cust81-private-reader/private-reader-values.r1.yaml", ++ "--set", ++ "image.digest=sha256:0000000000000000000000000000000000000000000000000000000000000000" ++ ], ++ "exit_code": 0, ++ "expected_success": true ++ } ++ ] ++} diff --git a/docs/assessments/netkingdom-2026-10-14/publication-preflight.json b/docs/assessments/netkingdom-2026-10-14/publication-preflight.json index ee5730a4..b279dca2 100644 --- a/docs/assessments/netkingdom-2026-10-14/publication-preflight.json +++ b/docs/assessments/netkingdom-2026-10-14/publication-preflight.json @@ -2,8 +2,8 @@ { "repo": "access-engine", "branch": "main", - "local_head": "16ca97b2776789f730cc7049a2d6533612faaccd", - "remote_head": "16ca97b2776789f730cc7049a2d6533612faaccd", + "local_head": "62ac2b4e99dec2005c7c407fe633612578a7907d", + "remote_head": "62ac2b4e99dec2005c7c407fe633612578a7907d", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -11,8 +11,8 @@ { "repo": "activity-core", "branch": "main", - "local_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df", - "remote_head": "83e6446807c4b36f3aa5023a5c16d4c7df8bd3df", + "local_head": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0", + "remote_head": "f9f8df039258a0d8b6fc29dc1f7c4bcc75fdc8c0", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -20,8 +20,8 @@ { "repo": "agentic-resources", "branch": "main", - "local_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709", - "remote_head": "65b3a5cb6bf3eb214b492b95a38f2eb729f89709", + "local_head": "c4cedab945e047de068428fb943f346f093b22dc", + "remote_head": "c4cedab945e047de068428fb943f346f093b22dc", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -29,8 +29,8 @@ { "repo": "approval-engine", "branch": "main", - "local_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51", - "remote_head": "e1649617e8ad321f79632d5fd33e973ae5d5ae51", + "local_head": "db850aded5fc3b5d35938d26e8084e436a83943b", + "remote_head": "db850aded5fc3b5d35938d26e8084e436a83943b", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -38,8 +38,8 @@ { "repo": "audit-core", "branch": "main", - "local_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9", - "remote_head": "f1e715326b3ffd956623a84fa7ab0ce5ab3fbcf9", + "local_head": "8d4bde6ece39ce0df3a3cc49da38613123e8f215", + "remote_head": "8d4bde6ece39ce0df3a3cc49da38613123e8f215", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -47,8 +47,8 @@ { "repo": "coordination-engine", "branch": "main", - "local_head": "c401067842072b75717f76480dd6e7db1836059c", - "remote_head": "c401067842072b75717f76480dd6e7db1836059c", + "local_head": "16de8fc3f70020df646f1ebdca705a1bf88485a0", + "remote_head": "16de8fc3f70020df646f1ebdca705a1bf88485a0", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -56,8 +56,8 @@ { "repo": "emergent-security", "branch": "main", - "local_head": "4c6fda38298fa50665ead41526b893adf069d335", - "remote_head": "4c6fda38298fa50665ead41526b893adf069d335", + "local_head": "6eead2a922ae2eb81593213f54bf1f35e1c9970f", + "remote_head": "6eead2a922ae2eb81593213f54bf1f35e1c9970f", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -65,8 +65,8 @@ { "repo": "fin-hub", "branch": "main", - "local_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4", - "remote_head": "8f527c6705bbf5d7ffed43559411ca748bec8fe4", + "local_head": "cace0fda7474304cc42028287f7ba1327ab07d00", + "remote_head": "cace0fda7474304cc42028287f7ba1327ab07d00", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -74,8 +74,8 @@ { "repo": "gate-house", "branch": "main", - "local_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3", - "remote_head": "bc890c4d050a2e726ce8988a8260ab9caea133e3", + "local_head": "ab1a299674679ccfefa8df84b877614ac44c9d38", + "remote_head": "ab1a299674679ccfefa8df84b877614ac44c9d38", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -83,8 +83,8 @@ { "repo": "glas-harness", "branch": "main", - "local_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe", - "remote_head": "7b1557ba14f483569b90ebfdc2d0136fa69602fe", + "local_head": "dc88f302044c7c2b41795958527e64be8a83e3ab", + "remote_head": "dc88f302044c7c2b41795958527e64be8a83e3ab", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -94,8 +94,8 @@ { "repo": "info-tech-canon", "branch": "main", - "local_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e", - "remote_head": "3d206a56f4ece439f6ee87f9ee4d1800ab82166e", + "local_head": "9b9be2ec8e846ceaa05fa644323b02d8603e39b6", + "remote_head": "9b9be2ec8e846ceaa05fa644323b02d8603e39b6", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -103,8 +103,8 @@ { "repo": "informed-decision", "branch": "main", - "local_head": "ee6a65b80a0fea1a914dfa31434b903669656c09", - "remote_head": "ee6a65b80a0fea1a914dfa31434b903669656c09", + "local_head": "faae9cb0dbaf4c8d23f838183f513c302ad3b9f0", + "remote_head": "faae9cb0dbaf4c8d23f838183f513c302ad3b9f0", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -114,8 +114,8 @@ { "repo": "issue-core", "branch": "main", - "local_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e", - "remote_head": "de368271f6ffc06353ec409998a0d6d0ec0bf25e", + "local_head": "1427d268a09b9334a98a167230ec7dd1d4a82053", + "remote_head": "1427d268a09b9334a98a167230ec7dd1d4a82053", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -123,19 +123,17 @@ { "repo": "key-cape", "branch": "main", - "local_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76", - "remote_head": "1344fc80e56315c5c99f58993f9ee02ce79e8a76", - "same_head": true, + "local_head": "8c6c071ad9c73865793a075ed1b34b93e5075436", + "remote_head": "44b243410006a2df32adcd4cae2ab5e6f806da82", + "same_head": false, "remote_read_exit": 0, - "staged_paths": [ - ".custodian-brief.md" - ] + "staged_paths": [] }, { "repo": "kings-guard", "branch": "main", - "local_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7", - "remote_head": "af02e2547598d6ec0e83f482d9ea3ef943ea67b7", + "local_head": "6aea834dc556067672f31ed762f44a39bad988e3", + "remote_head": "6aea834dc556067672f31ed762f44a39bad988e3", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -144,7 +142,7 @@ "repo": "maturity-engine", "branch": "main", "local_head": "2f1de542cc8f24a79452f906d99f95be39d8b6a9", - "remote_head": "2ef97c87a0f818a906aa42942c32d6c69f9ec899", + "remote_head": "363e8160a4910766e9380fabee68a8642dd45ccf", "same_head": false, "remote_read_exit": 0, "staged_paths": [] @@ -152,17 +150,17 @@ { "repo": "net-kingdom", "branch": "main", - "local_head": "1a36e857cc5aae6fe738f794417126c46dd94627", - "remote_head": "1a36e857cc5aae6fe738f794417126c46dd94627", - "same_head": true, + "local_head": "2cc09ceb05c6f2132c6fc3478901c4ee1085fa1b", + "remote_head": "8f0a5902004c47415846d818e400eb5d5e1e037d", + "same_head": false, "remote_read_exit": 0, "staged_paths": [] }, { "repo": "ops-bridge", "branch": "main", - "local_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2", - "remote_head": "190ef1e188e12c606f1359325fd9fdd1dbef29e2", + "local_head": "2246656f43fa5eae3ae917f63ea1dfa3f53f4a00", + "remote_head": "2246656f43fa5eae3ae917f63ea1dfa3f53f4a00", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -170,17 +168,19 @@ { "repo": "ops-mason", "branch": "main", - "local_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5", - "remote_head": "d86ad141befb6800468f5132d4c7c9ce2f852bb5", + "local_head": "97d1fed9496aacb1836982096b8aecb6da13cf0d", + "remote_head": "97d1fed9496aacb1836982096b8aecb6da13cf0d", "same_head": true, "remote_read_exit": 0, - "staged_paths": [] + "staged_paths": [ + ".custodian-brief.md" + ] }, { "repo": "ops-warden", "branch": "main", - "local_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2", - "remote_head": "6d2f1be9691b19e826898a2166ae4451e4802ae2", + "local_head": "1baeb0821cb6304464fab78932d8c6501f8c4cc6", + "remote_head": "1baeb0821cb6304464fab78932d8c6501f8c4cc6", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -188,8 +188,8 @@ { "repo": "policy-nexus", "branch": "main", - "local_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99", - "remote_head": "f784f017b0822f34c785f0b34c7c55fcf39c9d99", + "local_head": "c14561b2e5318e9637ba93e4c96c06a2db92d0c4", + "remote_head": "c14561b2e5318e9637ba93e4c96c06a2db92d0c4", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -197,8 +197,8 @@ { "repo": "rail-kubernetes", "branch": "main", - "local_head": "35159e49c1340b7a0e30c49188975c8839d346f6", - "remote_head": "35159e49c1340b7a0e30c49188975c8839d346f6", + "local_head": "5fad47fdfb7d4cabc21cf10f52ac733ef59803b0", + "remote_head": "5fad47fdfb7d4cabc21cf10f52ac733ef59803b0", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -206,8 +206,8 @@ { "repo": "railiance-apps", "branch": "main", - "local_head": "706461b845086ee2df8ce9acae3dae7feebfffda", - "remote_head": "706461b845086ee2df8ce9acae3dae7feebfffda", + "local_head": "72bcad86d7531bcc27f0e465a9385be559ba0c9f", + "remote_head": "72bcad86d7531bcc27f0e465a9385be559ba0c9f", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -217,8 +217,8 @@ { "repo": "railiance-bootstrap", "branch": "main", - "local_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b", - "remote_head": "ae00b2652737aaf18358431e66f59eeb7c01e16b", + "local_head": "70bd14d3b941a49c78bbc51d8faab5ab1da1df76", + "remote_head": "70bd14d3b941a49c78bbc51d8faab5ab1da1df76", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -226,8 +226,8 @@ { "repo": "railiance-cluster", "branch": "main", - "local_head": "12d1e881ff2086566712fbc591db293b38ea2bcf", - "remote_head": "12d1e881ff2086566712fbc591db293b38ea2bcf", + "local_head": "750c3e5b9b4623c52bce2b8fbd758f423f81f6c1", + "remote_head": "750c3e5b9b4623c52bce2b8fbd758f423f81f6c1", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -235,8 +235,8 @@ { "repo": "railiance-enablement", "branch": "main", - "local_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063", - "remote_head": "51a7c4cee68b48ed7a236e661b39c1d3cca92063", + "local_head": "ce9f6d1be8ff73afdedd6d666a8485e6c7348069", + "remote_head": "ce9f6d1be8ff73afdedd6d666a8485e6c7348069", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -244,8 +244,8 @@ { "repo": "railiance-fabric", "branch": "main", - "local_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e", - "remote_head": "96d19127125e85bdab7ff0ff79fc3ecf7d19045e", + "local_head": "095342c72ab6f02c72dd5d40e869dcba536bc5c1", + "remote_head": "095342c72ab6f02c72dd5d40e869dcba536bc5c1", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -253,8 +253,8 @@ { "repo": "railiance-forge", "branch": "main", - "local_head": "a15fac8e938c11b041eb39386f05b63d46ae566a", - "remote_head": "a15fac8e938c11b041eb39386f05b63d46ae566a", + "local_head": "6e8f657e55e96b4e9f3d9d74a27b420b68467e61", + "remote_head": "6e8f657e55e96b4e9f3d9d74a27b420b68467e61", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -264,17 +264,17 @@ { "repo": "railiance-infra", "branch": "main", - "local_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca", - "remote_head": "ef64e324b61e9aa9b9ed03aad7dd2101915057ca", - "same_head": true, + "local_head": "32f64b54fd94a5e6a145ef7c2c8faf051f721a71", + "remote_head": "99bc66f8c98a5404339074bf5bb11271d9f6d58d", + "same_head": false, "remote_read_exit": 0, "staged_paths": [] }, { "repo": "railiance-master", "branch": "main", - "local_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7", - "remote_head": "865c3bed86b3992244b29d6f1d6b8ebbe8db78c7", + "local_head": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4", + "remote_head": "a0be0d3142b5392f1fb6271cf91325ce91a0f9d4", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -282,17 +282,17 @@ { "repo": "railiance-platform", "branch": "main", - "local_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce", - "remote_head": "d303c99e3be993ffa989bc9ba3d7b471903858ce", - "same_head": true, + "local_head": "0f0282a43646edbb5743318bc923749af1c0cea2", + "remote_head": "b797594a21fb0969ec987e633521245e0277267b", + "same_head": false, "remote_read_exit": 0, "staged_paths": [] }, { "repo": "railiance-telemetry", "branch": "main", - "local_head": "81d905971c38de9aaf11088ba605e112152d8268", - "remote_head": "81d905971c38de9aaf11088ba605e112152d8268", + "local_head": "8cdb2d11dda03bd6839750d059b37932f069e66a", + "remote_head": "8cdb2d11dda03bd6839750d059b37932f069e66a", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -300,8 +300,8 @@ { "repo": "rapp-openbao", "branch": "main", - "local_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66", - "remote_head": "13ab9144bbb1d88fe760362df91a83c8b34e4e66", + "local_head": "35672be138036c8433a5ac5de91e068c03c2b124", + "remote_head": "35672be138036c8433a5ac5de91e068c03c2b124", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -309,8 +309,8 @@ { "repo": "rapp-playwright", "branch": "main", - "local_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", - "remote_head": "2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb", + "local_head": "4f76a87f67fdd9dab19564bb84235397e2f2470a", + "remote_head": "4f76a87f67fdd9dab19564bb84235397e2f2470a", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -318,8 +318,8 @@ { "repo": "rapp-policy-nexus", "branch": "main", - "local_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda", - "remote_head": "d3fee97d32ad47e3a7e3201a9c5b7209b4333fda", + "local_head": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", + "remote_head": "088b78ac03b0cebeec34a69aae3569eb7ec2f9c3", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -327,8 +327,8 @@ { "repo": "rapp-postgres", "branch": "main", - "local_head": "03744030c9258e920f6403a9ce184a26d7b75268", - "remote_head": "03744030c9258e920f6403a9ce184a26d7b75268", + "local_head": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", + "remote_head": "a9f569c96d74aa384ac8d3ac4aa960e4061550b5", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -336,8 +336,8 @@ { "repo": "rapp-telemetry", "branch": "main", - "local_head": "17053dbc47f7c22efd67fd90d06d108d154835fa", - "remote_head": "17053dbc47f7c22efd67fd90d06d108d154835fa", + "local_head": "f158307e24b86bab88a1af4830ff6b4f85afdeb5", + "remote_head": "f158307e24b86bab88a1af4830ff6b4f85afdeb5", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -345,8 +345,8 @@ { "repo": "rapp-tenant-engine", "branch": "main", - "local_head": "c160be23577ab4d99ee2cd008deb455b07f0597d", - "remote_head": "c160be23577ab4d99ee2cd008deb455b07f0597d", + "local_head": "9bdc86572728783a5ed94266f04f7b12d414c557", + "remote_head": "9bdc86572728783a5ed94266f04f7b12d414c557", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -354,17 +354,19 @@ { "repo": "rapp-user-engine", "branch": "main", - "local_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c", - "remote_head": "15faf1dc063a0bfdb2c4a56e9eb5b5791ec73d4c", + "local_head": "f35108f9e1b8702fb6c526fe42b2fec5ca032738", + "remote_head": "f35108f9e1b8702fb6c526fe42b2fec5ca032738", "same_head": true, "remote_read_exit": 0, - "staged_paths": [] + "staged_paths": [ + ".custodian-brief.md" + ] }, { "repo": "reef-railiance", "branch": "main", - "local_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239", - "remote_head": "ffb9e272ce1489cc37cc6388873558d8ba56c239", + "local_head": "33b840faac109f134bf1115d631d5b1242052d9a", + "remote_head": "33b840faac109f134bf1115d631d5b1242052d9a", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -372,8 +374,8 @@ { "repo": "rein-aharness", "branch": "main", - "local_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42", - "remote_head": "398949a3d34b6c9faae0fa1d0ff0aa039565aa42", + "local_head": "a58d11ce8ae9ea07baf0682c4f860caa251692b3", + "remote_head": "a58d11ce8ae9ea07baf0682c4f860caa251692b3", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -383,8 +385,8 @@ { "repo": "rein-openweights", "branch": "main", - "local_head": "e1fccb39b738a5381a9de6e1d799f124797798ce", - "remote_head": "e1fccb39b738a5381a9de6e1d799f124797798ce", + "local_head": "a2e428a76592d79982ea3c4eba5f137a12fb44e4", + "remote_head": "a2e428a76592d79982ea3c4eba5f137a12fb44e4", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -392,8 +394,8 @@ { "repo": "repo-manager", "branch": "main", - "local_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa", - "remote_head": "7677b00f69cd6362ac16a1021dc180ec6df4ebfa", + "local_head": "97ea2489257de08911cc5da1e1b84d8e15780dc3", + "remote_head": "97ea2489257de08911cc5da1e1b84d8e15780dc3", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -401,8 +403,8 @@ { "repo": "resource-control", "branch": "main", - "local_head": "3604d468f86ede7d320f4d22dd4aea775306b53f", - "remote_head": "3604d468f86ede7d320f4d22dd4aea775306b53f", + "local_head": "ac4e1c43e6d82ecd81108f3b006454ac6aa76722", + "remote_head": "ac4e1c43e6d82ecd81108f3b006454ac6aa76722", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -410,8 +412,8 @@ { "repo": "reuse-surface", "branch": "main", - "local_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1", - "remote_head": "a6da9f2c5c0cb8a69ddf4ea2386e79699a90c2e1", + "local_head": "03cd049773478e9de7e38035a49deaa82772a357", + "remote_head": "03cd049773478e9de7e38035a49deaa82772a357", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -419,8 +421,8 @@ { "repo": "risk-nexus", "branch": "main", - "local_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc", - "remote_head": "b877231d66e1289dc32fda07ed2c61dcb3e970dc", + "local_head": "0cb565e1e498002b0fe71975e7654b641a4c24d2", + "remote_head": "0cb565e1e498002b0fe71975e7654b641a4c24d2", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -428,8 +430,8 @@ { "repo": "role-engine", "branch": "main", - "local_head": "d231241dbfeeb541b34243f4022883aa6417a1eb", - "remote_head": "d231241dbfeeb541b34243f4022883aa6417a1eb", + "local_head": "c9d6d0763542f632f1d9b799d63b6b85cf8eaaab", + "remote_head": "c9d6d0763542f632f1d9b799d63b6b85cf8eaaab", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -437,8 +439,8 @@ { "repo": "runbook-tutorials", "branch": "main", - "local_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e", - "remote_head": "df97fadf5decfcdb5c3c6ab90211226335ffdf8e", + "local_head": "f0ea260895e8ad8e60f24bf64a89be063b7f8e13", + "remote_head": "f0ea260895e8ad8e60f24bf64a89be063b7f8e13", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -446,8 +448,8 @@ { "repo": "sand-boxer", "branch": "main", - "local_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d", - "remote_head": "b06d94f02b037764ff41c73c8ab43f4c8f5d309d", + "local_head": "7ddf92070f2fa267d79f8cad0aa07d16f0cd6410", + "remote_head": "7ddf92070f2fa267d79f8cad0aa07d16f0cd6410", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -457,8 +459,8 @@ { "repo": "sbom-nexus", "branch": "main", - "local_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522", - "remote_head": "07e998d9abfd4e4fcc74db9e292ed22c6f407522", + "local_head": "db76194330b9502e9a1085ae25cdd27ce264ec7b", + "remote_head": "db76194330b9502e9a1085ae25cdd27ce264ec7b", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -466,8 +468,8 @@ { "repo": "secrets-engine", "branch": "main", - "local_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d", - "remote_head": "d379a3dfba73c42cd97f4d9cba3a02d705155e4d", + "local_head": "6bd7129eac94131b4cf689e47cbdc9899418beb3", + "remote_head": "6bd7129eac94131b4cf689e47cbdc9899418beb3", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -477,8 +479,8 @@ { "repo": "security-canon", "branch": "main", - "local_head": "1664a6def20be2759a1e575024563efd27c9f36f", - "remote_head": "1664a6def20be2759a1e575024563efd27c9f36f", + "local_head": "c31c3008a53bcff07be09d0507d4693d27b40a5a", + "remote_head": "c31c3008a53bcff07be09d0507d4693d27b40a5a", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -486,8 +488,8 @@ { "repo": "state-hub", "branch": "main", - "local_head": "4ffc7236735afc6223aa613262483ea911307714", - "remote_head": "4ffc7236735afc6223aa613262483ea911307714", + "local_head": "2a2ac2eb195a073633f4db0f166b927ca1877d67", + "remote_head": "2a2ac2eb195a073633f4db0f166b927ca1877d67", "same_head": true, "remote_read_exit": 0, "staged_paths": [ @@ -497,8 +499,8 @@ { "repo": "tenant-engine", "branch": "main", - "local_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c", - "remote_head": "1dabbcf47d87d27d118dcf3147d9e3588a807e0c", + "local_head": "79a61905957bd78d3f4c93da42d7034ad3e3c8de", + "remote_head": "79a61905957bd78d3f4c93da42d7034ad3e3c8de", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -506,17 +508,19 @@ { "repo": "the-custodian", "branch": "main", - "local_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e", - "remote_head": "3f6df63a9a5ca5edfaf1c17ab59bd18b29c54c5e", + "local_head": "0e7bcd128bb80d3630d84c2ba1bedf88578ccde1", + "remote_head": "0e7bcd128bb80d3630d84c2ba1bedf88578ccde1", "same_head": true, "remote_read_exit": 0, - "staged_paths": [] + "staged_paths": [ + ".custodian-brief.md" + ] }, { "repo": "user-engine", "branch": "main", - "local_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79", - "remote_head": "85a419d6c5d0b4434d3ca7f33bde3092f5838f79", + "local_head": "e9534ef00f02f2b4772cd80f3b7c7aad5f9dae23", + "remote_head": "e9534ef00f02f2b4772cd80f3b7c7aad5f9dae23", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -524,8 +528,8 @@ { "repo": "whitehat-security", "branch": "main", - "local_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b", - "remote_head": "5587a8f6ac4b129527db819bc72832051c7fcc3b", + "local_head": "42fe7a12c7d9d64142ec0e820ba4e975ffeac593", + "remote_head": "42fe7a12c7d9d64142ec0e820ba4e975ffeac593", "same_head": true, "remote_read_exit": 0, "staged_paths": [] @@ -533,8 +537,8 @@ { "repo": "zone-engine", "branch": "main", - "local_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0", - "remote_head": "b5a6f88a82b125ebc82c0484bec1ea541e4f95d0", + "local_head": "7e7e3f307ca996c373e91009ed1b9b0cbc6fcb9e", + "remote_head": "7e7e3f307ca996c373e91009ed1b9b0cbc6fcb9e", "same_head": true, "remote_read_exit": 0, "staged_paths": [] diff --git a/docs/assessments/netkingdom-2026-10-14/published-source-verification.json b/docs/assessments/netkingdom-2026-10-14/published-source-verification.json index 83cdeb35..61dafc03 100644 --- a/docs/assessments/netkingdom-2026-10-14/published-source-verification.json +++ b/docs/assessments/netkingdom-2026-10-14/published-source-verification.json @@ -444,7 +444,7 @@ { "path": "registry/capabilities/capability.security.structure-construction.md", "http": 200, - "sha256": "7d6699c19f89d1ab916e0e2da6f7a36232b4960f693b042bf4374c86b7115f13", + "sha256": "000ceac5b4c71569aed1c9af970980a0c72a34db13fdca40671c9ddbfe97409d", "matches_local": true } ], diff --git a/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json b/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json index 44097c5e..34bb7c00 100644 --- a/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json +++ b/docs/assessments/netkingdom-2026-10-14/scoped-access-handoff.json @@ -1,7 +1,7 @@ { "workplan": "CUST-WP-0081", "user_disposition": "Arrange scoped owner access", - "status": "Awaiting owner provisioning; user preference is not evidence of provisioned access", + "status": "Public batch verified; founder metadata disclosure consent recorded for all seven sources. Restricted hub reader and native fetch verification remain pending.", "owner_repo": "railiance-platform", "write_access": { "route": "reuse-surface-hub-write-token", @@ -17,7 +17,8 @@ "platform/data/workloads/reuse/reuse-surface/runtime-secrets", "platform/metadata/workloads/reuse/reuse-surface/runtime-secrets" ], - "negative_check": "An unrelated sibling path must remain denied. Do not broaden policy contents or attach administrative/ESO-only permissions." + "negative_check": "An unrelated sibling path must remain denied. Do not broaden policy contents or attach administrative/ESO-only permissions.", + "verified_execution_receipt": "hosted-public-registration-verification.json" }, "private_source_access": { "repositories": [ @@ -38,11 +39,18 @@ "visibility_change_authorized": false, "credential_design": "A new dedicated Forgejo identity/PAT restricted to repository-read for exactly these seven sources; verify a denied-write/admin negative. Keep it distinct from the hub writer token and from other workload credentials.", "delivery": "Owner-reviewed OpenBao custody and ESO delivery to the reuse-surface hub runtime, then configure the registration auth_env with the environment variable name only.", - "approval": "Platform operator and each relevant source owner must approve the limited private capability-metadata disclosure and reader scope before provisioning." + "approval": "Platform operator and each relevant source owner must approve the limited private capability-metadata disclosure and reader scope before provisioning.", + "metadata_disclosure_consent": { + "status": "approved", + "receipt": "private-source-owner-consent-r1.json", + "decision_id": "d8f8f216-ac94-4295-97f3-825fd21254ea", + "proposal_sha256": "46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35" + }, + "consumer_delivery_gate": "Reuse owner reports native authenticated redirect forwarding hazard. Require owner-reviewed native fetch fix and verified fixed hub image before introducing source-reader PAT; initial same-image assumption is superseded by private-reader-owner-assembly-receipt.json." }, "resume": "Update and retain the exact registration proposal revision with admitted auth_env references, verify source parity, execute bounded registrations, then require all 70 reviewed IDs exactly once in a fresh hosted federation.", "secret_values_requested_in_chat": false, - "owner_message_sent": false, + "owner_message_sent": true, "attended_sequence": [ "Review CCR-2026-0005 and identify the actual intended caller principal. The existing OIDC identity is not named in the CCR.", "If needed, obtain and record platform-operator plus reuse-surface-owner approval for binding that exact identity to the existing read-only policy. Verify read on the two exact paths and denial on a sibling path.", @@ -54,6 +62,6 @@ "plan": "hub-public-resume-plan.json", "helper": "register_public_hub.py", "repositories": 31, - "status": "prepared and tested; not executed" + "status": "31 registrations applied, readback verified, hosted public capabilities verified, login session revoked" } }