feat(reproduce): index every capability card against a run of the profile (Refs #989)

.github/workflows/reproduce.yml

@@ -6,7 +6,8 @@ name: Reproduce the headless profile
 # empty directory and setup-zig keeps no cache, so nothing built before is reused.
 # The record of the run -- each command with its exit code, the compile failures by
 # root, the run steps, every compiled test root and every install with its sha256 --
-# is uploaded as the artifact reproduce-headless-<arch>.
+# is uploaded as the artifact reproduce-headless-<arch>, with the capability index of
+# tools/capabilities.py built on it (capabilities-<arch>.json, and a table in the job summary).
 
 on:
   pull_request:
@@ -18,6 +19,8 @@ on:
       - "external/**"
       - "deploy/**/*.zig"
       - "tools/reproduce.py"
+      - "tools/capabilities.py"
+      - "tools/contracts.py"
       - "specs/reproduce/**"
       - ".github/workflows/reproduce.yml"
   push:
@@ -61,6 +64,15 @@ jobs:
       - name: Build and test the headless profile with fresh caches
         run: python3 tools/reproduce.py headless --out reproduce-headless.json
 
+      # Every S01 capability card held to this run: measured (installs hashed, test roots passed,
+      # acceptance commands run), blocked (each in KNOWN_BLOCKED with its reason) or excluded with
+      # its reason -- specs/reproduce/capabilities.t27. The table goes to the job summary.
+      - name: Negative control of the capability index
+        run: python3 tools/capabilities.py --self-check
+
+      - name: Index the capabilities against this run
+        run: python3 tools/capabilities.py index --record reproduce-headless.json --out capabilities-${{ matrix.arch }}.json --summary "$GITHUB_STEP_SUMMARY"
+
       - name: Upload the record
         if: always()
         uses: actions/upload-artifact@v4
@@ -71,4 +83,5 @@ jobs:
           path: |
             reproduce-headless.json
             reproduce-headless.*.log
+            capabilities-*.json
           if-no-files-found: error

specs/reproduce/capabilities.t27

@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: Apache-2.0
+; specs/reproduce/capabilities.t27 -- how this repository measures each capability card of S01
+; S12 of gHashTag/trinity#988 (gHashTag/trinity#989): publish a machine-readable capability -> spec ->
+; artifact -> build/test -> evidence index, with every capability measured complete, explicitly blocked
+; or intentionally excluded with a reason, and no coverage figure taken from catalog counts. The cards
+; are t27's (external/t27, locked byte for byte by specs/reproduce/contracts.t27) and are not restated
+; here: this module is only the measuring -- which acceptance commands tools/capabilities.py runs, which
+; it does not and why, and which capabilities are known to be blocked, each with what blocks it.
+; A headless card with an ACCEPTANCE is in exactly one place: the profile's own commands (BUILD or TEST
+; of specs/reproduce/headless.t27, measured by the record of a headless run), RUN, or NOT_RUN. A card in
+; none of them, or in two, fails the index; so does a name here that is no card.
+; Not a claim that a capability works beyond what its row says was measured.
+; ASCII only (L3). phi^2 + 1/phi^2 = 3 | TRINITY
+
+module reproduce_capabilities;
+
+pub const KIND : str = "capability-index";
+pub const ID : str = "reproduce/capabilities";
+; Run as the card writes the command, with -Dci=true added to every `zig build` in it (the cards are
+; headless, and the headless profile is -Dci=true), stdin closed, at most RUN_TIMEOUT_S seconds each.
+; A tracked file the command changes is recorded with the run and restored after it.
+pub const RUN : [11]str = [
+    "trinity/abi.c-api",
+    "trinity/agent.phi-loop",
+    "trinity/cli.tri",
+    "trinity/convert.b2t",
+    "trinity/examples.zig",
+    "trinity/llm.firebird",
+    "trinity/mcp.needle-mcp",
+    "trinity/mcp.trinity-mcp",
+    "trinity/queen.lib",
+    "trinity/registry.commands",
+    "trinity/vibee.compiler"
+];
+pub const RUN_TIMEOUT_S : u32 = 600;
+pub const NOT_RUN : [3]str = ["trinity/agent.tri-api", "trinity/bot.tri-bot", "trinity/node.trinity-node"];
+pub const NOT_RUN_REASONS : [3]str = [
+    "zig build tri-api runs the agent against the Anthropic API, which needs a key; the build and install of exe:tri-api are what is measured",
+    "zig build tri-bot runs the Telegram bot until it is stopped, which needs a token; the build and install of exe:tri-bot are what is measured",
+    "zig build node runs the inference node until it is stopped; the build and install of exe:trinity-node are what is measured"
+];
+; Capabilities known to be blocked, and what blocks each. One that measures complete fails the index
+; until its line is removed, and one that is blocked and not here fails it too.
+pub const KNOWN_BLOCKED : [3]str = ["trinity/mcp.needle-mcp", "trinity/mcp.trinity-mcp", "trinity/registry.commands"];
+pub const KNOWN_BLOCKED_REASONS : [3]str = [
+    "zig build needle-mcp: there is no such step -- build.zig comments it out (around line 1507), and the S01 inventory counts it because tools/trinity_manifest.py does not skip // lines",
+    "zig build trinity-mcp: there is no such step -- build.zig comments it out (around line 1551), as for needle-mcp",
+    "zig build export-registry && git diff --exit-code .trinity/registry.json cannot pass: the export writes the time it ran into generated_at"
+];
+; Findings of the S01 checker that are drift since the inventory S01 pinned (gHashTag/trinity@976df517)
+; and are reported, not failed: the pin itself, and the counts of a tree that kept growing.
+pub const DRIFT_CODES : [2]str = ["PIN_MISMATCH", "COUNT_MISMATCH"];
+; Dispositions whose cards are excluded from measuring by what they are, with the card's own reason.
+pub const EXCLUDED_DISPOSITIONS : [4]str = ["deprecated", "out-of-scope", "catalog-only", "external"];
+pub const ENABLED : bool = true;
+
+test the_plan_is_whole {
+    assert KIND == "capability-index";
+    assert RUN_TIMEOUT_S == 600;
+}