{
  "capabilities": [
    {
      "id": "files/directory-snapshot-report",
      "name": "List two directories side by side, and record the comparison",
      "provider": "files",
      "description": "Lists two directories in one workflow — a \"current state\" directory and a \"reference/archive\" directory — then writes both listings into a single report file. Where every other `files` capability in this folder operates on one location, this one is the multi-location shape: useful for a recurring check like \"does this release's output directory still look like the last known-good one,\" without the runtime doing any diffing itself — it only gathers what's actually on disk into one place for a human or AI to compare.",
      "path": "capabilities/files/directory-snapshot-report.md"
    },
    {
      "id": "files/incident-log-lifecycle",
      "name": "Open an incident log, add an update, then review it",
      "provider": "files",
      "description": "The full non-destructive lifecycle of a single file in one workflow: **create** it (`write`), **update** it (`append`), then **review** it (`read`) — three different operations chained on one `path`, the one combination neither `notes-roundtrip.md` (`write`+`read`) nor `log-rotate.md` (`append`+`list`) demonstrates by itself.",
      "path": "capabilities/files/incident-log-lifecycle.md"
    },
    {
      "id": "files/log-rotate",
      "name": "Append to a log file, then confirm it via a directory listing",
      "provider": "files",
      "description": "Exercises the two `files` operations `notes-roundtrip.md` doesn't cover (`append`, `list`) — between the two capabilities in this folder, every non-destructive `files` operation has a checked-in, runnable example. Still auth-free, like every `files` capability.",
      "path": "capabilities/files/log-rotate.md"
    },
    {
      "id": "files/notes-roundtrip",
      "name": "Write and read back a notes file",
      "provider": "files",
      "description": "A minimal, auth-free capability (the `files` provider declares no auth provider) useful for proving the capability execution path end-to-end without any credentials configured.",
      "path": "capabilities/files/notes-roundtrip.md"
    },
    {
      "id": "files/scaffold-service-docs",
      "name": "Scaffold starter docs for a new service directory",
      "provider": "files",
      "description": "Bootstraps the three starter documents most new service/project directories need on day one, then lists the directory to confirm all three landed. Unlike `notes-roundtrip.md` and `log-rotate.md`, which each touch a single `path`, this capability writes to **three different paths** in one workflow — the shape worth exercising when a capability's job is \"create a set of files,\" not \"operate on one already-known file.\"",
      "path": "capabilities/files/scaffold-service-docs.md"
    },
    {
      "id": "github/github-access-review",
      "name": "Access review — who can do what",
      "provider": "github",
      "description": "Produce least-privilege evidence for an org/team/repo: org admins, outside collaborators, pending invitations, one team's members and repos, a repository's direct collaborators and teams, plus that user's effective permission on the repo. Read-only — default policy denies `api DELETE`, so revocation stays a separate, deliberate action.",
      "path": "capabilities/github/github-access-review.md"
    },
    {
      "id": "github/github-actions-run-inspect",
      "name": "List recent Actions runs, then inspect one by ID",
      "provider": "github",
      "description": "Exercises `run list` and `run view` together. `run list` alone is already covered by `github-repo-health.md`; `run view` — drilling into one specific run's status, conclusion, and job breakdown — isn't demonstrated anywhere yet.",
      "path": "capabilities/github/github-actions-run-inspect.md"
    },
    {
      "id": "github/github-branch-protection-audit",
      "name": "Branch protection audit — prove main cannot be force-pushed",
      "provider": "github",
      "description": "Fetch a branch's protection rules and the repository's rulesets. Answers \"is main protected / why could someone merge without approval?\" as read-only evidence. Setting or deleting protection is intentionally out of scope here (and `api DELETE` is denied by default policy anyway).",
      "path": "capabilities/github/github-branch-protection-audit.md"
    },
    {
      "id": "github/github-ci-failure-triage",
      "name": "CI failure triage — why is the build red?",
      "provider": "github",
      "description": "List recent failing Actions runs for a repository, then inspect one run (including failed-job logs). Answers \"why did the build fail?\" without fifteen browser tabs.",
      "path": "capabilities/github/github-ci-failure-triage.md"
    },
    {
      "id": "github/github-cli-issue-create",
      "name": "Create an issue via the GitHub CLI",
      "provider": "github",
      "description": "A raw Command Engine invocation (`binary: gh`) — the escape hatch for what the provider does not expose. Runs `gh issue create` against whichever repo `gh` is currently configured for. Requires `gh` to be installed and authenticated.",
      "path": "capabilities/github/github-cli-issue-create.md"
    },
    {
      "id": "github/github-cli-pr-list",
      "name": "List open pull requests via the GitHub CLI",
      "provider": "github",
      "description": "A raw Command Engine invocation (`binary: gh`) — the escape hatch for what the provider does not expose. Runs `gh pr list` against whichever repo `gh` is currently configured for (its own working-directory/remote resolution — the runtime does not inject a repo). Requires `gh` to be installed and authenticated.",
      "path": "capabilities/github/github-cli-pr-list.md"
    },
    {
      "id": "github/github-cli-repo-list",
      "name": "List repositories via the GitHub CLI",
      "provider": "github",
      "description": "A raw Command Engine invocation (`binary: gh`) — validated against `allowed_binaries`/`command_policy` rather than against the GitHub Provider's operation surface. The provider exposes a `repo list` operation that does the same job and lets the provider choose the transport; this file exists to demonstrate the escape hatch. Requires `gh` to be installed and authenticated.",
      "path": "capabilities/github/github-cli-repo-list.md"
    },
    {
      "id": "github/github-daily-digest",
      "name": "Daily GitHub digest",
      "provider": "github",
      "description": "A personal catch-up workflow: unread notifications, issues assigned to you across the active context's organization, and open pull requests via the GitHub CLI. No inputs. Requires `RUNTIME_GITHUB_TOKEN` to be exported and `gh` to be installed and authenticated.",
      "path": "capabilities/github/github-daily-digest.md"
    },
    {
      "id": "github/github-file-push",
      "name": "Push a new file to a repository",
      "provider": "github",
      "description": "Creates a file in a GitHub repository and commits it in one step — the \"drop this note into the repo\" workflow, without cloning anything.",
      "path": "capabilities/github/github-file-push.md"
    },
    {
      "id": "github/github-file-update",
      "name": "Update an existing file in a repository",
      "provider": "github",
      "description": "Replaces a file that already exists in a GitHub repository and commits the change. To create a file that isn't there yet, use [`github-file-push.md`](./github-file-push.md) — GitHub rejects a create that supplies a `sha`, and rejects an update that omits one.",
      "path": "capabilities/github/github-file-update.md"
    },
    {
      "id": "github/github-git-clone-commit-push",
      "name": "Clone a repository, add a file, commit and push",
      "provider": "github",
      "description": "The full git round trip through the runtime: clone, write a file with the File Engine, stage it, commit with a message, push. Every step is governed and audited; nothing runs outside the lifecycle.",
      "path": "capabilities/github/github-git-clone-commit-push.md"
    },
    {
      "id": "github/github-graphql-contributors-query",
      "name": "A custom GraphQL query the `graphql` escape hatch covers, that no curated operation does",
      "provider": "github",
      "description": "`repo summary` (see `github-repo-health.md`) is the **curated** GraphQL operation — a fixed, published query the provider maintains. This capability is the escape hatch next to it: `provider: github args: [graphql, \"\u003cquery\u003e\", key=value ...]` for a query no curated operation publishes yet — here, a repository's top contributors by commit count, which none of the curated operations expose.",
      "path": "capabilities/github/github-graphql-contributors-query.md"
    },
    {
      "id": "github/github-incident-what-changed",
      "name": "Incident forensics — what changed since T",
      "provider": "github",
      "description": "During an incident: commits since a timestamp, recently merged pull requests, recent deployments, and recent pushes to `main` via Actions. The \"what changed in the last N hours\" pack that pays for itself the first time it is used at 3am.",
      "path": "capabilities/github/github-incident-what-changed.md"
    },
    {
      "id": "github/github-issue-create-and-list",
      "name": "File an issue via the provider operation, then list it back",
      "provider": "github",
      "description": "Uses the **curated `issue create` operation** (`provider: github`), not the raw `binary: gh` escape hatch — the direct contrast to `github-cli-issue-create.md`, which pins the `gh` CLI transport deliberately as an escape-hatch demonstration. This file is the \"prefer the operation\" side of that same job: `issue create` and `issue list` are both `provider: github` steps, so the GitHub Provider — not this file — decides that both currently go through `gh` under the hood; that can change in a later runtime version without this capability needing an edit.",
      "path": "capabilities/github/github-issue-create-and-list.md"
    },
    {
      "id": "github/github-issues-list-for-org",
      "name": "List issues assigned to the user across the active context's organization",
      "provider": "github",
      "description": "Single-step capability wrapping the fixed `GET /orgs/{org}/issues` operation. The `{org}` segment resolves from the active Runtime Context's `github.organization`. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-issues-list-for-org.md"
    },
    {
      "id": "github/github-notifications-list",
      "name": "List the authenticated user's notifications",
      "provider": "github",
      "description": "Single-step capability wrapping the fixed `GET /notifications` Runtime Command. Useful as a quick \"what's waiting for me\" check. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-notifications-list.md"
    },
    {
      "id": "github/github-org-health-check",
      "name": "Organization health check",
      "provider": "github",
      "description": "Chains four read-only operations into a single snapshot of the active Runtime Context's GitHub organization: the orgs the token belongs to, the org's repositories, its teams, and issues assigned to the authenticated user across it. No inputs — every step resolves `{org}` from the active Runtime Context. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-org-health-check.md"
    },
    {
      "id": "github/github-org-repos-and-open-prs",
      "name": "List an organization's repositories and open pull requests",
      "provider": "github",
      "description": "Lists every repository in a GitHub organization via the REST API (a a provider operation), then lists open pull requests via the GitHub CLI (a raw Command Engine invocation). The clearest illustration of why the Runtime block grammar has two step shapes — both dispatch through the identical `Execute`/`RunCommand` lifecycle. Requires `RUNTIME_GITHUB_TOKEN` to be exported and `gh` to be installed and authenticated.",
      "path": "capabilities/github/github-org-repos-and-open-prs.md"
    },
    {
      "id": "github/github-organizations-list",
      "name": "List the authenticated user's organizations",
      "provider": "github",
      "description": "Single-step capability wrapping the fixed `GET /user/orgs` Runtime Command. No inputs — the organization list always comes from the authenticated token. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-organizations-list.md"
    },
    {
      "id": "github/github-pr-open-and-inspect",
      "name": "Open a pull request, then inspect it by number",
      "provider": "github",
      "description": "Exercises `pr create` and `pr view` — the two `pr`-family operations `github-repo-health.md` (`pr list`) and `github-cli-pr-list.md` (raw `binary: gh` escape hatch) don't cover between them.",
      "path": "capabilities/github/github-pr-open-and-inspect.md"
    },
    {
      "id": "github/github-release-cut",
      "name": "Cut a release with generated notes",
      "provider": "github",
      "description": "Generate release notes for a tag, create the GitHub Release from them, then list releases to verify. The generate/create steps use the Releases REST API via `api` (no curated `release create` operation yet); the verify step uses `binary: gh` because artifact-oriented release listing is still a `gh` strength the provider has not wrapped.",
      "path": "capabilities/github/github-release-cut.md"
    },
    {
      "id": "github/github-repo-bootstrap",
      "name": "Bootstrap a new repository and confirm it exists",
      "provider": "github",
      "description": "Creates a repository under the authenticated user's account via the REST API, then re-lists the user's repositories via the GitHub CLI as a confirmation step. Requires `RUNTIME_GITHUB_TOKEN` to be exported and `gh` to be installed and authenticated.",
      "path": "capabilities/github/github-repo-bootstrap.md"
    },
    {
      "id": "github/github-repo-health",
      "name": "Report a repository's health",
      "provider": "github",
      "description": "Pulls a single repository's headline numbers, its open pull requests, and its recent Actions runs.",
      "path": "capabilities/github/github-repo-health.md"
    },
    {
      "id": "github/github-repo-standards-audit",
      "name": "Repository standards audit",
      "provider": "github",
      "description": "Compliance snapshot for one repository: headline health (`repo summary`), community profile (README / LICENSE / CoC completeness), topics, and languages. Answers \"does this repo meet standard?\" before an audit or reorg.",
      "path": "capabilities/github/github-repo-standards-audit.md"
    },
    {
      "id": "github/github-repo-view",
      "name": "View a single repository's REST metadata",
      "provider": "github",
      "description": "The plainest possible demonstration of `repo view` — one `GET /repos/{owner}/{repo}` call, one step, no combination with anything else. Worth having as its own capability specifically to contrast with `repo summary`: `repo view` is the one-round-trip REST call for the raw repository object (visibility, default branch, fork/star counts as REST reports them, `pushed_at`, etc.); `repo summary` is the *curated* GraphQL call that additionally bundles open issue/PR counts and the latest release in that same round trip. Reach for `repo view` when you only need the repository object itself and don't want the extra GraphQL round trip's shape to deal with.",
      "path": "capabilities/github/github-repo-view.md"
    },
    {
      "id": "github/github-repositories-create",
      "name": "Create a repository under the authenticated user's account",
      "provider": "github",
      "description": "Single-step capability wrapping the fixed `POST /user/repos` Runtime Command. Every declared input becomes a `key=value` arg, which the REST Engine coerces into a JSON body field (`true`/`false`/numbers are coerced automatically). Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-repositories-create.md"
    },
    {
      "id": "github/github-repositories-list-for-org",
      "name": "List repositories for the active context's organization",
      "provider": "github",
      "description": "Single-step capability wrapping the fixed `GET /orgs/{org}/repos` operation. The `{org}` segment resolves automatically from the active Runtime Context's `github.organization` — no input needed. Use `runtime context show` / `runtime context set` to change which org this targets. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-repositories-list-for-org.md"
    },
    {
      "id": "github/github-repositories-list",
      "name": "List the authenticated user's repositories",
      "provider": "github",
      "description": "Single-step capability wrapping the fixed `GET /user/repos` Runtime Command. Lists every repository the authenticated user can see — personal and org-owned. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-repositories-list.md"
    },
    {
      "id": "github/github-repositories",
      "name": "Review an organization's repositories and open pull requests",
      "provider": "github",
      "description": "Lists every repository in a GitHub organization, then its open pull requests. Requires `RUNTIME_GITHUB_TOKEN` to be exported and `gh` to be installed — `gh auth login` is *not* needed, since the Command Engine forwards the token the Auth Engine already validated.",
      "path": "capabilities/github/github-repositories.md"
    },
    {
      "id": "github/github-request-create-issue",
      "name": "Create an issue on a specific repository",
      "provider": "github",
      "description": "Uses the generic `github.request` pass-through to file an issue via `POST /repos/{owner}/{repo}/issues`. `POST`/`PUT`/`PATCH` requests turn every `key=value` arg into a JSON request body field. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-request-create-issue.md"
    },
    {
      "id": "github/github-request-list-org-repos",
      "name": "List repositories for any GitHub organization",
      "provider": "github",
      "description": "Uses the generic `github.request` pass-through instead of `repo list` with an org argument so it can target *any* org by name — not just the one bound to the active Runtime Context. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-request-list-org-repos.md"
    },
    {
      "id": "github/github-request-list-repo-issues",
      "name": "List issues for a specific repository",
      "provider": "github",
      "description": "Uses the generic `github.request` pass-through to query a single repo's issues, filtered by `state`. `GET` requests turn every `key=value` arg into a query parameter. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-request-list-repo-issues.md"
    },
    {
      "id": "github/github-request-update-repo",
      "name": "Update a repository's description",
      "provider": "github",
      "description": "Uses the generic `github.request` pass-through to `PATCH /repos/{owner}/{repo}` with a new `description`. Requires `RUNTIME_GITHUB_TOKEN` to be exported, and write access to the target repository.",
      "path": "capabilities/github/github-request-update-repo.md"
    },
    {
      "id": "github/github-review-queue",
      "name": "Review queue — what needs my eyes, and what is going stale",
      "provider": "github",
      "description": "Daily review hygiene for one repository: pull requests waiting on me, then open non-draft PRs older than a cut-off date (stale queue). Both steps use the curated `pr list` operation with `gh`'s `--search` / `--json` surface — no transport named in the capability.",
      "path": "capabilities/github/github-review-queue.md"
    },
    {
      "id": "github/github-secrets-inventory",
      "name": "Secrets \u0026 variables inventory (metadata only)",
      "provider": "github",
      "description": "List which Actions secrets and variables exist for a repository, plus its environments. Names and metadata are readable; **values never are**, by GitHub's design — this is an inventory / rotation-planning report, not a secret dump.",
      "path": "capabilities/github/github-secrets-inventory.md"
    },
    {
      "id": "github/github-security-posture",
      "name": "Security posture — open vulnerability alerts for a repository",
      "provider": "github",
      "description": "Roll up the three alert surfaces GitHub exposes for one repository: Dependabot, code scanning, and secret scanning. Answers \"are we vulnerable / did anyone leak a secret?\" without opening three browser tabs.",
      "path": "capabilities/github/github-security-posture.md"
    },
    {
      "id": "github/github-service-onboarding",
      "name": "Golden-path service onboarding",
      "provider": "github",
      "description": "Stand up a new service repository that already meets org standards — create it, tag it, set merge policy, protect the default branch, grant a team write access, then check CODEOWNERS for errors. The \"golden path\" every platform team ends up writing by hand.",
      "path": "capabilities/github/github-service-onboarding.md"
    },
    {
      "id": "github/github-teams-list",
      "name": "List teams in the active context's organization",
      "provider": "github",
      "description": "Single-step capability wrapping the fixed `GET /orgs/{org}/teams` operation. The `{org}` segment resolves from the active Runtime Context's `github.organization`. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-teams-list.md"
    },
    {
      "id": "github/github-user-get",
      "name": "Get the authenticated GitHub user",
      "provider": "github",
      "description": "A minimal, single-step capability that calls the fixed `GET /user` operation. Useful as a credential smoke test — if this fails, no other `github.*` capability will work either. Requires `RUNTIME_GITHUB_TOKEN` to be exported.",
      "path": "capabilities/github/github-user-get.md"
    },
    {
      "id": "github/github-workflow-dispatch-and-list",
      "name": "Dispatch an Actions workflow, then list the workflow catalog",
      "provider": "github",
      "description": "Exercises `workflow run` and `workflow list` — the two `workflow`-family operations no other checked-in capability in this folder touches yet (`github-repo-health.md` and `github-daily-digest.md` both stop at `run list`/`run view`-adjacent territory, never `workflow`).",
      "path": "capabilities/github/github-workflow-dispatch-and-list.md"
    }
  ],
  "contract_version": "1.0",
  "counts": {
    "capabilities": 45,
    "providers": 2
  },
  "generated_at": "2026-08-06T05:41:37Z",
  "runtime": {
    "commit": "91572b30b6d494e3932f2c53a8e9a2c63f75662a",
    "known": true,
    "ref": "main",
    "repo": "engineering-runtime",
    "short_commit": "91572b3"
  },
  "source": "embed",
  "total": 45
}