CAPABILITY — retained instrument standing v1

A capability family makes a small set of retained instruments findable without turning the Library into a second CLI registry or claiming that source existence equals support.

CAPABILITY = purpose + standing + mouth + implementation + evidence + observations + reason + route + authority

Package

library/capabilities/<family>/
  README.md          # why these instruments belong together
  capabilities.json # explicit, checked records

The JSON contract is catalog/capability.schema.json. Its format is corpus-library-capability-family/v1. Discovery is explicit: a loose source symbol or a README without this manifest is not enrolled.

Canonical identity

The stable identity of an enrolled capability is <family-slug>/<capability-slug>, not its implementation path or symbol. Both parts stay human-readable; no database UUID is needed. A correctly repointed move — the manifest’s implementation or public_mouth changed to follow the code — keeps the same canonical ID. The checker refuses a duplicate canonical ID and refuses a bare capability slug that names more than one canonical ID; such a slug stops being a safe convenience alias and must be addressed by its full family/slug form. Exact where packets, the rendered shelf, and library_catalog.py capabilities all expose the canonical ID.

python corpus.py where tools lists enrolled live instruments. The fuller python house/offices/archivist/library_catalog.py capabilities view also shows cold standing such as shelved and superseded.

Standing

• shipped means a public command mouth exists and its exact --help probe succeeds.
• internal means retained implementation with no promised public mouth.
• candidate means an implemented trial authorized by a nonterminal REQ; a PROP, source symbol, or merely resolving object does not earn it.
• shelved means the implementation is deliberately not the working route.
• superseded means another named route displaced it.

Every record names a repo-contained Python implementation and top-level symbol. The checker parses that file without importing it. A shipped record additionally names its command token array; the checker verifies it against static parser and command declarations. It never launches help, imports enrolled code, or calls the capability action.

Each evidence pointer has explicit expected lifecycle observations. Shipped standing requires a fulfilled REQ, complete CHANGE, and closed successful review TRACE. Superseded standing names an accepted successor. Drift is reported; the Library never updates or promotes standing.

Non-shipped records do not get a decorative public mouth. They must explain why they remain and name a reopen, replace, or remove route. If that route targets a Corpus object, the object must resolve in the owning store.

When ADOPT is complete

Under CHANGE-048, Troll’s ADOPT class says a reusable instrument belongs in durable source. It is not a product Pass and does not by itself earn shipped standing or a public mouth.

For the capability shelf, an adopted instrument has not finished crossing until:

• its durable implementation and focused test are tracked;
• one capability record names its purpose, standing, evidence, continuation route, and authority;
• library_catalog.py capabilities accepts the record; and
• python corpus.py where <capability-slug> resolves it.

A true one-shot does not enroll. A retained instrument does. This keeps discovery attached to the adoption cut instead of asking a later folk to infer live standing from source existence.

Discovery seam

python corpus.py where tools is the retained live shelf, not a filesystem glob. Its top-level-census route uses tool_inventory.py for the direct tools/*.py scope accepted at REQ-260. tag-health runs the existing ops_tools_tag_check.py policy gate for an OPS MAP plus at least one real @ops.section. audit-candidates intersects that policy result with top-level main entrypoints that Scout does not observe corpus.py importing and absence from every capability manifest. The result is a review queue, not proof that each row should enroll. Its structural-atlas route uses scout_semantic_inventory.py, whose default active roots recursively cover corpus.py and tools/**. widen-atlas passes --active-root . to observe repository-wide Python subject to Scout’s declared exclusions. That wider view also contains tests, source caches, and room-local scripts; it produces candidates, not a list of Corpus tools.

OPS MAP and @ops.section tags make source addressable; they do not declare a module reusable, retained, shipped, or current. A kind=novel_tool FIND with an exact tool_path supplies creation provenance. A capability record supplies retained standing. Office-local instruments outside Scout’s default roots need that explicit enrollment too; source placement is not a reason to disappear.

Authority boundary

The capability shelf answers “what usable or deliberately retained instrument do we have, what is its honest standing, and where should work continue?” It does not own CLI dispatch, source, proposal status, acceptance, or lifecycle. Those authorities remain in the shipped help tree, Git/source, and Corpus objects.

The first family was the bounded REQ-366 vertical derived from FIND-812: four session-preservation records, and for a time the only family the checker would accept. archivist-instruments joined it on 2026-08-29, holding the two instruments that office uses on a live day.

Enrollment is still earned, not assumed. What earns it is the per-record warranty above — a resolving implementation symbol, a static mouth, evidence with lifecycle observations — not a decision that a family may exist. Standing does the rest of the work: shelved and superseded records stay here as honest history, and a shelf that lists everything present is worth less than one that says which things are alive.