Capabilities¶

Source of truth: src/assync/core/enums.py::Capability and HIGH_RISK_CAPABILITIES.

All capabilities¶

Capability	Value
Repository Read	`repository_read`
Repository Write	`repository_write`
Runtime Read	`runtime_read`
Runtime Write	`runtime_write`
Test Execute	`test_execute`
Analysis Execute	`analysis_execute`
Report Write	`report_write`
Finding Create	`finding_create`
Synthesis Create	`synthesis_create`
Decision Recommend	`decision_recommend`
Commit Prepare	`commit_prepare`
Commit Execute	`commit_execute`
Push Prepare	`push_prepare`
Push Execute	`push_execute`
PR Prepare	`pr_prepare`
PR Create	`pr_create`
Merge Prepare	`merge_prepare`
Merge Execute	`merge_execute`
Release Prepare	`release_prepare`
Release Execute	`release_execute`
Production Read	`production_read`
Production Write	`production_write`
Secret Read	`secret_read`

High-risk capabilities¶

These must never be inferred from a role title or granted implicitly by a mission's authorization type alone — only an explicit grant (role + mission + run, intersected) or a recorded human decision may enable them. No built-in role's allowed_capabilities may include any of these — roles/validation.py rejects a role registry that tries:

commit_execute
push_execute
pr_create
merge_execute
release_execute
production_write
secret_read

How a capability actually becomes available¶

effective = (role.allowed − role.forbidden)
          ∩ (authorization.permitted − authorization.prohibited)

See Authorization Model for the full rule, and Authorization Types for what each authorization type grants.