# L1 capability harness

Runs black-box capability checks through either legacy or platform dialect. Runtime reports are written to `tests/capability/reports/<adapter>.{json,md}` and are intentionally ignored.

## Commands

```bash
npm run test:capability -- --adapter=legacy
BASE_URL=https://worker.example PLATFORM_API_KEY=prefix.secret npm run test:capability -- --adapter=platform
```

Legacy credentials resolve from `LEGACY_API_KEY`/`API_KEY`, then from `ipz_api_key` in the `devzone-db` container. The runner loads missing variables from gitignored `./.env.capability`. CAP-16/CAP-17 require `LEGACY_ORACLE_DB_HOST`; only the legacy adapter inserts namespaced users, subscriptions, API keys, and credit allocations directly through the oracle PostgreSQL container, then deletes each fixture account in cleanup. Platform fixtures remain API-only.

Callback delivery uses a local collector exposed through a public tunnel:

```bash
npm run capability:callback-collector
cloudflared tunnel --url http://127.0.0.1:8788
CAPABILITY_CALLBACK_URL=https://<tunnel>/callback CAPABILITY_CALLBACK_INSPECT_URL=http://127.0.0.1:8788/capture CAPABILITY_CALLBACK_SECRET=<runtime-secret> npm run test:capability -- --adapter=legacy
```

Missing callback reachability reports `BLOCKED-ON-INFRA`; target capability absence alone reports `NOT-IMPLEMENTED`. Every non-PASS report row names its unearned MR gates.