feat(verify): add revision-bound capability evidence matrix

.github/workflows/house-style.yml

@@ -39,3 +39,8 @@ jobs:
         run: node marketplace/marketplace.test.js
       - name: Search ranking and escaping
         run: node search/search.test.js
+
+      - name: Capability evidence rendering and freshness
+        run: |
+          node --test scripts/render-capabilities.test.mjs
+          node scripts/render-capabilities.mjs --check

data/capabilities.json

@@ -0,0 +1,38 @@
+{
+  "reviewed_at": "2026-10-21",
+  "entries": [
+    {
+      "project": "cA2A",
+      "repository": "ca2a",
+      "capability": "Compare the official A2A TCK baseline with the extension enabled",
+      "revision": "d312e90307c0fe679101afb28a43a6d19554d3f0",
+      "pull_request": 266,
+      "run": 39665799848,
+      "evidence_class": "synthetic",
+      "result": "Paired TCK runs passed 79 tests each; protected handlers were not invoked.",
+      "limits": "Draft, unmerged implementation. Each run skipped 156 tests and deselected 30. This is bounded interoperability evidence, not full TCK conformance or live deployment acceptance."
+    },
+    {
+      "project": "TRACE Registry",
+      "repository": "trace-registry",
+      "capability": "Persist witness publication intent and fail closed on journal recovery errors",
+      "revision": "e70c10c05ab2b0c4f482d65332d0b8a91fc5882b",
+      "pull_request": 144,
+      "run": 39665123383,
+      "evidence_class": "synthetic",
+      "result": "The 413-test suite passed, including seven new durable-journal regression tests.",
+      "limits": "Draft, unmerged implementation. No live witness deployment or automated retry reconciliation is demonstrated; witness policy remains an operator decision."
+    },
+    {
+      "project": "Telemetry",
+      "repository": "agentrust-telemetry",
+      "capability": "Exercise Python and TypeScript exporters through a real OpenTelemetry Collector",
+      "revision": "27141868bbe729c23ddd97a99aa19fe43251cc59",
+      "pull_request": 100,
+      "run": 39665486568,
+      "evidence_class": "synthetic",
+      "result": "Twelve collector cases passed across healthy delivery, 503, lost acknowledgement, partial success, duplicate replay and restart.",
+      "limits": "Draft, unmerged implementation. Inputs and backend are synthetic. Row-count checks and backend deduplication do not prove exactly-once delivery, full projection fidelity, queue saturation or in-flight restart behavior."
+    }
+  ]
+}

scripts/render-capabilities.mjs

@@ -0,0 +1,56 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { pathToFileURL } from 'node:url';
+
+const start = '<!-- capabilities:start -->';
+const end = '<!-- capabilities:end -->';
+const escape = value => String(value).replaceAll('&', '&amp;').replaceAll('<', '&lt;')
+  .replaceAll('>', '&gt;').replaceAll('"', '&quot;').replaceAll("'", '&#39;');
+
+export function render(data) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(data.reviewed_at) || !Array.isArray(data.entries) || !data.entries.length) {
+    throw new Error('A dated, nonempty evidence inventory is required');
+  }
+  const seen = new Set();
+  const rows = data.entries.map(item => {
+    for (const field of ['project', 'capability', 'result', 'limits']) {
+      if (typeof item[field] !== 'string' || !item[field].trim()) throw new Error(`Missing ${field}`);
+    }
+    if (!/^[a-z0-9-]+$/.test(item.repository) || !/^[a-f0-9]{40}$/.test(item.revision)
+        || !Number.isSafeInteger(item.run) || item.run <= 0
+        || !Number.isSafeInteger(item.pull_request) || item.pull_request <= 0
+        || !['synthetic', 'captured', 'live'].includes(item.evidence_class)) throw new Error('Invalid evidence reference');
+    const key = `${item.repository}:${item.capability}`;
+    if (seen.has(key)) throw new Error('Duplicate capability');
+    seen.add(key);
+    const repo = `https://github.com/agentrust-io/${item.repository}`;
+    return `<tr><th scope="row">${escape(item.project)}</th><td>${escape(item.capability)}<br><a href="${repo}/tree/${item.revision}">Source ${item.revision.slice(0, 12)}</a><br><a href="${repo}/pull/${item.pull_request}">Draft PR #${item.pull_request}</a></td><td>${escape(item.evidence_class)}<br>${escape(item.result)}<br><a href="${repo}/actions/runs/${item.run}">Executable CI run</a></td><td>${escape(item.limits)}</td></tr>`;
+  });
+  return `${start}
+<section id="capability-evidence">
+  <span class="label">Evidence inventory</span>
+  <h2>Capabilities under review</h2>
+  <p>Selected contributions with revision-specific execution evidence, reviewed ${escape(data.reviewed_at)}. These are draft implementations, not a released-product support matrix. Follow each pull request for current status.</p>
+  <p>Synthetic means controlled fixtures or workloads; captured means previously collected evidence; live means a documented live operation. A real collector does not make its synthetic workload live evidence. Missing rows mean not assessed here, not unsupported.</p>
+  <div role="region" aria-label="Capability evidence table" tabindex="0" style="overflow-x:auto">
+    <table><caption>Bounded test results and limitations</caption><thead><tr><th scope="col">Project</th><th scope="col">Capability and source</th><th scope="col">Validation evidence</th><th scope="col">Limits</th></tr></thead><tbody>
+${rows.join('\n')}
+    </tbody></table>
+  </div>
+  <p>Run artifacts can expire. A passing run supports its recorded scope only; it does not establish conformance, production acceptance or hardware provenance. Canonical requirements remain in each project's specification.</p>
+</section>
+${end}`;
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  const root = new URL('../', import.meta.url);
+  const data = JSON.parse(await readFile(new URL('data/capabilities.json', root), 'utf8'));
+  const pageUrl = new URL('verify/index.html', root);
+  const page = await readFile(pageUrl, 'utf8');
+  if (page.split(start).length !== 2 || page.split(end).length !== 2) throw new Error('Expected one marker pair');
+  const first = page.indexOf(start), last = page.indexOf(end);
+  if (last < first) throw new Error('Reversed markers');
+  const output = page.slice(0, first) + render(data) + page.slice(last + end.length);
+  if (process.argv.includes('--check')) {
+    if (page !== output) throw new Error('Capability table is stale; run node scripts/render-capabilities.mjs');
+  } else await writeFile(pageUrl, output);
+}

scripts/render-capabilities.test.mjs

@@ -0,0 +1,28 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { render } from './render-capabilities.mjs';
+const example = () => ({ reviewed_at: '2026-10-21', entries: [{
+  project: '<script>alert(1)</script>', repository: 'ca2a', capability: 'Compare A & B',
+  revision: 'a'.repeat(40), pull_request: 1, run: 2, evidence_class: 'synthetic',
+  result: 'Passed bounded suite', limits: 'Not production acceptance',
+}] });
+test('escape content and pin source/run links', () => {
+  const html = render(example());
+  assert.ok(html.includes('&lt;script&gt;'));
+  assert.ok(!html.includes('<script>'));
+  assert.ok(html.includes(`/tree/${'a'.repeat(40)}`));
+  assert.ok(html.includes('/actions/runs/2'));
+  assert.ok(html.includes('scope="row"'));
+});
+test('reject missing limits, mutable revisions and unsafe references', () => {
+  for (const [field, value] of [['limits', ''], ['revision', 'main'],
+    ['repository', 'x/../../evil'], ['run', -1], ['evidence_class', 'verified']]) {
+    const data = example(); data.entries[0][field] = value;
+    assert.throws(() => render(data));
+  }
+});
+test('reject duplicate entries and undated snapshots', () => {
+  const data = example(); data.entries.push(data.entries[0]);
+  assert.throws(() => render(data));
+  assert.throws(() => render({ ...example(), reviewed_at: '' }));
+});

verify/index.html

@@ -208,6 +208,23 @@ <h2>A port, held to its original</h2>
   <p class="hint">A genuine quote prints <code>True</code>.</p>
 </section>
 
+<!-- capabilities:start -->
+<section id="capability-evidence">
+  <span class="label">Evidence inventory</span>
+  <h2>Capabilities under review</h2>
+  <p>Selected contributions with revision-specific execution evidence, reviewed 2026-10-21. These are draft implementations, not a released-product support matrix. Follow each pull request for current status.</p>
+  <p>Synthetic means controlled fixtures or workloads; captured means previously collected evidence; live means a documented live operation. A real collector does not make its synthetic workload live evidence. Missing rows mean not assessed here, not unsupported.</p>
+  <div role="region" aria-label="Capability evidence table" tabindex="0" style="overflow-x:auto">
+    <table><caption>Bounded test results and limitations</caption><thead><tr><th scope="col">Project</th><th scope="col">Capability and source</th><th scope="col">Validation evidence</th><th scope="col">Limits</th></tr></thead><tbody>
+<tr><th scope="row">cA2A</th><td>Compare the official A2A TCK baseline with the extension enabled<br><a href="https://github.com/agentrust-io/ca2a/tree/d312e90307c0fe679101afb28a43a6d19554d3f0">Source d312e90307c0</a><br><a href="https://github.com/agentrust-io/ca2a/pull/266">Draft PR #266</a></td><td>synthetic<br>Paired TCK runs passed 79 tests each; protected handlers were not invoked.<br><a href="https://github.com/agentrust-io/ca2a/actions/runs/39665799848">Executable CI run</a></td><td>Draft, unmerged implementation. Each run skipped 156 tests and deselected 30. This is bounded interoperability evidence, not full TCK conformance or live deployment acceptance.</td></tr>
+<tr><th scope="row">TRACE Registry</th><td>Persist witness publication intent and fail closed on journal recovery errors<br><a href="https://github.com/agentrust-io/trace-registry/tree/e70c10c05ab2b0c4f482d65332d0b8a91fc5882b">Source e70c10c05ab2</a><br><a href="https://github.com/agentrust-io/trace-registry/pull/144">Draft PR #144</a></td><td>synthetic<br>The 413-test suite passed, including seven new durable-journal regression tests.<br><a href="https://github.com/agentrust-io/trace-registry/actions/runs/39665123383">Executable CI run</a></td><td>Draft, unmerged implementation. No live witness deployment or automated retry reconciliation is demonstrated; witness policy remains an operator decision.</td></tr>
+<tr><th scope="row">Telemetry</th><td>Exercise Python and TypeScript exporters through a real OpenTelemetry Collector<br><a href="https://github.com/agentrust-io/agentrust-telemetry/tree/27141868bbe729c23ddd97a99aa19fe43251cc59">Source 27141868bbe7</a><br><a href="https://github.com/agentrust-io/agentrust-telemetry/pull/100">Draft PR #100</a></td><td>synthetic<br>Twelve collector cases passed across healthy delivery, 503, lost acknowledgement, partial success, duplicate replay and restart.<br><a href="https://github.com/agentrust-io/agentrust-telemetry/actions/runs/39665486568">Executable CI run</a></td><td>Draft, unmerged implementation. Inputs and backend are synthetic. Row-count checks and backend deduplication do not prove exactly-once delivery, full projection fidelity, queue saturation or in-flight restart behavior.</td></tr>
+    </tbody></table>
+  </div>
+  <p>Run artifacts can expire. A passing run supports its recorded scope only; it does not establish conformance, production acceptance or hardware provenance. Canonical requirements remain in each project's specification.</p>
+</section>
+<!-- capabilities:end -->
+
 </main>
 
 <footer class="site-footer"><div class="wrap">