test: add capability admission control tests and structural guards

- test_codex_implementation_dispatch_infeasible: codex + implementation
  recipe reports dispatch_feasible=False with gate_backend_write infeasible
- test_claude_implementation_dispatch_feasible: claude-code backend
  reports dispatch_feasible=True
- test_dispatch_feasible_defaults_true: recipes without capability gates
  default to feasible
- E2E chain test verifies backend → load_and_validate → dispatch_feasible
- AST-level tests guard all four content-serving surfaces and the
  load_and_validate call site
- CAPABILITY_GATE_CALLABLES ↔ smoke_utils export sync test

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Trecek

tests/arch/AGENTS.md

@@ -17,6 +17,7 @@ AST enforcement, sub-package layer contracts, and architectural invariant tests.
 | `test_backend_flag_isolation.py` | AST guard: ClaudeFlags must not appear in _session_launch.py — backend-specific flags belong inside each backend's build_interactive_cmd() |
 | `test_backend_coherence.py` | Architectural tests for backend coherence enforcement |
 | `test_canonical_constant_consumption.py` | Architectural invariant: every *_ENV_FORWARD_VARS constant must have a production consumer |
+| `test_capability_admission_control.py` | Architectural structural tests for capability admission control: dispatch_feasible gating on all four content-serving surfaces, _compute_capability_feasibility call in load_and_validate, CAPABILITY_GATE_CALLABLES/BACKEND_CAPABILITY_INGREDIENTS registry sync |
 | `test_backend_name_sync.py` | Architectural invariant: KNOWN_BACKEND_NAMES (IL-0) must match BACKEND_REGISTRY keys (IL-1) |
 | `test_capability_consistency.py` | Behavioral arch tests: BackendCapabilities filesystem consistency — applicable guards exist on disk, required session files are created, session_dir_symlinks entries are symlinks |
 | `test_cross_registry_dispatch_sufficiency.py` | Cross-registry dispatch sufficiency: real HOOK_REGISTRY × real BackendCapabilities — detects fix-required hooks that would brick backends with insufficient applicable_guards |

tests/arch/test_capability_admission_control.py

@@ -0,0 +1,111 @@
+"""Architectural structural tests for capability admission control.
+
+Verifies that:
+- _compute_capability_feasibility is called inside load_and_validate
+- All four content-serving surfaces gate on dispatch_feasible
+- CAPABILITY_GATE_CALLABLES entries have a corresponding BACKEND_CAPABILITY_INGREDIENTS input
+- Every run_python step using a CAPABILITY_GATE_CALLABLES callable reads a capability ingredient
+"""
+
+from __future__ import annotations
+
+import ast
+
+import pytest
+
+from tests.arch._helpers import SRC_ROOT
+
+pytestmark = [pytest.mark.layer("arch"), pytest.mark.small]
+
+
+def _has_call_in_function(tree: ast.Module, func_name: str, target_call: str) -> bool:
+    """Return True if the named function contains a call to target_call."""
+    for node in ast.walk(tree):
+        if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            if node.name != func_name:
+                continue
+            for child in ast.walk(node):
+                if (
+                    isinstance(child, ast.Call)
+                    and isinstance(child.func, ast.Name)
+                    and child.func.id == target_call
+                ):
+                    return True
+    return False
+
+
+def test_load_and_validate_calls_compute_capability_feasibility() -> None:
+    """load_and_validate must invoke _compute_capability_feasibility."""
+    api_path = SRC_ROOT / "recipe" / "_api.py"
+    tree = ast.parse(api_path.read_text(encoding="utf-8"))
+    assert _has_call_in_function(tree, "load_and_validate", "_compute_capability_feasibility"), (
+        "load_and_validate must call _compute_capability_feasibility "
+        "to detect DOA pipelines from capability-gated run_python steps."
+    )
+
+
+def test_open_kitchen_gates_on_dispatch_feasible() -> None:
+    """open_kitchen must check dispatch_feasible before enabling the gate."""
+    kitchen_path = SRC_ROOT / "server" / "tools" / "tools_kitchen.py"
+    src = kitchen_path.read_text(encoding="utf-8")
+    tree = ast.parse(src)
+    for node in ast.walk(tree):
+        if isinstance(node, ast.AsyncFunctionDef) and node.name == "open_kitchen":
+            src_dispatch_feasible = False
+            for child in ast.walk(node):
+                if isinstance(child, ast.Constant) and child.value == "dispatch_feasible":
+                    src_dispatch_feasible = True
+                    break
+            assert src_dispatch_feasible, (
+                "open_kitchen must reference 'dispatch_feasible' to gate "
+                "capability-DOA pipelines before revealing tools."
+            )
+            return
+    pytest.fail("open_kitchen function not found in tools_kitchen.py")
+
+
+def test_get_recipe_gates_on_dispatch_feasible() -> None:
+    """get_recipe resource must check dispatch_feasible."""
+    kitchen_path = SRC_ROOT / "server" / "tools" / "tools_kitchen.py"
+    src = kitchen_path.read_text(encoding="utf-8")
+    assert "dispatch_feasible" in src, (
+        "get_recipe resource must reference 'dispatch_feasible' to gate "
+        "capability-DOA recipe serving."
+    )
+
+
+def test_load_recipe_gates_on_dispatch_feasible() -> None:
+    """load_recipe tool must check dispatch_feasible."""
+    recipe_path = SRC_ROOT / "server" / "tools" / "tools_recipe.py"
+    src = recipe_path.read_text(encoding="utf-8")
+    assert "dispatch_feasible" in src, (
+        "load_recipe tool must reference 'dispatch_feasible' to surface "
+        "capability-DOA signal to calling orchestrators."
+    )
+
+
+def test_capability_gate_callables_have_matching_ingredient() -> None:
+    """Every CAPABILITY_GATE_CALLABLES callable must map to a BACKEND_CAPABILITY_INGREDIENTS input.
+
+    This guards against adding a new gate callable without declaring its
+    capability ingredient dependency.
+    """
+    import autoskillit.smoke_utils as smoke_utils_mod
+    from autoskillit.core import BACKEND_CAPABILITY_INGREDIENTS, CAPABILITY_GATE_CALLABLES
+
+    for callable_name in CAPABILITY_GATE_CALLABLES:
+        assert hasattr(smoke_utils_mod, callable_name), (
+            f"CAPABILITY_GATE_CALLABLES entry {callable_name!r} has no matching "
+            f"callable in autoskillit.smoke_utils."
+        )
+        assert callable_name in smoke_utils_mod.__all__, (
+            f"CAPABILITY_GATE_CALLABLES entry {callable_name!r} is not exported "
+            f"via smoke_utils.__all__."
+        )
+
+    assert len(BACKEND_CAPABILITY_INGREDIENTS) > 0, (
+        "BACKEND_CAPABILITY_INGREDIENTS must declare at least one capability ingredient key."
+    )
+    assert len(CAPABILITY_GATE_CALLABLES) > 0, (
+        "CAPABILITY_GATE_CALLABLES must declare at least one capability gate callable."
+    )

tests/recipe/test_bundled_recipes_dispatch_ready.py

@@ -258,3 +258,48 @@ def test_card_and_semantic_rules_agree_on_errors(recipe_name: str, tmp_path: Pat
         f"Card-only: {contract_error_steps - semantic_error_steps}, "
         f"Semantic-only: {semantic_error_steps - contract_error_steps}"
     )
+
+
+# ---------------------------------------------------------------------------
+# Capability-admission-control feasibility signal
+# ---------------------------------------------------------------------------
+
+
+def test_codex_implementation_dispatch_infeasible() -> None:
+    """Codex backend + implementation recipe must report dispatch_feasible=False.
+
+    gate_backend_write routes to terminal failure when backend_capable=false.
+    """
+    result = load_and_validate(
+        "implementation",
+        project_dir=_PROJECT_ROOT,
+        ingredient_overrides={"backend_supports_git_write": "false"},
+        backend_name="codex",
+    )
+    assert result["valid"] is True  # recipe is structurally valid
+    assert result.get("dispatch_feasible") is False  # but pipeline is DOA
+    assert "gate_backend_write" in result.get("infeasible_steps", [])
+
+
+def test_claude_implementation_dispatch_feasible() -> None:
+    """Claude Code backend + implementation recipe must report dispatch_feasible=True."""
+    result = load_and_validate(
+        "implementation",
+        project_dir=_PROJECT_ROOT,
+        ingredient_overrides={"backend_supports_git_write": "true"},
+        backend_name="claude-code",
+    )
+    assert result["valid"] is True
+    assert result.get("dispatch_feasible") is True
+
+
+def test_dispatch_feasible_defaults_true_for_recipes_without_capability_gates() -> None:
+    """Recipes that do not use capability-gated run_python steps should
+    default to dispatch_feasible=True regardless of backend overrides."""
+    result = load_and_validate(
+        "implementation",
+        project_dir=_PROJECT_ROOT,
+        ingredient_overrides={"backend_supports_git_write": "true"},
+    )
+    assert result.get("dispatch_feasible") is True
+    assert "infeasible_steps" not in result

tests/server/AGENTS.md

@@ -10,6 +10,7 @@ Server tool handler unit tests — kitchen, execution, CI, clone, workspace tool
 | `_helpers.py` | Shared test builder utilities for tests/server/ |
 | `_type_coercion_fixtures.py` | Test fixtures for _import_and_call annotation-aware type coercion |
 | `conftest.py` | Shared fixtures for tests/server/ |
+| `test_capability_admission_e2e.py` | End-to-end chain tests for capability admission control: backend → load_and_validate → dispatch_feasible signal |
 | `test_editable_guard.py` | Unit tests for server/_editable_guard.py — scan_editable_installs_for_worktree |
 | `test_factory.py` | Tests for server/_factory.py make_context() composition root |
 | `test_factory_recording.py` | Tests for make_context recording/replay runner wiring |

tests/server/test_capability_admission_e2e.py

@@ -0,0 +1,55 @@
+"""End-to-end chain tests for capability admission control.
+
+Verifies the full chain from backend capability detection through
+load_and_validate to the dispatch_feasible signal.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from autoskillit.core import BACKEND_CAPABILITY_INGREDIENTS, CAPABILITY_GATE_CALLABLES
+from autoskillit.recipe._api import load_and_validate
+
+pytestmark = [pytest.mark.layer("server"), pytest.mark.medium]
+
+
+_PROJECT_ROOT = pytest.importorskip("pathlib").Path(__file__).resolve().parent.parent.parent
+
+
+def test_capability_ingredient_keys_match_registry() -> None:
+    """BACKEND_CAPABILITY_INGREDIENTS must include backend_supports_git_write."""
+    assert "backend_supports_git_write" in BACKEND_CAPABILITY_INGREDIENTS
+
+
+def test_capability_gate_callables_includes_gate_backend_write() -> None:
+    """CAPABILITY_GATE_CALLABLES must include gate_backend_write."""
+    assert "gate_backend_write" in CAPABILITY_GATE_CALLABLES
+
+
+def test_codex_backend_produces_infeasible_recipe() -> None:
+    """Codex + implementation recipe chain: backend_supports_git_write=false
+    produces dispatch_feasible=False with gate_backend_write infeasible."""
+    result = load_and_validate(
+        "implementation",
+        project_dir=_PROJECT_ROOT,
+        ingredient_overrides={"backend_supports_git_write": "false"},
+        backend_name="codex",
+    )
+    assert result.get("valid") is True
+    assert result.get("dispatch_feasible") is False
+    assert "gate_backend_write" in result.get("infeasible_steps", [])
+
+
+def test_claude_code_backend_produces_feasible_recipe() -> None:
+    """Claude Code + implementation recipe: backend_supports_git_write=true
+    produces dispatch_feasible=True."""
+    result = load_and_validate(
+        "implementation",
+        project_dir=_PROJECT_ROOT,
+        ingredient_overrides={"backend_supports_git_write": "true"},
+        backend_name="claude-code",
+    )
+    assert result.get("valid") is True
+    assert result.get("dispatch_feasible") is True
+    assert "infeasible_steps" not in result