feat(coverage): sdk-coverage.v1.json per-capability snapshot (#182)

.github/workflows/ci.yml

@@ -170,6 +170,28 @@ jobs:
       - name: Run compatibility gate
         run: python scripts/compatibility_gate.py
 
+      - name: Run SDK coverage gate
+        # Validates compatibility/sdk-coverage.v1.json: every capability key
+        # is checked against honua-server's *live* published key list (not
+        # the offline compatibility/capability-keys.fixture.json fallback
+        # gen_sdk_coverage.py uses locally), every entrypoint is resolved
+        # against the installed packages (renamed/removed symbol -> fail),
+        # and the committed snapshot must match a fresh generation exactly.
+        env:
+          HONUA_CAPABILITY_KEY_LIST_URL: https://raw.githubusercontent.com/honua-io/honua-server/trunk/docs/gis/data/capability-keys.v1.json
+        run: python scripts/gen_sdk_coverage.py
+
+      - name: Upload SDK coverage snapshot artifact
+        # Published on trunk builds only (per honua-sdk-python#182), for
+        # honua-evidence's aggregate capability-matrix run to consume.
+        if: github.ref == 'refs/heads/trunk' && github.event_name == 'push'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: sdk-coverage-v1
+          path: compatibility/sdk-coverage.v1.json
+          if-no-files-found: error
+          retention-days: 90
+
   security-audit:
     runs-on: ubuntu-latest
     steps:

.github/workflows/publish-python-sdk.yml

@@ -113,6 +113,16 @@ jobs:
         run: python scripts/compatibility_gate.py
         working-directory: ${{ github.workspace }}
 
+      - name: Run SDK coverage gate
+        # A release must not ship a stale coverage claim (honua-sdk-python#182):
+        # fail the publish if compatibility/sdk-coverage.v1.json drifts from
+        # the SDK source, references a renamed/removed entrypoint, or uses a
+        # capability key honua-server no longer publishes.
+        env:
+          HONUA_CAPABILITY_KEY_LIST_URL: https://raw.githubusercontent.com/honua-io/honua-server/trunk/docs/gis/data/capability-keys.v1.json
+        run: python scripts/gen_sdk_coverage.py
+        working-directory: ${{ github.workspace }}
+
       - name: Install honua-admin (for full smoke coverage)
         run: pip install -e "${{ github.workspace }}/packages/honua-admin"
 
@@ -192,6 +202,16 @@ jobs:
         run: python scripts/compatibility_gate.py
         working-directory: ${{ github.workspace }}
 
+      - name: Run SDK coverage gate
+        # A release must not ship a stale coverage claim (honua-sdk-python#182):
+        # fail the publish if compatibility/sdk-coverage.v1.json drifts from
+        # the SDK source, references a renamed/removed entrypoint, or uses a
+        # capability key honua-server no longer publishes.
+        env:
+          HONUA_CAPABILITY_KEY_LIST_URL: https://raw.githubusercontent.com/honua-io/honua-server/trunk/docs/gis/data/capability-keys.v1.json
+        run: python scripts/gen_sdk_coverage.py
+        working-directory: ${{ github.workspace }}
+
       - name: Run tests
         # Exercise the full suite (not just ``tests/admin/``) so the admin
         # publish smoke mirrors the sdk job and CI; an sdk-side regression