harbor-capability-discovery

Rules

• Use Harbor CLI or API only.
• Never read Harbor's database directly.
• Treat published capabilities as the only executable source of truth.
• Summarize findings using capability, grant, approval, and execution terminology.

Discovery loop

1. Confirm Harbor reachability and identity as needed with

   harbor status --plain

   and

   harbor auth whoami --plain

   .
2. Run

   harbor ls --plain

   to list available published capabilities.
3. If a target capability is known, inspect it with

   harbor inspect <capability> --plain

   .
4. Distinguish capability discovery from grant state. Do not imply access just because a capability is listed.
5. If the next workflow is blocked on grant or execution approval, surface the

   approval_id

   and tell the owner to run

   harbor approve <approvalId> --yes --plain

   .
6. If a capability depends on owner-managed secrets, use

   harbor secrets ls --plain

   ,

   harbor secrets inspect <name> --plain

   , and

   harbor secrets set <name> --value <value> --plain

   .
7. Summarize the relevant capabilities, grant blockers, secret blockers, and the next safe Harbor action.

references/discovery-flow.md