The capability.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Manifestcapability.manifest
| Property | Value |
|---|---|
| Capability | system.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | Yes |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
the kernel’s self-description for an agent, designed for TOKEN EFFICIENCY +
MAXIMAL STEERAGE - it reveals in WAVES so the agent is never drowned in ~360 verbs and pays tokens only
for the slice it is actually heading toward. Three progressively-detailed modes over the SAME registry
the CLI opbox list filters:
- INDEX (default,
{}or just{tier?}): the cheapest wave - one line per DOMAIN with its verb count (e.g.{matter:12, bill:18, ...}), ~150 tokens. The agent sees the whole shape of its kernel and knows where to drill. Steerage, not a dump. - LIST (
{prefix?}or{search?}): the verbs in one domain / matching a keyword - COMPACT (name, capability, riskClass, authz, tier, idempotent, a one-line summary); NO heavy schemas. The agent narrows to a handful of candidates cheaply. - DETAIL (
{verb}, or any list{detail:true}): the FULL contract for the narrowed set only - adds the ADR-0035 input schema (mcp::tools::input_schema_for, the same source MCPtools/listuses)- the output render-schema. The agent reads the exact call contract for the 1-2 verbs it will use.
TIER wave throughout ({tier?: 1|2|3}, default Core): AdminOnly is NEVER listed (CC-OPBOX 56 C7
disclosure floor). The disclosure equals the MCP tools surface, so it is a pure Read/Member projection
(route PERMIT-1782512662, no new trust boundary - CC-OPBOX 16 does not bite); authz is still enforced
at dispatch on every call. Steering #2 (one source of truth) / #3 (the agent is the interface).
Call POST /v/capability.manifest with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool capability.manifest.