The capture.* family (2 verbs). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Ingestcapture.ingest
| Property | Value |
|---|---|
| Capability | capture.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
Stores ONE capture row. body is REDACTED-AT-INGEST (ADR-0021) BEFORE write - the regulated bytes
never reach the row. An empty body (or a body that redacts to empty) is a BadInput (INV-11 - a
capture must carry evidence text; an all-secret transcript routes its bytes elsewhere, not here).
Input { sourceType, body, sourceRef? } (fields ending in ? are optional)
Call POST /v/capture.ingest with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.
Listcapture.list
| Property | Value |
|---|---|
| Capability | capture.read |
| Risk class | Read - autonomy L0 |
| Min. permission | Member |
| Availability | Core - always on (MCP tier 1) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
| Render schema | Yes - drives an inline chat artefact and a GUI panel |
The ONE consolidated capture read ([2026] CC-OPBOX 28 gate (b)): the
capture rows capture.ingest writes (migration 0022) but which no read verb surfaced - the in-substrate
home of voice TRANSCRIPTs (source_type='TRANSCRIPT') + DOCUMENT/MESSAGE/NOTE/OTHER captures. Slim
standing, optional { sourceType? } filter, paginated, RLS-scoped. The Content-doc projection is a
regenerable VIEW (Steering #2), not a second source surfaced here. No new store/write/state.
Call POST /v/capture.list with a JSON body; returns JSON (or { error, code }). Also exposed as the MCP tool capture.list.