Ask for an outcome. Capability finds the ability.

Discovery before installation

An agent can search inert capability contracts without importing arbitrary package code just to learn what the package does.

Authority is part of the contract

Filesystem, network, process, secrets, database, email, and Git effects are visible before execution instead of hidden behind a generic tool call.

Acquisition is not trust

Indexes locate abilities. The client still resolves an exact artifact, checks package identity and available provenance, and binds the executable back to the inspected manifest.

Execution leaves evidence

Plans, verification results, provenance, timing, outputs, and failures can be preserved as receipts rather than disappearing into an opaque agent run.

A real extension boundary

MetabolicBinder is now a stable 1.x extension contract. A conformant executable binding must identify its binder and substrate, preserve evidence, record truthful authority state, and resolve a mutable discovery locator to an exact immutable artifact before execution.

Unknown authority cannot disappear

If authority is incomplete, custom:external.opaque-effects remains explicit. The common registry rejects an incomplete binding that drops that uncertainty and refuses execution without explicit approval, even if a third-party binder forgets its own guard.

One receipt across future substrates

Every execution attempted through the 1.x metabolic registry gets a stable receipt containing binder/substrate identity, original locator, exact artifact, authority state, evidence, timing, isolation information, and any substrate-specific upstream receipt.

Conformance is executable

runProtocolConformance() tests the stable protocol contracts without network access. runBinderConformance() lets an independently authored WASM, Rust, JVM, .NET, native-binary, or future binder prove it fits the same public boundary without a project-specific patch to Capability core.

PyPI / Python — exact wheel bytes

$ cap pypi-mine inflection --query "camelize text"
$ cap pypi-forge inflection --symbol camelize --execute '{"args":["hello_world"]}' --approve

→ wheel SHA256 verified
→ exact wheel stored
→ --no-index --no-deps
→ Docker network: none
→ HelloWorld

The automatic Python binder accepts non-yanked universal wheels, mines their source without importing the package, pins the exact verified wheel bytes and Python base-image digest, and executes without network access. Platform-specific wheels stay outside this binder until their platform can be bound explicitly.

OCI — the container is the artifact

$ cap oci-inspect busybox:1.36
→ busybox@sha256:…

$ cap oci-run busybox:1.36 echo capability-oci-ok --approve
→ immutable RepoDigest
→ network denied by default
→ capability-oci-ok

Capability resolves mutable tags to immutable image digests, then runs the digest with a read-only root filesystem, dropped capabilities, no-new-privileges and resource limits. Digest identity proves which bytes ran; it does not declare those bytes safe.

Composition — abilities from the space between tools

$ cap compose-intent "normalize text then slugify text"   --input '{"text":"  Hello   Capability World  "}'

text/normalize → text/slugify
→ hello-capability-world
→ receipt per step

The planner rejects known schema contradictions, synthesizes a composite manifest, unions the authority envelope, and keeps provenance and receipts at every execution boundary. Today intent-first composition auto-selects native indexed contracts; the lower-level primitives can accept external contracts from future binders.

Gaps — failure becomes the next software specification

$ cap gap "missing outcome" --out missing.json
$ cap build-gap missing.json ./missing-capability

need → search → compose → unresolved
→ machine-readable gap
→ buildable Capability project

An unresolved request can preserve its desired contract, authority ceiling, verification requirements and search evidence. A human or coding agent gets a normal Capability project containing that exact gap instead of a vague “tool not found” dead end.