Capabilities, built in
A record of what already worked, and what it does not cover.
The expensive failure is not an agent that cannot do something. It is an agent that could, and said it was blocked, because nothing told it the route existed. Cortex keeps the answer where the agent will look.
Ask the map before you say blocked.
A question in plain words comes back as routes. Each one carries the state it has earned, the evidence behind it, and the scope it is known not to cover, because a proven route usually proves one path and not its neighbours.
When the map cannot judge whether a route covers the request, it says UNKNOWN and lists candidates. That answer is an instruction to prove it, not permission to guess.
capability_map(“can we add a DNS record for a new subdomain?”)
- Registrar’s bulk DNS editor, keeping existing recordsPROVEN
Four records added and every earlier record kept, read back from the page and from public resolvers.
Does not cover the registrar’s API: no key on file for it.
- Issue the hosting certificate once the name resolvesPROVEN
Certificate issued in seconds; the site then answered over HTTPS.
Does not cover a name that public resolvers cannot see yet.
Illustrative answers, in the shape the map returns. When it cannot judge whether a route covers the request, it says UNKNOWN and lists candidates.
How a row gets written
A row is earned by doing the job, not by claiming it. The record only takes verified work.
- 01 · Ask
Check the record first
The agent asks the map what is known. A hit with evidence is a route to follow; a hit with a scope limit is a warning about where it stops.
- 02 · Prove
Do the real thing, then read it back
Proof is the outcome observed from outside: the record fetched again, the page reloaded, the exit code, the artefact and its checksum. A rehearsal is not proof.
- 03 · Write
One guarded way in
Verified use goes through a single front door that validates the row and hands back an identifier, so the record is auditable and nothing writes to it behind the service’s back.
What a state means
- PROVEN
- Someone did this and read the result back. The row names the evidence and the session that saw it.
- LIKELY
- A close route is proven and this one shares its credentials and its tools. Treat it as a lead, and prove it.
- UNKNOWN
- The record cannot judge it. The gap is named, and the first verified run becomes the route.
How the vault and the record fit together · Request early access