Roadmap 11: complete Capability Fabric end to end

[Sequela02]

Status

Deferred behind Roadmap 00 Source Stability. This issue remains the implementation owner for Roadmap 11; it is not an admitted default task until source stability completes or the roadmap records an explicit reprioritization.

Objective

Complete Roadmap 11 so admitted Kiln surfaces can discover and invoke eligible portable, native, service-backed, or agent-backed capabilities while preserving authority, effects, provenance, lifecycle, cost, and artifact identity.

Canonical scope, dependencies, and ordered design: docs/roadmap/11-capability-fabric.md.

Current state

• Slice 0, exact harness contract baseline: complete.
• Slice 1, canonical capability catalog: complete.
• Slice 2, read-only discovery adapters: next Roadmap 11 slice, deferred behind Roadmap 00.
• Slices 3–8 remain blocked by their recorded dependencies and vertical proofs.
• Runtime-owned durable claims and execution fences landed in 44cd5c13; this unblocks a dependency but completes no Capability Fabric acceptance criterion.
• Model Gateway remains ingress-only and does not become capability execution or orchestration authority.

Remaining ordered work

• Slice 2 — read-only discovery adapters
• Slice 3 — deferred tool search
• Slice 4 — portable tool execution and cross-surface web.search
• Slice 5 — agent-backed capabilities and vision.analyze
• Slice 6 — artifact continuity and presentation workflow
• Slice 7 — cross-surface promotion, including operator-question lifecycle
• Slice 8 — capability-aware orchestration promotion
• Remove superseded paths and unnamed residuals
• Promote stable contracts and operations to canonical architecture and guides

Engineering constraints

• Preserve bounded contexts and dependency direction. Model Gateway remains independent from capability execution and orchestration.
• Discovery is read-only and never grants execution authority.
• Fail closed on stale, malformed, unsupported, secret-bearing, or contradictory evidence.
• Do not retain OpenCode V1, experimental provider endpoints, compatibility aliases, or unused migration paths.
• Keep credentials, raw provider results, operator paths, and incident payloads out of fixtures and durable evidence.
• Use behavior-first tests, synthetic portable fixtures, focused verification before broader gates, and independent security/architecture/findings review.
• Do not reinstall or synchronize native Model Gateway projections as an intermediate side effect.

Acceptance

All Roadmap 11 completion criteria and promotion gates pass, including:

• one canonical owner for capability identity, eligibility, selection, planning, evidence, and public projection;
• deterministic no-effect discovery;
• bounded search, execution, cancellation, settlement, and replay;
• authority, permission, data, network, budget, credential, and destructive-effect negatives;
• honest local Agent Task and remote A2A lifecycle evidence;
• artifact lineage and cross-surface semantic conformance;
• GUI-first operator-question flow reproduced in TUI and admitted native harnesses;
• end-to-end web.search, vision.analyze, and presentation workflows;
• capability-first orchestration with no double delegation or fabricated evidence;
• tests, typecheck, public-schema/privacy checks, git diff --check, and independent reviews with no unresolved high or medium findings.

Re-admission gate

Roadmap 11 work resumes only after Roadmap 00 Source Stability completes or docs/roadmap/README.md records an explicit priority decision. Dependency readiness by itself does not supersede that queue.

[Sequela02]

The execution boundary referenced by #98 landed in 44cd5c13. Capability-backed execution can now consume Runtime-owned durable claims/fences; Model Gateway remains ingress-only and external harnesses are fenced only at the invocation boundary Kiln owns. No Capability Fabric acceptance criteria are claimed complete here, so #82 remains open.