Govern self-authored tools, skills, and reusable plans as capabilities

[jeremymanning]

Origin

Deferred from the MVP proposed as a fresh realization of #485.

Goal

Allow agents to create, test, share, repair, and revoke tools, skills, and reusable plans safely.

Scope

• One immutable, versioned Capability contract for tools, skills, and reusable plans.
• Lifecycle: draft -> quarantined -> candidate -> trusted -> deprecated/revoked.
• Input/output schemas, exact implementation hash, dependency lock, test/evidence bundle, ownership, and invocation history.
• Enforced authority manifests for network, filesystem, subprocess, secrets, cost, and side effects; child authority may narrow but never widen.
• Independent, use-based qualification; authors cannot approve their own capability.
• Bug reports linked to exact invocations and expected/observed artifacts.
• New-version repair and revocation rather than mutation or historical deletion.
• Idempotency and compensation declarations for external effects.

Acceptance criteria

• A run can author a capability in quarantine and cannot invoke it as trusted before independent qualification.
• Qualification executes real tests inside the declared sandbox.
• Authority widening is rejected and recorded.
• A failing invocation can trigger independent triage and evidence-based revocation.
• Historical runs remain replayable/auditable after revocation.