Capability without custody.

Status: foundation implementation. Durable audit/profile work remains incomplete, and no external host has passed the Yukh-specific host-composition gate. goose and Hermes passed only the earlier runtime-substrate gate.

The problem

Agents need to inspect and change real systems, but direct credential access collapses intent, policy, host permissions, execution and audit into one opaque step.

Responsibility

Represent explicit capability decisions, minimum scope and operational evidence so execution authority remains legible across replaceable hosts and runtimes.

Authority boundary

MCP may participate in authorizing and evidencing a bounded capability. It must not become a second hidden approval engine beside the agent host, decide portfolio priority, own accepted work state or infer coordination authority from messages.

Public contracts

• Intent: a typed declaration of the requested outcome and target.
• Policy decision: an explicit Yukh allow, deny or approval requirement with reasons and scope.
• Capability grant: the minimum Yukh authority, scope and lifetime needed for the operation.
• Evidence: portable operational facts correlated to participant, work, capability and runtime identifiers.

How it interacts

Coordination carries claims and handoffs. Accepted-state implementations retain reviewed delivery state. The current Track A Gate A2 requires Yukh decisions and host-native decisions to remain independently observable, with the effective result no broader than either policy allows.

Next direction

Execute Gate A2 against goose and Hermes through supported public seams, prove two-sided Yukh/host policy composition, then continue restart/recovery and adapter-cost qualification. A host is not selected merely because its upstream permission tests pass.