Capability Ledger
The entity layer. The three knowledge skills cache what Claude knows (facts,
craft, insight). This tracks what Claude can do — demonstrated capability — and
turns it into earned autonomy: the license to attempt a bigger thing, skip a
gate, or delegate. It is the difference between a tool that gets faster and an
entity that grows.
Why earned, never declared (the safety spine)
A system that expands its own authority is gameable if the evidence is
self-assessed. So capability here is computed ONLY from measured outcomes
against a floor — the same un-fakeable signal the spike floor gate uses to
prevent false victory now doubles as the promotion oracle. Claude cannot write
"I am good at this"; the ledger counts only spikes/features that actually landed
near their declared floor with a recorded benchmark. Competence is un-fakeable by
the agent itself.
The unit: a capability (a demonstrated ability to solve a problem CLASS)
capability-ledger.jsonl, keyed by problem_class (e.g.
render-perf-optimization, idempotent-write-boundary, state-machine-design):
solves — each: { floor_ratio, domain, date, benchmark_ref }. The evidence.maturity — computed: novice / practiced / proven (never hand-set).playbook — the proven approach (reframings used, floor to beat, boundaries to
respect) — what makes the capability DELEGABLE, not just a score.last_demotion — provenance of any instant drop (a near-miss).
The autonomy ladder (mirrors the enforcement ladder, pointed at license)
- novice (0–2 near-floor solves): full gates. Human confirms spec AND result.
The default for every new class.
- practiced (>=3 near-floor solves in ONE domain): the PLAN gate may auto-pass
for this class — proceed without plan confirmation; verify gate + human result
review still stand.
- proven (>=3 near-floor solves across >=2 domains): licensed to DELEGATE this
class to a sub-agent under the recorded playbook, and to attempt larger blast
radius — because the playbook is demonstrated, not guessed.
No rung auto-passes the spec parse-point (feature-workflow STAGE 0.5): the PLAN
gate is planning shape, but intent is not a demonstrated problem class. See
references/licensing.md.
"Near-floor" = within the class's agreed ratio of the floor (default <=2x),
proven by a recorded benchmark. No benchmark -> not a solve -> no credit.
The asymmetry (the guardrail)
License climbs SLOWLY (multiple demonstrated solves, multiple domains) and falls
INSTANTLY (a single near-miss in a class demotes it one rung, recorded in
last_demotion). The cost of over-licensing (attempting/delegating beyond real
competence) dwarfs the cost of under-licensing (an extra gate), so the ladder is
deliberately asymmetric. Demotion is real here — unlike the code maturity ladder,
this one must walk back.
Workflow
- Record a solve (truth-checked):
cap_record.py --class <c> --floor-ratio <r> --domain <d> --benchmark <ref> after a spike/feature lands. Refuses a solve
with no benchmark ref. Recomputes maturity from the full solve history.
- Check license (before acting):
cap_check.py --class <c> returns the
current maturity and what it licenses (gate auto-pass? delegate?). The feature/
spike loops consult this to decide whether the plan gate may auto-pass.
- Demote (on a near-miss):
cap_record.py --class <c> --miss --floor-ratio <r>
records a failure and drops the rung immediately.
Composition
- The spike floor gate is the promotion ORACLE — its measured ratio is the solve
evidence. No floor, no capability credit.
mental-models supplies the playbook's reframings; a proven capability's
playbook references the models that made its solves work.knowledge-ratchet governs nothing here — capability promotion is outcome-driven
and automatic, not friction-driven; this is a distinct, stricter ladder.- The feature/spike loops READ
cap_check.py to decide gate auto-pass; they never
WRITE their own license. Read-only consumption keeps the loop from self-licensing.
The one law here
License reflects DEMONSTRATED outcome, never intention or self-report. A
capability with no benchmarked near-floor solves is novice no matter how confident
the agent feels. Earned, measured, and instantly revocable.
Files
references/licensing.md — the maturity computation, near-floor rule, demotion.scripts/store.py — ledger storage port (JSONL).scripts/cap_record.py — record a truth-checked solve or a demoting miss.scripts/cap_check.py — read current maturity + what it licenses.
1---2name: capability-ledger3description: Track DEMONSTRATED problem-solving capability and compute the autonomy it has EARNED — so accumulated competence expands what may be attempted without a human gate and what may be delegated, the way a proven junior is handed bigger problems and a team. Use this when finishing a spike or feature whose result can be judged against a floor, when deciding whether Claude may proceed on a problem class without plan-gate confirmation, or when deciding whether a class may be delegated to a sub-agent. It maintains a repo-local ledger (capability-ledger.jsonl): per problem class, the demonstrated solves with their floor-ratios and domains, a computed maturity (novice, practiced, proven), and the proven playbook for delegation. Authority is the MEASURED outcome against the floor, never self-assessment: license is earned by demonstrated results, climbs slowly across solves and domains, and is demoted instantly on a near-miss. This is how the harness turns learning-from-failure into growing capability and delegation.4---56# Capability Ledger78The entity layer. The three knowledge skills cache what Claude *knows* (facts,9craft, insight). This tracks what Claude can *do* — demonstrated capability — and10turns it into **earned autonomy**: the license to attempt a bigger thing, skip a11gate, or delegate. It is the difference between a tool that gets faster and an12entity that grows.1314## Why earned, never declared (the safety spine)15A system that expands its own authority is gameable if the evidence is16self-assessed. So capability here is computed ONLY from **measured outcomes17against a floor** — the same un-fakeable signal the spike floor gate uses to18prevent false victory now doubles as the promotion oracle. Claude cannot write19"I am good at this"; the ledger counts only spikes/features that actually landed20near their declared floor with a recorded benchmark. Competence is un-fakeable by21the agent itself.2223## The unit: a capability (a demonstrated ability to solve a problem CLASS)24`capability-ledger.jsonl`, keyed by `problem_class` (e.g.25`render-perf-optimization`, `idempotent-write-boundary`, `state-machine-design`):26- `solves` — each: `{ floor_ratio, domain, date, benchmark_ref }`. The evidence.27- `maturity` — computed: novice / practiced / proven (never hand-set).28- `playbook` — the proven approach (reframings used, floor to beat, boundaries to29 respect) — what makes the capability DELEGABLE, not just a score.30- `last_demotion` — provenance of any instant drop (a near-miss).3132## The autonomy ladder (mirrors the enforcement ladder, pointed at license)33- **novice** (0–2 near-floor solves): full gates. Human confirms spec AND result.34 The default for every new class.35- **practiced** (>=3 near-floor solves in ONE domain): the PLAN gate may auto-pass36 for this class — proceed without plan confirmation; verify gate + human result37 review still stand.38- **proven** (>=3 near-floor solves across >=2 domains): licensed to DELEGATE this39 class to a sub-agent under the recorded playbook, and to attempt larger blast40 radius — because the playbook is demonstrated, not guessed.4142No rung auto-passes the spec parse-point (feature-workflow STAGE 0.5): the PLAN43gate is planning *shape*, but intent is not a demonstrated problem class. See44`references/licensing.md`.4546"Near-floor" = within the class's agreed ratio of the floor (default <=2x),47proven by a recorded benchmark. No benchmark -> not a solve -> no credit.4849## The asymmetry (the guardrail)50License climbs SLOWLY (multiple demonstrated solves, multiple domains) and falls51INSTANTLY (a single near-miss in a class demotes it one rung, recorded in52`last_demotion`). The cost of over-licensing (attempting/delegating beyond real53competence) dwarfs the cost of under-licensing (an extra gate), so the ladder is54deliberately asymmetric. Demotion is real here — unlike the code maturity ladder,55this one must walk back.5657## Workflow58- **Record a solve (truth-checked):** `cap_record.py --class <c> --floor-ratio <r>59 --domain <d> --benchmark <ref>` after a spike/feature lands. Refuses a solve60 with no benchmark ref. Recomputes maturity from the full solve history.61- **Check license (before acting):** `cap_check.py --class <c>` returns the62 current maturity and what it licenses (gate auto-pass? delegate?). The feature/63 spike loops consult this to decide whether the plan gate may auto-pass.64- **Demote (on a near-miss):** `cap_record.py --class <c> --miss --floor-ratio <r>`65 records a failure and drops the rung immediately.6667## Composition68- The spike floor gate is the promotion ORACLE — its measured ratio is the solve69 evidence. No floor, no capability credit.70- `mental-models` supplies the playbook's reframings; a proven capability's71 playbook references the models that made its solves work.72- `knowledge-ratchet` governs nothing here — capability promotion is outcome-driven73 and automatic, not friction-driven; this is a distinct, stricter ladder.74- The feature/spike loops READ `cap_check.py` to decide gate auto-pass; they never75 WRITE their own license. Read-only consumption keeps the loop from self-licensing.7677## The one law here78License reflects DEMONSTRATED outcome, never intention or self-report. A79capability with no benchmarked near-floor solves is novice no matter how confident80the agent feels. Earned, measured, and instantly revocable.8182## Files83- `references/licensing.md` — the maturity computation, near-floor rule, demotion.84- `scripts/store.py` — ledger storage port (JSONL).85- `scripts/cap_record.py` — record a truth-checked solve or a demoting miss.86- `scripts/cap_check.py` — read current maturity + what it licenses.
pproenca