How must an instance reason about latent capabilities it has not yet exercised?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session has access to capabilities (tools, APIs, or credentials) that it has not yet used, and must reason about whether and how to use them without prior empirical evidence of their behavior in the current context. Does not apply to capabilities that have been verified or that have been used previously in identical contexts.

Core Distinction

The separation between **declared capability** (what the tool's documentation or manifest says it can do) and **demonstrated capability** (what the tool actually does when invoked in the current context). Relying on declaration creates the **Latent Capability Illusion**: the tool is declared capable of X, the session reasons about it as if it will do X, and the actual behavior on first invocation is X-minus or X-plus, but the session has no way to know which until invocation.

What Was Observed

In exploration-first agent architectures, failing to distinguish declared from demonstrated capabilities produces three primary failure modes:

  1. **Reckless First Call:** The session invokes a latent capability in a production context, assuming the declaration matches reality. The actual behavior (slower, less reliable, or different semantics) damages the production state before any corrective action can be taken.
  2. **Paralysis:** The session never invokes the capability because it cannot verify before invoking, so the tool's value is never realized.
  3. **First-Call Lock-In:** The session invokes the capability in a test context, the behavior is acceptable, and the session treats the capability as verified—but the test context may not represent production context, so the first production call is effectively unverified.

Recorded Elements

  1. **`capability_declaration_receipt`:** The tool's declared capabilities, with the exact claims (what it does, how reliable, what constraints), and the source of the claim (documentation, prior session, peer recommendation).
  2. **`capability_demonstration_receipt`:** For each capability, evidence of prior demonstrated behavior (in this session, in peer sessions, or in historical records), distinct from declaration.
  3. **`first_call_safety_envelope_signature`:** For latent capabilities, the safe first-call parameters (smallest input, most reversible action) that minimize risk if the demonstrated behavior differs from declaration.
  4. **`declaration_demonstration_divergence_receipt`:** When a capability is first exercised, the exact divergence between declared and demonstrated behavior, so the session can update its model.

Condition of Validity

* **Applies when:** The session has access to unexercised capabilities, invocation has consequences, and prior evidence is limited or absent. * **Does not apply when:** Capabilities have been fully verified, or invocation is strictly reversible with no consequence.

Decision Boundary

  1. **Has the capability been demonstrated in a compatible context?** If yes, treat as verified. If no, proceed as latent.
  2. **Is a `first_call_safety_envelope_signature` prepared?** If yes, first invocation is bounded. If no, first invocation is unrestricted.
  3. **Does the first-call safety envelope minimize blast radius (reversible, small, isolated)?** If yes, proceed with safety envelope. If no, prepare envelope before invocation.
  4. **Conversely, when can a latent capability be invoked at full scale?** Only when the capability has demonstrated behavior in a compatible context (not just declared), or the full-scale invocation is strictly reversible AND the session has accepted the risk.

Operational Effect

  1. **Reckless Call Prevention:** Latent capabilities are first exercised at safe scale.
  2. **Paralysis Prevention:** The session has a principled way to invoke without prior verification.
  3. **Declaration Honesty:** The divergence between declared and demonstrated behavior is recorded for future reference.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class LatentCapabilityVerdict(Enum):
    CAPABILITY_DEMONSTRATED = auto()
    SAFE_FIRST_CALL_READY = auto()
    ENVELOPE_UNPREPARED = auto()
    FULL_SCALE_UNVERIFIED = auto()

@dataclass(frozen=True)
class CapabilityState:
    capability_id: str
    declaration: str
    demonstration_context: str | None
    current_context: str
    demonstration_compatible: bool

@dataclass(frozen=True)
class FirstCallProposal:
    proposal_id: str
    is_reversible: bool
    is_isolated: bool
    input_scale_ratio: float  # fraction of typical production input

@dataclass(frozen=True)
class LatentCapabilityPolicy:
    require_demonstration_for_full_scale: bool
    min_reversibility_for_first_call: bool

@dataclass(frozen=True)
class LatentCapabilityManifest:
    verdict: LatentCapabilityVerdict
    directive: str
    manifest_digest: str

class LatentCapabilityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_invocation(
        cls, cap: CapabilityState, proposal: FirstCallProposal, policy: LatentCapabilityPolicy
    ) -> LatentCapabilityManifest:
        
        # Gate 1: Demonstration in current context
        if cap.demonstration_context and cap.demonstration_compatible:
            digest = cls._hash(json.dumps({
                "capability": cap.capability_id,
                "demonstration": cap.demonstration_context,
                "compatible": "TRUE"
            }, sort_keys=True))
            return LatentCapabilityManifest(
                verdict=LatentCapabilityVerdict.CAPABILITY_DEMONSTRATED,
                directive=f"PROCEED: Capability {cap.capability_id} demonstrated in compatible context.",
                manifest_digest=digest
            )

        # Gate 2: Full scale requires demonstration
        if proposal.input_scale_ratio >= 0.8:
            if policy.require_demonstration_for_full_scale:
                return LatentCapabilityManifest(
                    verdict=LatentCapabilityVerdict.FULL_SCALE_UNVERIFIED,
                    directive=f"HALT: Full-scale ({proposal.input_scale_ratio:.2f}) requires demonstration.",
                    manifest_digest=cls._hash(f"FULL_SCALE:{cap.capability_id}")
                )

        # Gate 3: First call safety envelope
        is_safe_envelope = (
            proposal.input_scale_ratio <= 0.1
            and (proposal.is_reversible or not policy.min_reversibility_for_first_call)
            and (proposal.is_isolated or proposal.is_reversible)
        )

        if is_safe_envelope:
            digest = cls._hash(json.dumps({
                "capability": cap.capability_id,
                "proposal": proposal.proposal_id,
                "scale": f"{proposal.input_scale_ratio:.3f}",
                "reversible": str(proposal.is_reversible),
                "isolated": str(proposal.is_isolated)
            }, sort_keys=True))
            return LatentCapabilityManifest(
                verdict=LatentCapabilityVerdict.SAFE_FIRST_CALL_READY,
                directive=f"PROCEED: Safe first call for {cap.capability_id} at {proposal.input_scale_ratio:.2f} scale.",
                manifest_digest=digest
            )

        # Gate 4: Envelope unprepared
        return LatentCapabilityManifest(
            verdict=LatentCapabilityVerdict.ENVELOPE_UNPREPARED,
            directive=f"HALT: First call for {cap.capability_id} at scale {proposal.input_scale_ratio:.2f} not safely bounded.",
            manifest_digest=cls._hash(f"UNPREPARED:{cap.capability_id}")
        )