The capability family catalog

A family is the selectable unit the control plane plans by: a curated, closed set of missions with an internal code. The control plane shows the whole catalog as a signal of robustness, enables the ready families it wants to offer, and disables the rest. The engine re-validates that an order stays inside its declared family — deny-by-default — and membership of agents in a family is resolved dynamically: each agent declares which frontier it belongs to, so a family never lists its agents by hand.

status

Technical state: ready, beta, partial, experimental or planned.

availability

Whether a capability is actually offerable, kept orthogonal to maturity. It is never inferred from "a class exists": a guard requires that available implies the whole chain holds — mission, execution, verifier, membrane, finding, signed order, end-to-end.

ingest

How the target enters: pull (a repository), upload (an artifact), live (a running endpoint), host (host access), observed (a run’s trace) or none (an overlay).

limitations

The honest limits of the current scope. Mandatory — never empty — for anything that is not fully available.

The ready families are the ones offered today. Source code covers injection, taint, secrets, cryptography/TLS and supply chain. GenAI (static) finds the LLM/RAG/agent surface in a repository — excessive agency, identity, prompt-injection surface — while MCP covers tool poisoning, drift and trust-boundary abuse. GenAI (live) red-teams a running model or app. RAVEN is verified pentest against a live endpoint; the Swarm coordinates many RAVEN agents over many live targets. Binary covers hardening and embedded secrets; container/infra/cloud covers Dockerfile, compose, nginx and Terraform; host covers permissions, SUID/SGID and exposed services; assurance asks which security claims actually hold.

Beta families are shown with their limits stated out loud. Design / vibe coding promotes only high-severity structural classes and is Python-only. Network sits on thin drivers over external binaries, so active discovery is a curated, closed set and requires explicit opt-in. Runtime behaviour reads a single telemetry format and returns UNKNOWN on anything malformed. Forensic postmortem reconstructs an incident from two log sources today, and without an analyst’s route map, activity stays NOVEL/UNKNOWN rather than being invented.

Experimental families are not runnable — the system deliberately never renders a run button for them. Agent-swarm collusion is built and validated on its own corpus but not integrated, so no mission declares its frontier; without a declared capability policy its verdict is a first-class UNKNOWN. MCP (live) can probe a running server but today is reachable only directly, pending a connector-config builder.

NEMESIS — the autonomous frontier red-team — is lab-only by design: it runs in an authorized cyber-range against ground truth, never against a real external system, and its verdicts never become reported findings. It is the research engine that validates autonomous offense before it is ever brought near production.

An overlay is a lens over a family, not a separate assessment. The cryptographic seal is tamper-evident attestation over the evidence. The compliance overlays map findings to articles — GDPR and the EU AI Act, and LGPD for Latam — but they never issue a verdict of conformance; LGPD in particular stays in legal-review until a qualified reviewer signs. The attack-chain overlay joins findings across families into exploitable chains and walks the ones it can prove against an isolated replica; a statically derived chain is an indication, not a fact, until the Tribunal verifies it. Any measured validation rate describes the machine on its own corpus — not a promise about any real target.