Capability Provider Model

Capability Provider Model

Architecture governs. Resources participate.

This is the idea that lets the system outlive any single model.

The reframe

A naïve agent is built around a model, so it breaks when the model changes. This architecture inverts it: the system is built around capabilities it needs — REASONING, PLANNING, MEMORY, EXECUTION, VALIDATION, GOVERNANCE — and a Capability Provider is anything that can supply one. A local 7B model, a frontier API, a specialist agent, a rule engine, or a human are all providers. The caller asks for a capability and never learns which provider answered.

The provider contract

CapabilityProvider:
    name       : str
    provides   : list[Capability]
    available() -> bool        # has key? GPU free? human awake?
    invoke(capability, request) -> Result

available() is the crucial method: a provider lacking prerequisites returns False and is skipped silently — not errored. (Exactly the pattern of a keyed-vs-free fallback chain.)

The router: negotiation, not just selection

It picks a provider by a documented priority:

Axis	Question
Availability	is it up and configured?
Capability fit	can it do this well enough?
Cost	tokens, dollars, latency
Sovereignty	may this data leave the box at all? (sovereign → cloud is blocked, not dispreferred)
Determinism	do we need a reproducible answer?

Routing is deterministic and inspectable — two identical requests route the same way, or the audit trail is fiction.

Why it matters

1. Model independence — a frontier model is a provider upgrade, not a rewrite.
2. Graceful degradation — offline/keyless, the system falls back to whatever provider is available; its capability drops honestly, it doesn't pretend.
3. Heterogeneous minds — a CSP solver can provide PLANNING; a human can provide a high-stakes GOVERNANCE decision. Human-in-the-loop is just another provider — the highest-authority one.

The danger, named

The provider model is what makes it tempting to drop governance when a strong model is plugged in ("it's smart now"). That is the one trap that unravels the design. The provider is the replaceable part; the discipline is not. Swap providers freely; never swap out accountability.

---

📖 Full document: docs/04 · 📐 Spec: specs/capability-contract.md · 🧩 Code: providers.py → Next: Reality Grading Loop