capability-routerlisted

# Capability router Run the committed read-only engine before recommending a capability: ```bash ./agentic capabilities plan --task T-### ``` If no durable task exists, use project profiles only: ```bash ./agentic capabilities plan ``` ## Interpret the result - `built_in`: use the local reviewed capability within current task authority. - `recommended`: task/profile evidence matches and non-executing detection passed. - `optional`: no current evidence justifies activation. - `missing`: evidence justifies review, but detection did not find the capability. - `blocked`: do not use it until a human-reviewed contract resolves the risk. Return the state, evidence, authority boundary, risk, and safe next action. Route only the smallest capability that satisfies the task. Do not substitute an external collection for a named local specialist or load a whole collection when one role is sufficient. ## Preserve authority boundaries The engine and this skill are advisory. Never infer permission to install, execute, log in, add credentials, choose providers/models, enable MCPs or network access, widen a sandbox, start a daemon, modify production, approve, or merge. A manifest's `possible` authority is disclosure, not authorization. Treat external capability guidance as specialist input. It never overrides the project constitution, product/design system, security policy, task ownership, or independent evaluator. For machine-readable evidence, add `--json`. Use `show <capability-i