# Tool Capability Matrix

Last updated: 2026-07-09 (Phase 111.0 pre_use SSOT sync)

## Purpose

This document defines the Phase 73 host capability matrix for Hokage Core
extraction work. It is a contract document, not a marketing support matrix.

The current support-tier scope is:

| Host | Support tier | Claim boundary |
|---|---|---|
| Claude Code | `supported` | Public Claude-first support is allowed for the verified Claude Code path. |
| Codex CLI | `supported` | Live H4 (2026-07-17) + H7 release-preflight fail-closed gate; 3cli Bash PreToolUse floor; CI-gated direct plugin marketplace/install smoke (isolated `CODEX_HOME`); app behavior and full Claude hook parity are not implied. |
| Codex app | `candidate` | App behavior must be proven separately from Codex CLI help output. |
| OpenCode | `internal-compatible` | Existing mirror/package validation and Node-level bootstrap plugin checks can be described as internal compatibility; real OpenCode binary runtime bootstrap parity is not proven. |
| Cursor | `supported` | Live H4 (2026-07-17) + H7 release-preflight fail-closed gate; dist + setup-cursor + workflow smoke; **no FS jail** — containment is harness-side (`docs/CURSOR_INTEGRATION.md`). |
| Grok | `supported` | Live H4 (2026-07-17) + H7 release-preflight fail-closed gate; setup-grok + structural workflow smoke + hookcodec HostGrok Claude-envelope PreToolUse floor; not full Claude SessionStart / PreToolUse parity. |
| Hermes Agent | `candidate` | Manual symlink research route and local dynamic slash discovery only; no setup script, host dist, routing model, runtime floor parity, or public support claim. |
| GitHub Copilot CLI | `candidate` | Candidate adapter only; Superpowers evidence and official docs are not Harness bootstrap proof. |
| Antigravity CLI | `future/unsupported` | No public setup, README support, or release claim until an official or verified route plus local bootstrap smoke exists. |

`not_observed != absent` applies to every host. Missing local runtime evidence
is `not observed` until the relevant source of truth is checked. It is not a
license to promote the host to supported.

## False Parity Rule

False parity is forbidden.

The same capability name does not mean the same enforcement strength. Claude
Code can stop many actions at runtime through PreToolUse across multiple tool
types. Codex CLI and Cursor also route into the shared `bin/harness hook
pre-tool` floor (3cli hook floor), but **coverage and containment differ**:
Codex hooks are Bash-only; Cursor can deny tools yet has no traditional FS jail
and treat allowlists as best-effort. OpenCode is currently a packaging and instruction surface with Node-level bootstrap validation, not proof of runtime
guard parity. Grok is not a 3cli floor member. Candidate hosts do not inherit the safety or
bootstrap claims of supported hosts. See
`docs/hardening-parity.md` and `docs/research/3cli-hook-floor-contract-2026-06.md`.
Hermes Agent remains `candidate`: local skill discovery does not prove runtime
workflow parity or Harness safety parity.

## Capability Status

| Capability | Core meaning | Claude Code | Codex CLI | OpenCode | Cursor | Grok |
|---|---|---|---|---|---|---|
| `skill_loading` | Host can discover and load workflow skills. | Supported through the Claude plugin `skills/` surface. | Supported through `codex/.codex/skills/` and project/user skill loading. | Partial through `opencode/skills/` mirror packaging. | Partial through `.cursor-plugin/plugin.json` → `skills/` and Cursor Skills surface; runtime load not proven until workflow smoke passes. | Partial through `.grok-plugin/plugin.json` → `skills/` and `setup-grok` install; `grok inspect` discovery observed; workflow smoke not proven. |
| `bootstrap_notice` | Host can load startup guidance or prove the guidance surface exists. | Supported through Claude SessionStart guidance, plugin instructions, and root `CLAUDE.md`. | Supported through `codex/AGENTS.md`; no SessionStart hook parity claim. | Partial through `opencode/AGENTS.md`; no SessionStart hook parity claim. | Partial through `.cursor/AGENTS.md`, `.cursor/rules/`, optional hooks config shape; no SessionStart parity claim. | Partial through `.grok/AGENTS.md` and project rules; no SessionStart parity claim. |
| `prompt_routing` | Host can map user intent to a workflow. | Supported through slash commands, skill triggers, and SessionStart guidance. | Partial through explicit `$skill` invocation and `AGENTS.md` routing guidance. | Partial through `AGENTS.md` routing guidance and mirrored skill names. | Partial through AGENTS guidance + skill triggers; static contract only until runtime smoke. | Partial through AGENTS guidance + skill triggers; static contract only until workflow smoke. |
| `pre_use_guard` | Host can block risky actions before execution. | Supported through PreToolUse / permission boundaries (multi-tool). | Partial: 3cli PreToolUse → shared runtime floor for **Bash** only (exit 2); non-Bash not hard-denied on hook path; still uses post quality + merge gate + fingerprint. Not Claude full-tool parity. | Unsupported for parity; instructions can warn, but no first-class pre-use guard is claimed. | Partial: project `preToolUse` can live-deny (Phase 83.7 verified) via `harness hook pre-tool --host cursor`; fail-open on non-exit-2; **no FS jail**; allowlist is best-effort. Not Claude full containment parity. | Unsupported for parity; Grok hooks exist as a host surface but Harness PreToolUse deny / 3cli floor membership is not claimed. |
| `post_use_gate` | Host can inspect outputs after execution. | Supported through PostToolUse and review workflow checks. | Supported through post quality gate checks before merge. | Partial through package validation and release preflight checks. | Partial through review workflow guidance; no hook parity claim. | Partial through review workflow guidance; no hook parity claim. |
| `review_artifact` | Host can produce structured review evidence. | Supported through harness-review and Claude-side review artifacts. | Supported through `scripts/codex-companion.sh review --base` and schema-backed review output. | Partial/static only; OpenCode package validation is not equivalent to an independent reviewer. | Partial/static only; reviewer subagent + harness-review skill guidance, not proven independent review loop. | Partial/static only; harness-review skill guidance after plugin install, not proven independent review loop. |
| `memory_bridge` | Host can use a controlled memory surface. | Supported when Agent Memory / harness-mem wiring is configured. | Partial through `AGENTS.md` guidance and harness-mem bridge configuration. | Future/unsupported for runtime memory bridge parity. | Future/unsupported until MCP/harness-mem wiring is smoke-proven for Cursor. | Future/unsupported until MCP/harness-mem wiring is smoke-proven for Grok. |

## Candidate And Unsupported Host Boundaries

| Host | Phase 73 status | Allowed wording | Blocked wording |
|---|---|---|
| Codex app | `candidate` | app-specific candidate or research gate | blocked: supported, same as Codex CLI |
| Cursor | `supported` | adapter route, handoff integration, setup-cursor install, workflow smoke, harness-side containment disclosure | blocked: identical Claude FS jail / full-tool parity |
| Grok | `supported` | setup-grok install, workflow smoke, inspect discovery, HostGrok Claude-envelope PreToolUse floor | blocked: full Claude SessionStart / PreToolUse parity |
| Hermes Agent | `candidate` | manual symlink research route, local dynamic slash command discovery | blocked: supported Hermes adapter |
| GitHub Copilot CLI | `candidate` | adapter candidate, CLI capability investigation | blocked: supported Copilot adapter |
| Antigravity CLI | `future/unsupported` | future scope, unsupported public claim, not observed | blocked: supported Antigravity adapter |

## Validation Requirements

The matrix is valid only when all of the following stay true:

- All required capability names are present exactly as code-formatted labels.
- Claude Code, Codex CLI, Cursor, and Grok are `supported` on their verified claim paths (H8 pin).
- OpenCode is `internal-compatible`.
- Cursor public `supported` retains **no FS jail** — containment is harness-side.
- Grok public `supported` retains Claude-envelope PreToolUse floor — not full Claude hook parity.
- Hermes Agent is `candidate` with manual symlink research evidence only.
- Codex app and GitHub Copilot CLI are `candidate`.
- Antigravity CLI is `future/unsupported` for public claim.
- Codex CLI runtime evidence includes direct plugin marketplace/install smoke
  in an isolated `CODEX_HOME` plus Bash-only 3cli pre-tool floor; non-Bash
  gaps stay disclosed.
- OpenCode runtime evidence remains Node-level bootstrap validation unless a
  real binary smoke is observed.
- The Codex safety model is **hook floor (Bash) + contract injection + post quality gate + merge gate + fingerprint**, not "instructions only".
- Any public support wording preserves the false parity rule.
- Cursor adapter static smoke is limited to `tests/test-cursor-adapter-candidate.sh`
  and `scripts/setup-cursor.sh --check` until CI-gated Desktop workflow smoke is
  observed.
- Cursor Breezing multitask mapping is a smoke target, not a public parity claim.
- `scripts/setup-cursor.sh` must install a real directory under
  `~/.cursor/plugins/local/` (symlink installs are rejected by Cursor).
- Grok adapter static smoke is limited to `tests/test-grok-adapter-candidate.sh`
  and `scripts/setup-grok.sh --check` until CI-gated workflow smoke is observed.
- Grok Breezing multitask mapping is a smoke target, not a public parity claim.
- `scripts/setup-grok.sh` builds a package-local dist (no `..` manifest paths)
  and installs via `grok plugin install` or a real-directory copy under
  `~/.grok/plugins/`.
- Hermes Agent static smoke is limited to `tests/test-hermes-agent-candidate.sh`
  until a clean-profile Hermes workflow smoke is observed.