A capability is more than a prompt#
A capability is a versioned bundle that can contain any of these:
| Part | What it is |
|---|---|
| Skills | Standard Agent Skills directories (SKILL.md plus references). Work in any agent that reads skills. |
| Tools | Programs an agent can call: Node, Python or native binaries. They receive JSON and return JSON. |
| Workflows | Multi-step recipes: tool steps run by the host, agent steps handed back to the agent. |
| Knowledge | Structured reference material, shipped or fetched remotely. |
| Assets | Images, video, audio, fonts and other media. |
| Resources | Large remote files (datasets, indexes, weights) pinned by hash, fetched when needed. |
| Adapters | Descriptions of models and inference backends it can use. |
Dependencies, platform requirements, Free or Pro metadata and the permissions it needs sit in the manifest, capability.json.
Identity: content, not names#
A package is identified by the SHA-256 of its manifest, and the manifest lists the SHA-256 of every file. Change a byte and the identity changes. Builds are reproducible: the same source gives the same bytes.
Trust: who vouches for what#
registry root key ──signs──▶ catalogue (publishers' keys, package document hashes)
publisher key ──signs──▶ package (id, version, manifest digest)A client pins the registry root key. From the signed catalogue it learns each publisher's public keys and the hash of each package document, then checks every archive against the hash in its entry and the publisher's signature inside the archive. Mirrors need not be trusted: a mirror cannot serve bytes that do not match.
The catalogue carries a sequence number. A client refuses an older catalogue than it has already seen, so an attacker cannot roll it back to hide a revocation.
Permissions: declared, shown, granted#
Every capability lists what it may do, each with a reason: read or write files in your workspace, connect to a named host, start a program, read an environment variable. You see this list at install. A tool can use only the permissions it names, and an update that asks for more asks you again.
Nothing runs at install or browse time#
There are no install scripts. Browsing the directory shows metadata only. Installing downloads, verifies and unpacks files. Code runs only when a host calls a declared tool, and then inside a sandbox.
Versions, updates and rollback#
Versions are semantic. Updates stay inside the major version unless you ask. Older versions stay on disk after an update, so arcotheon rollback switches back in an instant (after re-checking the files). A rollback pins the version so a later update does not silently undo it.
The registry can mark a version yanked (not chosen automatically), revoked (never installed or run) or a capability deprecated. arcotheon doctor tells you about them.
Free, Pro and entitled downloads#
A capability may be marked pro and entitled. The registry records this, and the catalogue stays public so people can find it. The host application enforces the tier, and downloads of entitled archives and resources go through an authoriser the host provides (for AgentDock, backed by its Sarja account). See AgentDock integration.