# Runtime capability observations

Baseline: upstream DSH `639ed015397290b3745d163aafe02ffee4aa3f84`.

| Surface | Verified behavior | Limit |
|---|---|---|
| Core | Native subprocess imports neutral core/authority only; external anchor owns intent | Shared OS governance, not actor authentication |
| Root continuation | Native Workspace + persisted root Session/new Agent resumes exact anchor | Missing/changed native workspace anchor fails closed |
| Policy | Native Settings live forms, stored edits, revision conflicts; editable prompt and legal empty role list | Deployment paths use native ordinary plugin configuration |
| Models | Native exact route metadata and configured allowed-set membership | No route ranking or online catalog smoke |
| Children | Fresh native spawn, bounded handoff, allowlist plus body checks, immediate ID/correlation recording | Current supported provider is local in-process spawn |
| Recovery | Native catalog correlation + durable terminal Session reason; archived reservation; completed/aborted tested | Unbound/cross-process liveness remains UNKNOWN; no uncertainty auto-release |
| Memory | Optional independent capability/provider packages; async external injection, bounded read/search/write and user grants | No embeddings/vector/RAG/credential management |
| Memory writes | Disabled default, manual/review Core proposals, human Remote approval, explicitly opted-in auto | Approval is human-client governance within native Host trust |
| Uninstall | Native effects dispose provider/capability; routing and close continue | Native package-manager UI installation/removal smoke is pending |
| Remote | Native Gateway SRC dispatch of templates, diagnostics, and approval; temporary Web preview rendered the client and injected its API namespace | Extracted-package verification does not launch a browser; the original source repository's live Web integration was separately verified against Core source revision `256f760` |

Tests use real native source components and a scripted LLM. They do not establish Codex managed enforcement, universal process authentication, or semantic task completion authority.