# Capability Matrix

## Outcome

See what works today across channels, providers, and platforms, including caveats.

## Channels

| Area | Support level | Notes / caveats |
|---|---|---|
| Telegram | Verified | Webhook mode + long-polling fallback supported. |
| Discord | Verified | Gateway + outbound flows supported. |
| Slack | Implemented (smoke pending) | Runtime wiring present; live smoke evidence pending. |
| Signal | Implemented (smoke pending) | Inbound polling, typing indicators, and append-time read receipts are implemented; live smoke evidence pending. |
| Matrix / Element | Implemented (smoke pending) | Native `matrix-sdk` runtime with E2EE, encrypted SQLite store, cross-signing bootstrap, SAS device verification (`cara matrix verify/accept/confirm/cancel`), recovery-key handling (CLI-only `cara matrix recovery-key show/restore`), and store-key rotation (`cara matrix rekey-store --new`). Live smoke evidence pending. |
| Hooks (automation) | Verified | Token-authenticated wake/agent/mapping endpoints. |

## Providers

| Provider | Support level | Notes / caveats |
|---|---|---|
| Anthropic | Verified | Streaming + tools + cancellation. |
| OpenAI | Verified | Streaming + tools + cancellation. |
| Codex | Verified | OpenAI subscription-login auth profile via explicit `codex:` routing. |
| Gemini | Verified | Streaming + tools + cancellation. |
| Vertex AI | Verified | Gemini (Google) via `streamGenerateContent`; third-party publishers (Anthropic, Meta, Mistral, Nvidia) via `streamRawPredict`. |
| Ollama | Verified | Local serving path supported. |
| Bedrock | Verified | SigV4 + streaming/event path wired. |
| NEAR AI Cloud | Verified | OpenAI-compatible provider wiring; Carapace does not independently verify TEE attestation. |
| Venice AI | Verified | OpenAI-compatible wrapper/provider wiring. |
| Claude CLI | Implemented | Local Claude CLI-backed provider via explicit `claude-cli:` routing. |

## Tools / local workspace

| Area | Support level | Notes / caveats |
|---|---|---|
| Filesystem tools | Verified | `file_read`, `directory_list`, `file_stat`, and `file_search` register when `filesystem.enabled = true`. `file_write` and `file_move` require `filesystem.writeAccess = true`. Access stays inside configured roots and excludes, and config changes require restart. |

## Platform/runtime

| Area | Support level | Notes / caveats |
|---|---|---|
| Control UI (`/ui`) | Foundation shipped | Auth/session handling, status/channels, redacted config read + safe patch path, task operator actions, pairing flow. |
| macOS sandboxing | Verified | Seatbelt + limits for sandbox-required subprocess paths. |
| Linux sandboxing | Verified | Landlock + limits for sandbox-required subprocess paths. |
| Windows sandboxing | Partial | Job Objects + AppContainer paths; unsupported deny-network spawn paths fail closed. |
| Unsupported targets | Verified fail-closed | Sandbox-required subprocess flows are rejected rather than unsandboxed. |

## Source of truth

- [Feature status inventory](../feature-status.yaml)
- [Feature evidence inventory](../feature-evidence.yaml)
- [Channel smoke playbook](../channel-smoke.md)
