master-capability-record

Master Capability Record

This is the index of BrainstormRouter's load-bearing capabilities — what they do, where they live, and which architecture doc explains them in depth. Ship-log entries reference this record under the "Master Record" lockstep checklist.

The goal: if you're new to the codebase and need to know what the system actually does (vs what marketing claims), this is the file to read first.

> Query, don't read. This file is the _human_ fallback. Agents should query > GET /v1/capabilities (or MCP br_capabilities_query) — the machine-native, trust-scored > version of this record (source of truth: src/capability-graph/seed.ts).

Tier 0 — Agent substrate (identity, mesh, grants, custody)

The agent-orchestration foundation — historically omitted from this record, the exact "forgotten powers" the capability graph now surfaces first-class.

CapabilitySourceNotes
CAF agent identity (SPIFFE + CA + registry + kill switch)src/security/caf/* (spiffe.ts, ca.ts, agent-registry.ts, revocation.ts, anomaly-engine.ts)spiffe://brainstorm.internal/agent/{tenant}/{agent}; cryptographic revocation; anomaly trust
A2A mesh (authorized agent-to-agent proxy)src/security/caf/a2a-proxy.ts, mesh-graph.ts, mesh-rbac.tsresolve → RBAC authorize → hop-count → payload inspect → forward → record mesh-graph edge
Trust envelope (signed scoped grants + delegation chain)src/security/trust-envelope/schema.ts, sign.ts, verify.tsbr_principal.parent_chain (delegation), br_budget (caps), br_scope — the mandate substrate
Credential custody (KMS-envelope BYOK vault + local keystore)src/db/stores/tenant-provider-key-store.ts, src/security/local-keystore.ts, src/security/secrets.tsper-tenant customer KMS via STS; resolveSecret() backend; server-side injection (never reveal)
Pi Engine (multi-turn agent runtime + tool exec)src/agents/pi-embedded-runner/, bash-tools.exec-, apply-patch.tssandboxed tool execution with approval + abort
Grok Bot harness (Cursor-plugin MCP + always-on rules)plugins/grok-bot/, .cursor-plugin/marketplace.jsonGrok Bot uses BR as control plane (route/memory/budget); guide docs/guides/grok-bot.mdx

Capability tiers

Each capability is tagged with a tier:

  • Tier 1 — Hot path, every request: failures here are user-visible 5xx
  • Tier 2 — Hot path, fraction of requests: failures degrade specific features
  • Tier 3 — Background: failures eventually visible, not request-blocking

Tier 1 — Hot path, every request

CapabilitySourceArchitecture docNotes
Request authentication (API key, JWT, mTLS)src/api/middleware/auth.tshot-path.mdxRedis cache hit → 0 DB connections; PR #204 folded tenant status into cache blob
Tenant context propagationsrc/db/tenant-context.tstenant-isolation.mdxThree layers: RLS, AsyncLocalStorage, query-builder enforcement
Provider routing (auto / explicit)src/router/model-router.tsthompson-sampling.mdxPer-request auto = capability-matched auto-selector (model-auto-selector.ts: tier floor + learned quality − cost); Thompson-learned leaderboard; cost-quality frontier, strategy sort
Circuit breakers (per provider+model)src/router/circuit-breaker.tscircuit-breakers.mdxCross-task pub/sub recovery (PR #185); cold-start forcedOpen preservation (PR #201)
Budget enforcementsrc/api/middleware/budget.tshot-path.mdx30s in-process tenant-limits cache (PR #203); pipelined recordSpend
Rate limiting (per agent / API key / IP)src/api/middleware/rate-limit.ts, agent-limits.tshot-path.mdxPipelined Redis ops (PR #214); Redis dual-failure-mode coverage (PR #205)
Guardian intelligence (cost prediction, PII scan)src/api/middleware/guardian.tsguardian.mdxLRU-bounded per-tenant Maps (PR #215)
Data-protection policy resolutionsrc/api/middleware/data-protection.ts(TBD)Resolves once after auth, before guardrails and the prompt cache; records only
Routing constraint enforcementsrc/router/model-strategy.ts(TBD)checkEndpointConstraints — never relaxed, including on the starvation path
Evidence receiptssrc/security/evidence-receipt.ts(TBD)evidenceMode: required withholds the completion (503) unless a receipt commits

Tier 2 — Hot path, fraction of requests

CapabilitySourceArchitecture docNotes
Semantic cache (in-memory + pgvector)src/router/model-semantic-cache.tshot-path.mdxTenant-partitioned (PR #213); O(1) LRU eviction (PR #215)
Cost-optimizer cascadesrc/router/model-cascade.ts(TBD)Routes to cheaper model on validity-confirmed completion
Community-tier rate limitsrc/api/middleware/community-tier.tshot-path.mdxPipelined 5 Redis ops → 1 (PR #212)
Workspace file context injectionsrc/api/middleware/agent-context-injector.tstenant-isolation.mdxagentId scoping + role-marker stripping (PR #208)
Prompt sanitizersrc/api/middleware/prompt-sanitizer.tstenant-isolation.mdxDeny-list strip of role-override markers in workspace files
mTLS advisory enforcementsrc/api/middleware/mtls-auth.ts(TBD)Advisory-by-default; flip to strict via gateway.tls.mtls.meshWritesEnforcement (PR #206)
Slack webhooksrc/api/routes/admin.tshot-path.mdxPer-IP rate limit BEFORE HMAC verify (PR #207)

Tier 3 — Background

CapabilitySourceArchitecture docNotes
Model performance trackingsrc/router/intelligence/model-performance.tsthompson-sampling.mdxBatched multi-row INSERT on flush (PR #209)
Shadow comparator (Thompson vs static benchmarks)src/router/intelligence/shadow-comparator.tsthompson-sampling.mdxCross-task ZSET persistence; statistical significance pending n>=200 accrual
Forensic store (CAF anomaly evidence)src/security/caf/forensic-store.ts(TBD)PR #184 fixed pg result-shape handling
Audit chain (tamper-evident operations log)src/security/audit-chain.ts(TBD)Hash-chained append-only
Memory extraction queuesrc/db/schema/memory-extraction.tsextraction-queue.mdxCross-tenant worker; per-job tenant context for writes
Anomaly detection + kill-switchsrc/security/caf/anomaly-engine.ts(TBD)LRU-bounded per-tenant Maps (PR #215)
Sentinel (provider health probing)src/router/endpoint-sentinel.tscircuit-breakers.mdxRecovery-probe filter bypass (PR #187)

Cross-cutting patterns

Patterns that apply across multiple capabilities, not specific to any single subsystem:

Router invariants (no dedicated doc yet)

Two rules the router must not violate. Both were violated in production before 2026-08-05, so they are recorded here rather than left implicit:

  1. Preferences degrade; constraints do not. Strategy, cost ceiling, priority,

circuit-breaker state and context window may all be relaxed when the candidate pool is starved. Provider allow/deny, required capabilities, data retention and region may not — relaxing a preference degrades service, relaxing a constraint breaks a promise. The relax path in model-router-select.ts previously worked by listing what to keep, which silently omitted every constraint added after it was written; checkEndpointConstraints is now the single definition, applied on all three narrowing paths.

  1. Compliance facts are attested, never inferred. Retention, training use and region are

properties of a specific provider ACCOUNT and product, not of a vendor, so they cannot be derived from a provider id. Every fact defaults to unknown, and an unknown fact satisfies no requirement. Detection (PII/DLP classification) may only ever _tighten_ a requirement — a regex miss is not proof that content is free of regulated data.

Capabilities NOT yet documented

The following exist in code but don't have a dedicated architecture doc yet (TBD entries above):

  1. Cost-optimizer cascade (src/router/model-cascade.ts) — deserves its own doc on the validity-confirmed-fallback pattern
  2. mTLS / CAF (Cryptographic Agent Framework) — has dedicated runbook at docs/runbooks/mtls-policy.md but no architecture doc
  3. Forensic store + audit chain — security docs at docs/security/ but no architecture doc on the CAF subsystem
  4. Anomaly detection + kill-switch — referenced in security docs; deserves dedicated coverage
  5. Memory subsystemdocs/concepts/memory.mdx exists at concept level but no architecture-level doc

Maintenance

This file is updated when:

  1. A new capability is added (the relevant ship-log entry should reference this file's row)
  2. An existing capability moves to a different file (update the source column)
  3. A new architecture doc is written for a previously-undocumented capability (move from "NOT yet documented" to a tier table, with the doc link)

If you're working on a substantive change to any Tier 1 or Tier 2 capability, your ship-log entry should reference both this record and the relevant architecture doc.