# Compatibility and evidence boundaries

Discovery, packaging, invocation, delegation and runtime behavior are different claims. The ordinary Markdown skills are portable where a host supports that format. A successful copy/install or static manifest check does not establish native agent execution.

| Surface | Evidence/status |
| --- | --- |
| Existing Agentic init/configs: Rust, Go, TypeScript, Python, Lua, Swift, Kotlin | Preserved baseline/protected hashes and 70 initializer characterization scenarios; not a claim every native compiler ran |
| Local installer copy/link, selected skills, update/uninstall | Executable isolated integration tests, including complete selected EGM bundle and preserved config |
| Remote archive installer | Executable local archive simulation through unchanged download/extract boundary; public remote publication is outside scope |
| npm package | Actual local npm pack, extraction, package CLI/API and selected installed consumer tested |
| Claude Code marketplace | Single Agentic manifest, strict validator; native adapted reviewer execution unverified |
| Codex skill metadata/discovery | Generated metadata; final adapted fresh-stage probe recorded separately in integration report |
| Codex fresh isolation/direct dispatch | Requires fork_turns:none and real read/completion traces; pinned-upstream design review evidence is distinct from adapted bundle evidence |
| Gemini CLI, Antigravity, Cursor, GitHub Copilot | Runtime adapters describe fail-closed capability checks; native invocation/isolation/permissions not verified here |
| Third-party npx skills selected EGM directory copy | Self-contained installed-copy consumer reproduces the relevant package boundary; actual third-party CLI/network not exercised |

| Capability | Codex | Claude Code | Other hosts |
| --- | --- | --- | --- |
| Command discovery | Metadata and directory layout | Marketplace plus direct directory | Host/version dependent |
| Native named personas | Optional; use general agent | Optional; no duplicate registrations | Unknown |
| Fresh contexts | Actual tool must expose fork_turns:none | Verify documented fresh Agent behavior | Must verify host capability |
| Nested dispatch | Direct parent fallback | Direct parent fallback | Direct parent fallback if fresh dispatch exists |
| Reviewer tool permissions | Host dependent; advisory unless enforced | Host allowed-tools policy when available | Unverified |
| Artifact persistence | Parent writes explicit reports | Parent writes explicit reports | Must verify |
| Interactive approval | Human receipt/current trust required for intake | Same cryptographic contract | Same Node contract where executable |
| Runtime product verification | Existing Codinary platform contract | Existing Codinary platform contract | Missing tools remain blockers |

The Node API requires >=18, Git, origin URL and HEAD for handoff revision binding. The Bash installer remains usable without Node; handoff validation requires Node. Existing custom configs are preserved; no automatic plugin/global tool install or upstream update occurs. Unsupported fresh delegation blocks Goldfish, while direct Codinary requests retain their existing semantics and their independent-QA prerequisite.

The adapted installed-copy Codex Stage6 probe completed under `/private/tmp/codinary/unified-agentic-20261028T220833Z/runtime-probe/` with exact input fingerprints, actual fork_turns:none dispatch, full paraphrase/three findings and a seeded parent-only marker sample. Read-only was advisory, not host-enforced. This is one real adapted stage. A separate full five-stage adapted review-only fixture records its actual completion/results under runtime-probe/full-review/; consult its retained manifest rather than infer a pass here. Other native hosts remain unverified. Initial five-stage pinned-upstream proposal review and its capped readiness re-audit failed; neither is substituted for final implementation QA.

## Caveman and Security Audit extension (2026-10-29)

| Surface/capability | Evidence boundary |
| --- | --- |
| Caveman/Security Audit standalone copy/link | Selected independent installation into both existing destinations; no sibling dependency; all resources/notices retained. |
| Archive/npm/directory-copy distribution | Executable local consumers and package-content/reference checks; remote archive transport simulated with a local archive. |
| Workspace/marketplace discovery | Existing `.agents/skills.json` points to `skills`; canonical registry generates the one marketplace list and metadata. Native invocation is separate. |
| Caveman activation/persistence/status | Fresh-context multi-turn behavioral probe, including untracked status, exact payload and full artifacts; hook-based tracking is excluded and unverified. |
| Security guidance/full-audit routing | Source-only focused-review probe and a constrained full-audit probe; missing delegation/sandbox controls are recorded, not simulated as successful independent phases. |
| Security validators | Upstream tests and installed-copy execution establish validator behavior; successful JSON is not proof of audit execution. |
| Full six-phase independent audit | Not established by this integration. Actual fresh hunter/critic/verifier traces, current source evidence, every OS execution limit and parent-only safe promotion must be verified on the chosen host. |
| Other native hosts and third-party installer | Claude/Gemini/Antigravity/Cursor/Copilot native audit execution and actual `npx skills` network invocation remain unverified. |

See [decisions](caveman-security-audit.md) and [observed verification](caveman-security-verification.md). Missing required runtime evidence remains visible; installation never upgrades it to verified support.