Capability Reflexes: The Pre-Reasoning Fast Path

When you ask the Companion to "show my Passport settings," you should not wait 1.5 seconds while a model decides to open a surface you already own. That request is not reasoning work — it is a governed control-plane action with a known binding. Capability Reflexes exist to execute that class of intent at reflex latency (~15ms) while preserving HumanOS policy gates.

Reflex vs. reasoning

	Reflex	Reasoning
Latency	~10–50ms	~500–3000ms
Mechanism	Local alias + capability index	LLM + tool loop
Best for	Settings, canvases, safe reads	Novel tasks, synthesis
Governance	Risk tier + proposal/escalate gates	Full pipeline + HITL

The reflex layer runs before the Reasoning Service on every eligible surface: Companion chat, workflow capability steps, and in-process human.call('passport.settings.view').

Four lanes in plain language

1. Direct match — Your phrase exactly matches a registered alias or capability ID. Example: "show my passport settings" → open the Passport settings canvas immediately.
2. Near match — Similar phrasing via example/trigram scoring. The system may ask you to clarify if multiple capabilities tie.
3. Proposal — Mutations (disconnect connector, revoke delegation) never auto-execute; you get a confirmation/proposal surface instead.
4. Safety / fall-through — Destructive intents (delete Passport) escalate to human review; unknown gibberish routes to normal reasoning.

Critical rule: delete my passport never returns silent execution — it always hits the safety escalation binding.

Add a reflex in five lines (bundle command)

// In your BundleManifestV1 commands[]:
{
  id: 'open_report',
  name: 'Open report',
  description: 'Show the weekly report canvas',
  icon: 'lucide:BarChart',
  canvas_kind: 'weekly_report',
  capability_id: 'acme.report.view',
  intent_triggers: ['show weekly report', 'open report'],
  autonomous_ok: true,
}

Reinstall or recompile the hot-path bundle — no separate routing config.

Universality

The same CapabilityReflexEntry index is consulted from:

• Companion BFF — pre-model check on /api/companion/call
• Workflow steps — capabilityStep('id', 'passport.settings.view')
• human.call() — in-process resolver when the target is a capability ID (no :// scheme)
• Agent SDK — ctx.reflex() for cross-boundary HTTP resolution

Magic by default: bundle commands with canvas_kind + intent_triggers auto-index; muscles declare reflex_capabilities[].

Namespace protection

First-party namespaces (passport.*, core humanos.*) ship signed in FIRST_PARTY_CAPABILITY_BINDINGS. External publishers register extensions under their own namespace with stricter risk caps — preventing a third-party bundle from hijacking identity settings.

Developer tooling

human reflex list
human reflex test "show my passport settings"
human reflex inspect passport.settings.view

Full guide: Capability Reflexes runbook in the monorepo.

What we measure

Every reflex resolution can emit a capability_resolution gate event (lane, capability ID, latency, rationale code). Wrong-route feedback feeds the learning flywheel without exposing raw conversation content.

---

Capability Reflexes do not replace reasoning — they reserve reasoning for work that actually requires it. That is how HUMΛN keeps control-plane interactions feeling instant, owned, and trustworthy.