Agent capabilities v26.5+ PREVIEW
Kubling is not an AI agent. It exposes bounded capabilities that applications, orchestrators and external agent runtimes can invoke over federated data. The runtime plans each task; Kubling owns the caller identity, visible context, query validation, execution policies and limits.
Agent capabilities are Preview. The runtime capability documented here is
investigation. Pin compatible components and validate the complete
deployment before production use.
Responsibility boundary
The runtime does not receive source credentials, an unrestricted engine session or authority to bypass VDB policies. Responsibilities are divided as follows:
| Kubling owns | The runtime owns |
|---|---|
| Authentication and the initiating caller. | Task planning and reasoning. |
| Caller-visible catalog, functions and semantics. | Selecting the next supported action. |
| Logical Query validation and SQL compilation. | Interpreting bounded observations. |
| Authorization, federation and physical execution. | Producing conclusions and other artifacts. |
| Task, observation and execution limits. | Reporting usage and an explicit stop reason. |
Runtime integration
The authenticated Task API selects one VDB and creates a bounded task from a caller-filtered context snapshot. The runtime may request Logical Query actions; Kubling validates and executes accepted actions as the initiating caller and returns bounded observations. The request completes with a terminal task snapshot.
The runtime may be local to one Kubling instance or shared by several instances.
instanceIdentifier and the VDB target prevent their registered contexts from
being mixed.
Documentation map
| Surface | Purpose |
|---|---|
| Investigation | Goal-driven, multi-step analysis over one authorized VDB context. |
| Task API | Authenticated fire-and-resolve HTTP API and versioned task snapshots. |
| Logical Query v1 | Structured, bounded query actions compiled by Kubling. |
| Configuration | Runtime connection, context publication, budgets and timeouts. |
| Security boundary | Caller propagation, runtime credentials and production controls. |
The legacy /agent/* API is deprecated. New
integrations should use the native capability Task API.
Deployment status
This documentation defines Kubling’s integration contract. Packaging, image names and model-provider configuration for the separate agent runtime are released by that component and are not frozen here yet. Do not infer runtime compatibility from the presence of the Task API alone.