KR-6 ships the Python mirror of TS-side actorHasCapability
(packages/sea-mcp-server/src/capability-matrix.ts:657). Replaces the
KR-3 ST1 stub at tools/iso_node.py:assert_kora_can_perform (which
always allowed + logged [kora.isokron.todo]
D-kr3-st1-capability-check-deferred) with a real check.

Cheapest-unlock follow-on per PM's pipeline-order note: no substrate
dependency, ~120 LOC including tests, closes one of our own
BUILD_DEVIATIONS entries.

New plugins/memory/isokron/capability_check.py:
* CapabilityDeniedError — carries .capability + .reason (default
  message names the capability; callers can override).
* actor_has_capability(capability) — O(1) dict lookup against the
  existing C2 mirror's ACTOR_CAPABILITY_MATRIX_KORA_COLUMN. Unknown
  capability raises KeyError (fail-LOUD — typo or parity-test drift;
  the parity guard catches mirror divergence on both sides).
* assert_kora_can_perform(capability, *, reason=None) — raises
  CapabilityDeniedError if Kora lacks the cap; KeyError propagates
  for unknown caps.

Behavior change vs the TS reference: TS is fail-closed (unknown cap
returns false); Python is fail-LOUD (unknown cap raises KeyError).
Rationale documented in the module docstring: Python callers are
inside Kora's own code so unknown caps are programmer errors we
want surfaced during testing; TS callers ride through a Sea MCP JSON
boundary where unknown caps can arrive from payloads — fail-closed
there prevents privilege escalation via typo.

Stub replacement:
* tools/iso_node.py — local stub deleted; the public names re-export
  from ..capability_check so existing callers (iso_link.py + tests
  + dispatcher) don't need to change their import paths.
* tools/iso_link.py — imports CapabilityDeniedError directly from
  ..capability_check; previously transitively via iso_node.
* tools/__init__.py — re-exports capability_check public surface.

Tool-handler integration:
* handle_iso_node_tool_call and handle_iso_link_tool_call now catch
  CapabilityDeniedError and surface a structured envelope:
  {"ok": false, "denied": true, "capability": ..., "reason": ...}
  Mirrors the deferred-write envelope pattern from KR-2 ST3 / ST4 /
  KR-3 ST2 — model gets an in-band signal rather than an uncaught
  exception. (Today, all 7 tools require caps Kora has, so this path
  doesn't fire in normal operation — but it's defensive against
  future cap shifts.)

Tests:
* New tests/plugins/memory/test_capability_check.py (11 tests):
  - actor_has_capability granted (cap_sea_create, cap_write_agent_
    scratchpad)
  - actor_has_capability denied (cap_override_security_or_policy_
    verdict, cap_unbless_convention)
  - actor_has_capability unknown → KeyError with diagnostic message
  - assert_kora_can_perform granted (cap_propose_policy_change)
  - assert_kora_can_perform denied → CapabilityDeniedError with
    .capability + default .reason
  - assert_kora_can_perform with caller-supplied .reason
  - assert_kora_can_perform unknown → KeyError propagates
  - Forward-stability: module has no MCP / DB / network imports at
    load time (the K-7 → KR-N swap invariant — must remain a one-line
    import change).
  - Tightness: capability_check.py imports only the C2 mirror — no
    provider / connection / reads / scratchpad / events / relationlink
    pulls (keeps the swap surface tight).

* Existing KR-3 tests updated (the stub-log assertions no longer
  apply):
  - test_iso_node_tools.py: deleted
    test_assert_kora_can_perform_stub_logs_deviation_id; added
    test_assert_kora_can_perform_passes_for_granted_capability +
    test_assert_kora_can_perform_raises_for_denied_capability +
    test_assert_kora_can_perform_raises_keyerror_for_unknown_cap.
  - test_iso_link_tools.py: renamed/flipped
    test_iso_link_traverse_capability_check_logs_deviation →
    test_iso_link_traverse_capability_check_passes_silently
    (asserts no denial envelope + ok=True).
  - test_tool_finalize.py: parametrized
    test_every_iso_tool_logs_capability_stub_deviation → flipped to
    test_every_iso_tool_passes_capability_check_for_granted_caps
    (asserts no denial envelope across all 7 tools).

BUILD_DEVIATIONS:
* D-kr3-st1-capability-check-deferred moved from Open to a new
  Closed section with the spec quote, the forward-stability
  invariant explained, and the tool-handler integration noted.

README "Operator pitfalls":
* Deferred-surface table trimmed from 5 rows to 4 (D-kr3-st1
  removed); a Recently-closed note replaces the entry so operators
  see the resolution at a glance.

Local gates:
* ty check — 7,337 diagnostics, zero-delta vs KR-3 ST3 baseline.
* pytest tests/plugins/memory/ — 326/326 passing (11 new KR-6 + 11
  new flipped + 304 pre-KR-6).
* Full suite via xdist (-n auto): 24,649 / 142 failed / 129 skipped.
  Δ vs KR-3 ST3 (24,625/153/129): +24 passed, -11 failed (xdist
  isolation oscillates; none touch isokron).

4 deferrals remain open pending CC#1 substrate:
* D-kr2-st2-capability-matrix-mirror ← K-7
* D-kr2-st3-no-scratchpad-write-mcp-tool ← K-8
* D-kr2-st4-no-chain-emit-mcp-tool ← K-9
* D-kr3-st2-no-relationlink-write-mcp-tool ← K-10

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>