diff --git a/docs/UPSTREAM-CAPABILITY-MATRIX.md b/docs/UPSTREAM-CAPABILITY-MATRIX.md
new file mode 100644
index 0000000..fd7f991
--- /dev/null
+++ b/docs/UPSTREAM-CAPABILITY-MATRIX.md
@@ -0,0 +1,52 @@
+# C0PY Upstream Capability Matrix
+
+This matrix defines how C0PY consumes high-value upstream ideas without creating duplicate runtimes or conflicting sources of truth.
+
+| Upstream | Classification | Adopt | Do not adopt |
+|---|---|---|---|
+| Mahanaicoach/ai-site-cloner | CHERRY_PICK / REIMPLEMENT | deterministic extraction, compact state deltas, responsive probes, canvas capture patterns, spec generation/linting, pixel + CSS root-cause QA, resumable manifests | duplicate orchestration/runtime ownership |
+| jongko54/webEmbedding | CHERRY_PICK / REIMPLEMENT | HAR capture/replay contracts, authenticated storage-state capture, evidence artifacts, replay-readiness, failure taxonomy, verification patterns, MCP surface | a second canonical evidence model |
+| tentenco/ai-website-clone | REIMPLEMENT / REFERENCE_ONLY | clone/adapt/blend modes, evidence-confidence model, reference ledger, motion audit, deterministic acceptance gates | duplicate capture pipeline |
+| Omerfaruk-aydn/sitecloner | CHERRY_PICK / REIMPLEMENT | media discovery, yt-dlp/ffmpeg integration patterns, animation extraction, interaction maps, source/clone recording and frame comparison | duplicate browser crawler and visual diff core |
+| microsoft/playwright | DEPENDENCY | canonical browser automation/runtime | custom replacement browser runtime |
+| Chrome DevTools Protocol | DEPENDENCY | DOMSnapshot, CSS, Animation, Network, Runtime, Accessibility, Performance, Coverage | undocumented browser scraping where a typed CDP domain exists |
+| apify/crawlee | DEPENDENCY | request queue, crawl graph, browser crawl orchestration | separate canonical route ontology |
+| browser-use/browser-use | ADAPTER | semantic exploration, task/workflow discovery | low-level deterministic measurement |
+| browser-use/browser-harness | ADAPTER | authenticated real-browser/CDP exploration | canonical IR ownership |
+| rrweb-io/rrweb | DEPENDENCY / ADAPTER | DOM mutation timeline, interaction record/replay | replacing C0PY evidence contracts |
+| BabylonJS/Spector.js | ADAPTER | optional WebGL frame forensics | mandatory core dependency |
+| mapbox/pixelmatch | DEPENDENCY | deterministic pixel diff primitive | single release score |
+| dequelabs/axe-core | DEPENDENCY | accessibility verification | copied implementation |
+| Google Lighthouse | DEPENDENCY / TOOL | performance/runtime comparison | product behavior truth |
+| gildas-lormeau/SingleFile | ADAPTER | archival/reference snapshot only | copied AGPL code in C0PY core |
+| webrecorder/browsertrix-crawler | ADAPTER | optional WARC/WACZ archival service | copied AGPL code in C0PY core |
+| Stagehand | ADAPTER | semantic observe/extract/act where deterministic selectors are insufficient | source-of-truth capture engine |
+
+## Import rules
+
+1. Every source-derived implementation must record repository, commit SHA, source files, license, integration method and tests.
+2. MIT/ISC/Apache components may be integrated according to their license and notices.
+3. Copyleft components must stay behind a separately deployable adapter unless a deliberate licensing decision says otherwise.
+4. Prefer dependencies over vendoring when the upstream public API is stable and sufficient.
+5. Prefer reimplementation from behavior/specification when importing code would create architectural duplication.
+6. No upstream project may define C0PY's schema, ontology or release criteria.
+
+## Provenance record example
+
+```yaml
+capability: visual-css-root-cause
+classification: CHERRY_PICK
+source:
+  repository: Mahanaicoach/ai-site-cloner
+  commit: <sha>
+  files:
+    - scripts/compare.mjs
+license: MIT
+integration:
+  target: packages/c0py-core/src/verification
+  method: adapted
+tests:
+  - geometry-diff
+  - typography-diff
+  - responsive-diff
+```