feat: add inert capability pack contract

.superpowers/sdd/2026-08-30-m2-capability-pack-contract/task-5-review-record-report.md

@@ -0,0 +1,29 @@
+# Task 5 Review Record
+
+## Scope
+
+Documentation-only update to `docs/superpowers/programmes/2026-08-30-capability-packs-clean-architecture/progress.md`. No manifest or implementation files were changed.
+
+## Recorded state
+
+- M2 is locally complete.
+- Dual final reviews and both scoped round-2 re-reviews are recorded as Approved.
+- Accepted implementation commits: `3f77c426681d3118e5e00cfeee5bb7c9c8c2b663`, `2e6286cc23584d5e82842aacf106c3bb5e7462df`, `4c9af6f0b220a789f30e214d8ff90996f21e1d00`.
+- Final-review Important findings and both fix rounds are recorded resolved; no remaining Critical/Important findings.
+- The `487 PASS, 5 ignored` broad result is explicitly bounded to the earlier candidate; final exact-head host rerun remains pending controller verification.
+- FIFO/nonblocking-open is recorded as a future portable-policy residual, not an M2 blocker.
+- Hosted exact-head CI, push, and draft PR remain unproven and are the next external gate.
+
+## Verification
+
+- `rtk git diff --check` — PASS.
+- Bounded privacy scan of `progress.md` for local paths and common secret markers — zero matches.
+- No tests run; prose-only change.
+
+## Commit
+
+Commit message: `docs: record capability pack review acceptance`
+
+## Follow-up qualification record
+
+At implementation/review-record anchor `6018319a331f09e2731a0f44195e197b96e31abd`, controller checks recorded fmt PASS, strict workspace Clippy PASS, capability contract 27/27 PASS, compatibility manifest 1/1 PASS, M2 manifest 1/1 PASS, empty scoped compatibility diff, diff-check PASS, and host full suite 494 passed/5 ignored/28 suites/10.09s. The next commit is documentation-only evidence recording.

CHANGELOG.md

@@ -9,6 +9,10 @@ Semantic Versioning after its first public release.
 
 ### Added
 
+- Added the pre-1.0 additive Rust capability-pack contract and pinned schema;
+  this does not change existing CLI or receipt schemas and does not enable
+  official pack execution.
+
 - Added auditable economic qualification guidance with machine-readable August
   2026 case-study inputs for Matryca-Knowledge and the private case published as
   Matryca-Brain. The documentation separates quota preservation and GitHub

docs/CAPABILITY_PACKS.md

@@ -0,0 +1,78 @@
+# Capability packs
+
+Status: schema and inert library inspection/expansion only; no official pack execution in M2.
+
+## TOML schema 1.0
+
+Manifests use `schema_version = "1.0"` and strict TOML fields. A manifest is at
+most 1 MiB; it has manifest metadata (`pack_id`, `pack_version`, `license`, and
+`description`), upstream sources, and 1–32 profiles. Each profile has a unique
+identifier, bounded metadata, tools (at most 32), inputs (at most 64), hosts,
+targets, runtime, environment, caches, storage, and checks. Lists are bounded
+to the limits enforced by the library; relative paths are validated and a
+finite known-shell denylist rejects declared shell entrypoints. It does not
+establish that arbitrary argv is safe or shell-free.
+
+## Identity and versions
+
+The pack identity tuple is `(pack_id, pack_version, pack_digest)`.
+Versions are immutable: publishing a changed manifest requires a new version
+and therefore a new digest.
+
+## Images and provenance
+
+Runtime images must be digest-pinned. Tools and upstream inputs carry explicit
+SHA-256-style provenance digests and URLs; an unpinned or missing provenance
+value is rejected.
+
+## Licensing
+
+License values use SPDX-style identifier syntax. Syntax validation is not legal
+review, and operators remain responsible for licensing and attribution review.
+
+## Integrity and freshness
+
+Pack canonical integrity verifies the normalized pack against its pack digest.
+Declared provenance digests are syntax-checked declarations, not proof that
+external bytes match. External preparation and qualification must obtain and
+verify those bytes. Database and rules freshness is separate: inputs may
+declare a creation timestamp and a maximum age, but a valid digest does not
+make stale data fresh.
+
+## Profile binding and expansion
+
+Consumers bind a project, profile identifier, and receipt configuration
+explicitly. Expansion resolves exactly one profile into exactly one normalized
+execution plan, preserving the pack digest and evidence class.
+
+## Expansion is not execution
+
+Expansion only constructs an inspectable plan. It does not acquire resources,
+start a runtime, run checks, create receipts, or qualify a result. No CLI
+command exists for official pack execution yet.
+
+## Preparation and I/O boundaries
+
+Network access is disabled. Any required preparation is external to this
+library. Sources are read-only; outputs must be explicit paths and bounded by
+the existing plan contracts.
+
+## Evidence classes
+
+`deterministic` evidence should repeat exactly. `schedule-sensitive` evidence
+can vary with scheduling or resource timing. `bounded-nondeterministic`
+evidence may vary within documented bounds. The class describes evidence; it
+does not qualify an execution.
+
+## Non-goals
+
+M2 adds no workflow DSL, package manager, tool installer, report interpreter,
+receipt extension, publication mechanism, or policy override.
+
+## M3 entry criteria
+
+M3 may propose the `rust-deep` reference pack only after a reviewed manifest,
+digest-pinned image and provenance, explicit offline preparation, bounded
+inputs/outputs, profile-to-plan tests, freshness and integrity evidence, and a
+separate execution/qualification decision. No such official pack is executable
+from this M2 contract.

docs/superpowers/programmes/2026-08-30-capability-packs-clean-architecture/m2-manifest.json

@@ -0,0 +1,24 @@
+{
+  "schema_version": "1.0",
+  "base_commit": "2e6286cc23584d5e82842aacf106c3bb5e7462df",
+  "files": [
+    {"path":"CHANGELOG.md","bytes":20296,"sha256":"sha256:bf3cd42627ff40e23490d0cf4a36d640e5c08feaef2af4d1779172464722b54c"},
+    {"path":"docs/CAPABILITY_PACKS.md","bytes":3231,"sha256":"sha256:434c95d26a9fb75916037391cc5322095ccfd660155d315464735815d8fc079b"},
+    {"path":"schema/capability-pack-v1.schema.json","bytes":11325,"sha256":"sha256:2c35b17807ef85a4ba79343c3d1948fd185ca7d5f1dc9a6b1dbf15b9635b8f09"},
+    {"path":"src/capability_pack.rs","bytes":35849,"sha256":"sha256:3b395715921b15732727c3762fc2d43b965184c1087dde9db948b6ce745ade0c"},
+    {"path":"src/lib.rs","bytes":1036,"sha256":"sha256:55f5edc35ac49ff0dbcb10723986c3da239b23788a757c232d14071e8c20644b"},
+    {"path":"tests/capability_pack_contract.rs","bytes":34412,"sha256":"sha256:5e90941506da053d2fd61e1a14f852e25d57fe057fbf87cea9a96d6685a8ecce"},
+    {"path":"tests/fixtures/capability-pack-v1/dependency-cycle.toml","bytes":2067,"sha256":"sha256:aa88ff2c9931d23ddba372f045bc402bad514085fa13a3f159dbf78172030e3d"},
+    {"path":"tests/fixtures/capability-pack-v1/invalid-image.toml","bytes":1910,"sha256":"sha256:64cbf330a32076072587b0498e8248284e8c67ba0370b35b0a278e980360f7ab"},
+    {"path":"tests/fixtures/capability-pack-v1/invalid-license.toml","bytes":1989,"sha256":"sha256:1d42945238ec458f03cfee56225894febf6d35b7398e26c5698c2746f614df29"},
+    {"path":"tests/fixtures/capability-pack-v1/invalid-path.toml","bytes":1978,"sha256":"sha256:55978cd2012ba27ca09184fe3384fd6970c58dc415548672eb723b43bd6a1f03"},
+    {"path":"tests/fixtures/capability-pack-v1/invalid-provenance.toml","bytes":1982,"sha256":"sha256:1d02a3904553e47cb6db807197ef92670634689382cb89429efbc0d3942aa5b5"},
+    {"path":"tests/fixtures/capability-pack-v1/shell-entrypoint.toml","bytes":1912,"sha256":"sha256:8dcafc09f7e3d700ed2b71ebe6022701a4d69a71183b392901d25e349afda220"},
+    {"path":"tests/fixtures/capability-pack-v1/unknown-field.toml","bytes":1981,"sha256":"sha256:5b9231953f27054741d8e9f6fe407002e1aa52d6c5bec10f25f4d88d74c4fb40"},
+    {"path":"tests/fixtures/capability-pack-v1/unknown-version.toml","bytes":1963,"sha256":"sha256:fb264d537d8d5a350a954bc031cc61ca0c9deb4340501922d311c2728960e988"},
+    {"path":"tests/fixtures/capability-pack-v1/valid-minimal.canonical.json","bytes":2217,"sha256":"sha256:ae9ccb5ea2e26759b8f8364fc19aebf112b8dcd70075c33a4c952e489559b8ce"},
+    {"path":"tests/fixtures/capability-pack-v1/valid-minimal-reordered.toml","bytes":1982,"sha256":"sha256:1b790425e89bc32eebd1f5b96e5cbaa7d85a5c2d5559831bcb62abd687f7f7e3"},
+    {"path":"tests/fixtures/capability-pack-v1/valid-minimal.strict-clippy.expansion.json","bytes":1321,"sha256":"sha256:20859fc142a923b9f3b46bbb5d11e685b39128eda1d9c59269bcdad56decc602"},
+    {"path":"tests/fixtures/capability-pack-v1/valid-minimal.toml","bytes":1982,"sha256":"sha256:3e90fb7b3c6294de423651d22a2f23b3b4ab20bd7e66f48f996535ad46f6b2eb"}
+  ]
+}

docs/superpowers/programmes/2026-08-30-capability-packs-clean-architecture/progress.md

@@ -2,9 +2,9 @@
 
 - Base: `5fed7c443504969e62980141048f9279f9fa1dfe`
 - Predecessor: `17e069a7eb3bcc6596c93bb6432984eba8472208`
-- Branch: `codex/capability-packs-clean-architecture-delivery-v1`
+- Branch: `codex/capability-pack-contract-v1`
 - Specification commit: `5ef9707930f7095a2f57bc3e38e53bfeac06aaf2`
-- Current milestone: M2 Capability Pack contract plan (ready; implementation gated by hosted CI)
+- Current milestone: M2 locally complete; dual final reviews and both scoped round-2 re-reviews Approved
 - Completed evidence: design review READY; `git diff --check` PASS; M0 compatibility manifest and downstream facade checks independently approved at `9e689c7f04e3d8c0479c74d91669c170a4c66e52`
 - Terminal M0 verification: `rtk cargo fmt --check` PASS; focused manifest test PASS; full compatibility baseline PASS (9 passed, 1 ignored); `rtk git diff --check` PASS; bounded privacy scan PASS (zero matches)
 - M0 status: terminally closed; Spec PASS and Task quality Approved
@@ -17,8 +17,21 @@
 - M2 plan commit: `a1c922d4f47fd06e74a336b89a19aecc703908bd`
 - M2 plan decision: TOML-only schema `1.0`; library-first inert validation/inspection; explicit one-profile binding into the existing schema-`1.3` plan; separate pack and plan digests; no CLI, receipt, policy, execution, or publication change in M2
 - M2 plan review: initial NOT_READY findings for implicit types/helpers and missing error mappings were corrected; final Luna re-review READY with no Critical or Important findings
-- Unproven: hosted CI for the exact M0-M1-plus-plan head, push, draft PR, publication, and release gates; all M2 implementation; reference packs
+- M2 accepted implementation commits: closure `3f77c426681d3118e5e00cfeee5bb7c9c8c2b663`, hardening `2e6286cc23584d5e82842aacf106c3bb5e7462df`, final gap fix `4c9af6f0b220a789f30e214d8ff90996f21e1d00`.
+- M2 accepted reviews: dual final reviews and both scoped round-2 re-reviews Approved. Final-review Important findings and both fix rounds are resolved; no remaining Critical or Important findings.
+- M2 implementation history includes the pre-closure anchor `da3849b0c6b06d7992ee4c68cf5d9d6e2781425f` (`docs: define capability pack contract`); accepted closure and hardening follow below.
+- M2 local qualification: rustfmt PASS; strict workspace Clippy PASS; capability-pack contract 20 PASS before Task 5 test; compatibility baseline 9 PASS, 1 ignored; plan CLI 11 PASS; matrix contract 16 PASS; receipt contract 10 PASS; verification contract 20 PASS, 1 ignored. The original sandbox broad run stopped at 279 PASS, 3 `Operation not permitted` denials, 1 ignored. Controller repeated the same exact broad command under narrow host permission on the earlier candidate: 487 PASS, 5 ignored, 28 suites, 7.65s. The host result is qualification evidence for that candidate; final exact-head host rerun remains pending controller verification. Sandbox denials are neither product failures nor PASS.
+- M2 compatibility evidence: scoped diff against `5fed7c443504969e62980141048f9279f9fa1dfe` over CLI/config/matrix/receipt/verify and v1/v2 schema surfaces was empty. The available exact compatibility manifest test `manifest_paths_and_hashes_match` passed 1/1. The brief's named `manifest_matches_the_exact_compatibility_corpus` filter selected no test (0 PASS, 10 filtered) and is not treated as evidence.
+- M2 closure evidence: `m2-manifest.json` schema `1.0` anchors the pre-closure HEAD and lists 18 sorted path/byte/SHA-256 entries. Its contract test observed RED because the manifest was absent, then GREEN 1/1 after creation.
+- M2 final-review findings accepted for one separate fix commit: `load` had a path-metadata/reopen TOCTOU window and no explicit regular-file policy; public envelope and expansion wrappers could be mutated after validation; HTTPS authority checks accepted malformed hosts and ports; derived envelope Debug could disclose fixed-environment literals. Documentation also overstated identity, arbitrary argv safety, and provenance-digest verification.
+- M2 final-review fix anchor: `3f77c426681d3118e5e00cfeee5bb7c9c8c2b663`; its scoped specification-compliance and code-quality/security re-review is accepted below.
+- M2 final-review round 1 re-review found three remaining findings: documentation still called manifest metadata an identity; the strict HTTPS change rejected a valid no-port bracketed IPv6 authority while accepting fragments; and expansion retained derived Debug that could disclose fixed-environment literals. Round 2 corrects only those findings. The FIFO/nonblocking-open residual is explicitly out of scope pending separate portable policy design.
+- M2 final-review round-2 fix anchor: `2e6286cc23584d5e82842aacf106c3bb5e7462df`; final gap fix/current implementation HEAD before this review-record commit: `4c9af6f0b220a789f30e214d8ff90996f21e1d00`.
+- FIFO/nonblocking-open remains an explicit future portable-policy residual, not an M2 blocker.
+- M2 residual boundary: inert library validation and expansion only. No official pack, CLI entry point, tool/image qualification, Docker execution, hosted exact-head result, push, PR update, merge, stable installation, tag, or release is implied. M3 must first review the `rust-deep` tool/image/license matrix and design the smallest user entry point without weakening M0 compatibility guarantees.
+- M2 final local qualification at `6018319a331f09e2731a0f44195e197b96e31abd`: fmt PASS; strict workspace Clippy PASS; capability contract 27/27 PASS; compatibility manifest 1/1 PASS; M2 manifest 1/1 PASS; scoped compatibility diff empty; diff-check PASS; host full suite 494 passed, 5 ignored, 28 suites, 10.09s. Worktree was clean before this documentation update.
+- `6018319a331f09e2731a0f44195e197b96e31abd` is the locally qualified implementation/review-record anchor. This follow-up is documentation-only evidence recording; it makes no source, schema, or manifest change.
+- Unproven: hosted exact-head CI, push, draft PR, publication, release gates, and reference packs. No external mutation occurred.
 - Heavy processes: none
 - External mutations: none
-- Restart checkpoint: requested 2026-08-30; tracked handoff and resume prompt added under `restart/2026-08-30/`; the final exact branch and external archive hashes are recorded in the persistent `RECOVERY_MANIFEST.md`
-- Next action after restart: complete the handoff's read-only audit, then obtain an exact bounded authorization to fetch `origin`, push the unchanged branch non-forced, open a draft PR, and require terminal hosted CI before dispatching M2 Task 1
+- Next action: exact non-force push/draft PR/hosted CI authorization.