{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "CapabilityPack",
  "metadata": {
    "name": "Project Reader",
    "slug": "project-reader"
  },
  "spec": {
    "description": "Project knowledge, repository metadata and sanitized health/log visibility without writes.",
    "allowedRiskClasses": [
      "R0",
      "R1"
    ],
    "scopeTemplates": [
      "hub:catalog:read",
      "project:{project}:read"
    ],
    "toolAllowPatterns": [
      "project.status.get",
      "knowledge.*",
      "gitea.capabilities.get",
      "gitea.connection.check",
      "gitea.selftest.run",
      "gitea.repository.get",
      "gitea.repository.context",
      "gitea.repository.health",
      "gitea.branchprotection.get",
      "gitea.branchprotection.preview",
      "gitea.branch.list",
      "gitea.commit.list",
      "gitea.commit.get",
      "gitea.ref.compare",
      "gitea.release.list",
      "gitea.issue.list",
      "gitea.issue.search",
      "gitea.pullrequest.list",
      "gitea.pullrequest.get",
      "gitea.pullrequest.feedback",
      "gitea.commitstatus.list",
      "gitea.code.search",
      "gitea.research.search",
      "gitea.research.fetch",
      "gitea.file.read",
      "gitea.tree.list",
      "gitea.changeset.preview",
      "gitea.validation.get",
      "gitea.validation.failure.get",
      "gitea.validation.list",
      "gitea.change.status",
      "gitea.change.review",
      "gitea.change.reconcile",
      "gitea.workspace.status",
      "gitea.portfolio.health",
      "gitea.portfolio.governance.preview",
      "gitea.portfolio.governance.verify",
      "gitea.orchestration.plan",
      "deployment.project.status",
      "deployment.stack.inspect"
    ],
    "toolDenyPatterns": [
      "*.create",
      "*.update",
      "*.delete",
      "*.execute",
      "*.restart",
      "*.redeploy",
      "*.rollback"
    ],
    "environmentConstraints": {
      "productionWrites": false
    }
  }
}