{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "CapabilityPack",
  "metadata": {
    "name": "Infrastructure Reader",
    "slug": "infrastructure-reader"
  },
  "spec": {
    "description": "Read-only Unraid and internal Hub observability with secret-safe output.",
    "allowedRiskClasses": [
      "R0",
      "R1"
    ],
    "scopeTemplates": [
      "project:{project}:read",
      "infra:unraid:read"
    ],
    "toolAllowPatterns": [
      "project.status.get",
      "unraid.host.*",
      "unraid.storage.*",
      "unraid.container.list",
      "unraid.container.inspect",
      "unraid.container.health",
      "unraid.container.logs",
      "unraid.network.list",
      "observability.health.summary",
      "observability.logs.search"
    ],
    "toolDenyPatterns": [
      "*.create",
      "*.update",
      "*.delete",
      "*.execute",
      "*.restart",
      "*.rotate",
      "*.renew"
    ],
    "environmentConstraints": {
      "productionWrites": false
    }
  }
}