{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "CapabilityPack",
  "metadata": {"name": "OpenCode Read-Only Analysis", "slug": "opencode-analysis"},
  "spec": {
    "description": "Optional asynchronous plan analysis with a deliberately read-only workspace mount.",
    "allowedRiskClasses": ["R0", "R1"],
    "scopeTemplates": ["project:{project}:read"],
    "toolAllowPatterns": ["opencode.analysis.*", "opencode.delivery.repositories.list", "opencode.delivery.jobs.list", "opencode.delivery.status", "opencode.delivery.result"],
    "toolDenyPatterns": ["opencode.job.*", "opencode.analysis.*.shell*", "opencode.analysis.*.admin*"],
    "environmentConstraints": {"productionWrites": false}
  }
}