{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "CapabilityPack",
  "metadata": {"name": "AppOps Operator", "slug": "appops-operator"},
  "spec": {
    "description": "Bounded server inspection and typed AppOps operations governed by identity, binding and exact-target policy without shell or Docker socket access.",
    "allowedRiskClasses": ["R0", "R1", "R2", "R3"],
    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
    "toolAllowPatterns": ["server.*"],
    "toolDenyPatterns": ["server.*.admin", "server.shell.*", "server.secret.*", "server.docker.*"],
    "environmentConstraints": {"productionWrites": true}
  }
}