{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "CapabilityPack",
  "metadata": {
    "name": "Developer",
    "slug": "developer"
  },
  "spec": {
    "description": "Read capabilities plus bounded non-production developer workflows. Write tools remain absent from v1.0.",
    "allowedRiskClasses": [
      "R0",
      "R1",
      "R2"
    ],
    "scopeTemplates": [
      "hub:catalog:read",
      "project:{project}:read",
      "project:{project}:develop"
    ],
    "toolAllowPatterns": [
      "project.status.get",
      "knowledge.*",
      "gitea.*.list",
      "gitea.repository.get",
      "gitea.code.search",
      "gitea.file.read",
      "deployment.project.status",
      "deployment.stack.inspect"
    ],
    "toolDenyPatterns": [
      "*.delete",
      "*.execute",
      "*.restart",
      "*.redeploy",
      "*.rollback",
      "database.query.*"
    ],
    "environmentConstraints": {
      "productionWrites": false
    }
  }
}