{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "CapabilityPack",
  "metadata": {
    "name": "Gitea Controlled Writer",
    "slug": "gitea-controlled-writer"
  },
  "spec": {
    "description": "Bounded production writes through safe change branches, atomic changesets, managed validation, reviewed pull requests, verified exact-head merge and merged-branch cleanup.",
    "allowedRiskClasses": ["R2", "R3"],
    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
    "toolAllowPatterns": [
      "gitea.repository.create",
      "gitea.branchprotection.ensure",
      "gitea.portfolio.governance.apply",
      "gitea.branch.create",
      "gitea.issue.create",
      "gitea.issue.update",
      "gitea.issue.comment.create",
      "gitea.file.create",
      "gitea.file.update",
      "gitea.file.delete",
      "gitea.pullrequest.create",
      "gitea.pullrequest.update",
      "gitea.pullrequest.close",
        "gitea.pullrequest.validation.ensure",
      "gitea.pullrequest.sync",
      "gitea.pullrequest.merge",
      "gitea.branch.delete",
      "gitea.changeset.apply",
      "gitea.validation.run",
      "gitea.workspace.run",
      "gitea.orchestration.start"
    ],
    "toolDenyPatterns": [
      "gitea.repository.delete",
      "gitea.*.admin",
      "gitea.*.force*",
      "gitea.repository.*.update"
    ],
    "environmentConstraints": {"productionWrites": true}
  }
}