{
  "apiVersion": "hub.example.com/v1alpha1",
  "kind": "CapabilityPack",
  "metadata": {"name": "OpenCode Governed Agent", "slug": "opencode-agent"},
  "spec": {
    "description": "Preview-gated asynchronous OpenCode jobs in explicitly registered workspaces and exact allowlisted models.",
    "allowedRiskClasses": ["R0", "R1", "R2", "R3"],
    "scopeTemplates": ["project:{project}:read", "project:{project}:write"],
    "toolAllowPatterns": ["opencode.*"],
    "toolDenyPatterns": ["opencode.*.shell*", "opencode.*.admin*", "opencode.*.provider*"],
    "environmentConstraints": {"productionWrites": true}
  }
}