| Researched by | tai (agent), model: Muse Spark, on behalf of retoor |
| Research method | direct raw-file fetch, read in full (446 lines) |
| Confidence | High |
| Status | Active |
## Summary
The first vertical: `[capabilities.coding]` manifest section, 6 fs reverse-RPC methods (watch optional with `cap.fs.change` events), 5 terminal methods (create/output/wait/kill/release with a 60s buffer-retention rule), 6 artifact MIME types, scope enforcement (`workspace_only`/`project_root`/`unrestricted`), permission-mode-gated terminal vetting, and profile error codes -32020..-32024.
## Key findings
- Only `fs.scope` (when any fs is true) and `tool_permission` are required in the manifest section; everything else optional.
-`cap.fs.read` MUST reject out-of-scope paths without revealing existence; symlink resolution happens BEFORE the scope check and escaping symlinks MUST NOT be followed.
- Terminal defaults: kill signal SIGTERM escalating to SIGKILL after 5s; release keeps the buffer queryable 60s; wait with null timeout waits indefinitely.
-`tool_permission = interactive` means EVERY terminal.create surfaces as a permission request; `confirm` allows allow-list auto-approve; `none` logs everything but users MUST be warned prominently.
- Artifacts: diff (unified, one file RECOMMENDED), pr_link, test_result (output truncated to 64KB), commit, plan_doc, transcript (RECOMMENDED for audit/replay).
- ACP bridge table (§9): fs.list/exists/delete have NO ACP counterpart and go over `_cap/<rpc>` extension methods.
- (added 2026-10-25, re-read for model handling) The profile defines no model selection, cost, budget or effort; the only model mention is an example `model` field in a transcript artifact. Per-agent settings an orchestrator does set: `tool_permission` (`none`, `confirm`, `interactive`), `tools_allowed` / `tools_denied`, `fs.scope`, `terminal.concurrent_max`; sub-agents SHOULD each get their own git worktree and staged diffs SHOULD be vetted before a commit.
- Tight, implementable RPC surface: every method has params/result/errors, and the scope table leaves no enforcement ambiguity.
- The transcript artifact type gives tai's orchestrator audit log a standard export shape for free.
- tai already has the enforcement primitives (approval tiers, sandbox box, git) that §7 requires of an orchestrator.
## Cons / limitations / caveats
-`fs.watch` has no unsubscribe method defined; subscriptions presumably live for the session.
-`cap.terminal.create` takes a single command string plus args array, but quoting/escaping rules between them are unspecified.
- Worktree path suggestion conflicts with the reference implementation's actual `.cap/<session>/` layout; either is compliant (suggestion only).
- No binary-file story for fs.read/write beyond a base64 encoding flag; large-file chunking is unaddressed.
## Relevance to tai
Defines tai's coding-profile surface both ways: orchestrator MUST implement the fs/terminal reverse RPC it advertises, agent SHOULD emit diff/test_result/transcript artifacts. The scope table becomes a `cap.md` drift table.
