# CAP Profile Coding v1 specification

## Metadata

| Field | Value |
|---|---|
| Institute | Molodetz Institute — Research & Retrieval Division |
| Subject | cap-protocol |
| Document type | Source Dossier |
| Tier | 1 |
| Source title | CAP Profile: Coding (v1, draft) |
| Source URL | https://github.com/rsclaw-ai/cap-protocol/blob/main/docs/cap-profile-coding-v1.md |
| Source type | specification |
| Source date (published) | 2026-05-18 (draft) |
| Date researched | 2026-10-18 |
| Researched by | tai (agent), model: Muse Spark, on behalf of retoor |
| Research method | direct raw-file fetch, read in full (446 lines) |
| Confidence | High |
| Status | Active |

## Summary

The first vertical: `[capabilities.coding]` manifest section, 6 fs reverse-RPC methods (watch optional with `cap.fs.change` events), 5 terminal methods (create/output/wait/kill/release with a 60s buffer-retention rule), 6 artifact MIME types, scope enforcement (`workspace_only`/`project_root`/`unrestricted`), permission-mode-gated terminal vetting, and profile error codes -32020..-32024.

## Key findings

- Only `fs.scope` (when any fs is true) and `tool_permission` are required in the manifest section; everything else optional.
- `cap.fs.read` MUST reject out-of-scope paths without revealing existence; symlink resolution happens BEFORE the scope check and escaping symlinks MUST NOT be followed.
- Terminal defaults: kill signal SIGTERM escalating to SIGKILL after 5s; release keeps the buffer queryable 60s; wait with null timeout waits indefinitely.
- `tool_permission = interactive` means EVERY terminal.create surfaces as a permission request; `confirm` allows allow-list auto-approve; `none` logs everything but users MUST be warned prominently.
- Artifacts: diff (unified, one file RECOMMENDED), pr_link, test_result (output truncated to 64KB), commit, plan_doc, transcript (RECOMMENDED for audit/replay).
- ACP bridge table (§9): fs.list/exists/delete have NO ACP counterpart and go over `_cap/<rpc>` extension methods.
- Multi-agent worktree naming suggestion: `<repo>/.cap-worktrees/<sub-agent-urn>/` (the reference CLI instead uses `.cap/<session>/`).

## Pros / strengths

- Tight, implementable RPC surface: every method has params/result/errors, and the scope table leaves no enforcement ambiguity.
- The transcript artifact type gives tai's orchestrator audit log a standard export shape for free.
- tai already has the enforcement primitives (approval tiers, sandbox box, git) that §7 requires of an orchestrator.

## Cons / limitations / caveats

- `fs.watch` has no unsubscribe method defined; subscriptions presumably live for the session.
- `cap.terminal.create` takes a single command string plus args array, but quoting/escaping rules between them are unspecified.
- Worktree path suggestion conflicts with the reference implementation's actual `.cap/<session>/` layout; either is compliant (suggestion only).
- No binary-file story for fs.read/write beyond a base64 encoding flag; large-file chunking is unaddressed.

## Relevance to tai

Defines tai's coding-profile surface both ways: orchestrator MUST implement the fs/terminal reverse RPC it advertises, agent SHOULD emit diff/test_result/transcript artifacts. The scope table becomes a `cap.md` drift table.

## Changelog

| Date | Change |
|---|---|
| 2026-10-18 | Initial dossier created. |