Files

T

retoor cc1c130b51 CAP protocol both directions: agent speak plus orchestrator drivers (1.39.0)

- Agent side: --cap-manifest plus --cap-speak stream-json binding with
  transcript-diff frames, diff/transcript artifacts, session config
- Orchestrator: PTY driver (settle heuristics on PtyProc/TuiVtScreen),
  stream-json, ACP-stdio (permission/elicit/fs/terminal serving) and
  A2A drivers (dual draft/current spelling, SSE mapping)
- Sessions, fleets: worktrees, master plans, mediated routing,
  budget refusal, audit log, research auto-answerer, --cap CLI
- cap.md contract with drift tests; research/cap-protocol archive
- Suites 1119 + 16 green

2026-10-18 13:17:35 +02:00

3.3 KiB

Raw Blame History

CAP Profile Coding v1 specification

Metadata

Field	Value
Institute	Molodetz Institute — Research & Retrieval Division
Subject	cap-protocol
Document type	Source Dossier
Tier	1
Source title	CAP Profile: Coding (v1, draft)
Source URL	https://github.com/rsclaw-ai/cap-protocol/blob/main/docs/cap-profile-coding-v1.md
Source type	specification
Source date (published)	2026-05-18 (draft)
Date researched	2026-10-18
Researched by	tai (agent), model: Muse Spark, on behalf of retoor
Research method	direct raw-file fetch, read in full (446 lines)
Confidence	High
Status	Active

Summary

The first vertical: [capabilities.coding] manifest section, 6 fs reverse-RPC methods (watch optional with cap.fs.change events), 5 terminal methods (create/output/wait/kill/release with a 60s buffer-retention rule), 6 artifact MIME types, scope enforcement (workspace_only/project_root/unrestricted), permission-mode-gated terminal vetting, and profile error codes -32020..-32024.

Key findings

Only fs.scope (when any fs is true) and tool_permission are required in the manifest section; everything else optional.
cap.fs.read MUST reject out-of-scope paths without revealing existence; symlink resolution happens BEFORE the scope check and escaping symlinks MUST NOT be followed.
Terminal defaults: kill signal SIGTERM escalating to SIGKILL after 5s; release keeps the buffer queryable 60s; wait with null timeout waits indefinitely.
tool_permission = interactive means EVERY terminal.create surfaces as a permission request; confirm allows allow-list auto-approve; none logs everything but users MUST be warned prominently.
Artifacts: diff (unified, one file RECOMMENDED), pr_link, test_result (output truncated to 64KB), commit, plan_doc, transcript (RECOMMENDED for audit/replay).
ACP bridge table (§9): fs.list/exists/delete have NO ACP counterpart and go over _cap/<rpc> extension methods.
Multi-agent worktree naming suggestion: <repo>/.cap-worktrees/<sub-agent-urn>/ (the reference CLI instead uses .cap/<session>/).

Pros / strengths

Tight, implementable RPC surface: every method has params/result/errors, and the scope table leaves no enforcement ambiguity.
The transcript artifact type gives tai's orchestrator audit log a standard export shape for free.
tai already has the enforcement primitives (approval tiers, sandbox box, git) that §7 requires of an orchestrator.

Cons / limitations / caveats

fs.watch has no unsubscribe method defined; subscriptions presumably live for the session.
cap.terminal.create takes a single command string plus args array, but quoting/escaping rules between them are unspecified.
Worktree path suggestion conflicts with the reference implementation's actual .cap/<session>/ layout; either is compliant (suggestion only).
No binary-file story for fs.read/write beyond a base64 encoding flag; large-file chunking is unaddressed.

Relevance to tai

Defines tai's coding-profile surface both ways: orchestrator MUST implement the fs/terminal reverse RPC it advertises, agent SHOULD emit diff/test_result/transcript artifacts. The scope table becomes a cap.md drift table.

Changelog

Date	Change
2026-10-18	Initial dossier created.

3.3 KiB Raw Blame History