tai/research/cap-protocol/cap-profile-coding-v1.md

CAP Profile Coding v1 specification

Metadata

Field	Value
Institute	Molodetz Institute — Research & Retrieval Division
Subject	cap-protocol
Document type	Source Dossier
Tier	1
Source title	CAP Profile: Coding (v1, draft)
Source URL	https://github.com/rsclaw-ai/cap-protocol/blob/main/docs/cap-profile-coding-v1.md
Source type	specification
Source date (published)	2026-05-18 (draft)
Date researched	2026-10-18
Researched by	tai (agent), model: Muse Spark, on behalf of retoor
Research method	direct raw-file fetch, read in full (446 lines)
Confidence	High
Status	Active

Summary

The first vertical: [capabilities.coding] manifest section, 6 fs reverse-RPC methods (watch optional with cap.fs.change events), 5 terminal methods (create/output/wait/kill/release with a 60s buffer-retention rule), 6 artifact MIME types, scope enforcement (workspace_only/project_root/unrestricted), permission-mode-gated terminal vetting, and profile error codes -32020..-32024.

Key findings

• Only fs.scope (when any fs is true) and tool_permission are required in the manifest section; everything else optional.

• cap.fs.read MUST reject out-of-scope paths without revealing existence; symlink resolution happens BEFORE the scope check and escaping symlinks MUST NOT be followed.

• Terminal defaults: kill signal SIGTERM escalating to SIGKILL after 5s; release keeps the buffer queryable 60s; wait with null timeout waits indefinitely.

• tool_permission = interactive means EVERY terminal.create surfaces as a permission request; confirm allows allow-list auto-approve; none logs everything but users MUST be warned prominently.

• Artifacts: diff (unified, one file RECOMMENDED), pr_link, test_result (output truncated to 64KB), commit, plan_doc, transcript (RECOMMENDED for audit/replay).

• ACP bridge table (§9): fs.list/exists/delete have NO ACP counterpart and go over _cap/<rpc> extension methods.

• Multi-agent worktree naming suggestion: <repo>/.cap-worktrees/<sub-agent-urn>/ (the reference CLI instead uses .cap/<session>/).

• (added 2026-10-25, re-read for model handling) The profile defines no model selection, cost, budget or effort; the only model mention is an example model field in a transcript artifact. Per-agent settings an orchestrator does set: tool_permission (none, confirm, interactive), tools_allowed / tools_denied, fs.scope, terminal.concurrent_max; sub-agents SHOULD each get their own git worktree and staged diffs SHOULD be vetted before a commit.

Pros / strengths

• Tight, implementable RPC surface: every method has params/result/errors, and the scope table leaves no enforcement ambiguity.
• The transcript artifact type gives tai's orchestrator audit log a standard export shape for free.
• tai already has the enforcement primitives (approval tiers, sandbox box, git) that §7 requires of an orchestrator.

Cons / limitations / caveats

• fs.watch has no unsubscribe method defined; subscriptions presumably live for the session.
• cap.terminal.create takes a single command string plus args array, but quoting/escaping rules between them are unspecified.
• Worktree path suggestion conflicts with the reference implementation's actual .cap/<session>/ layout; either is compliant (suggestion only).
• No binary-file story for fs.read/write beyond a base64 encoding flag; large-file chunking is unaddressed.

Relevance to tai

Defines tai's coding-profile surface both ways: orchestrator MUST implement the fs/terminal reverse RPC it advertises, agent SHOULD emit diff/test_result/transcript artifacts. The scope table becomes a cap.md drift table.

Changelog

Date	Change
2026-10-18	Initial dossier created.
2026-10-25	Forward correction: model-handling findings added from a re-read.