Build capsule installation, sharing, and provenance

[robinbraemer]

Outcome

Let people install, export, fork, update, remove, and share capsules while preserving user ownership and artifact provenance.

Provide:

• local file and URL installation with integrity verification;
• manifest, capability, provenance, and compatibility review before activation;
• explicit fork lineage for user modifications;
• update comparison that never overwrites a user's fork silently;
• uninstall that removes capsule-owned state without touching unrelated workspace data;
• provider-neutral sharing metadata; and
• export of a complete runnable capsule with no build-service dependency.

Exclusions

• Requiring a central Flect marketplace.
• Granting capabilities because a capsule came from a known product.
• Allowing a product update to take ownership of local customization.

Acceptance criteria

• A capsule can be exported on desktop, installed in a browser profile, and run with identical declared behavior.
• Installation starts without ambient grants and shows requested capabilities before approval.
• Fork, update, conflict, and uninstall flows preserve revision and ownership invariants.
• Offline installation works from a complete local capsule.
• Corrupt, incompatible, or integrity-mismatched artifacts fail before activation.

[robinbraemer]

Product-quality coverage: FQ-09.1 through FQ-09.7, FQ-10.5, FQ-10.7, FQ-10.8, FQ-17.1, FQ-17.4, FQ-17.5, and FQ-23.1 through FQ-23.7.

[robinbraemer]

Progress: local declarative capsule export/import now works through a reviewable candidate boundary. Flect exports the accepted interface as a deterministic verified .flect; browser import uses the native picker, validates integrity, and opens an isolated candidate rather than replacing accepted state. Malformed import is proven in production Chromium to leave accepted UI unchanged with no candidate or unexpected browser failures. Shaper can invoke reserved flect capsule import <workspace-path>; App Agent is denied. This does not close #10: URL install, provenance/capability review UI, fork/update reconciliation, uninstall, and compiled/extension capsules remain open. Evidence: docs/capsule-format.md and docs/verification/2026-08-01-capsule-verification.md.

[robinbraemer]

Compiled-capsule persistence progress (2026-08-01): Flect now stores immutable .flect archives content-addressed by SHA-256 in browser OPFS and advances versioned accepted/candidate/last-known-good bindings only after object persistence. Startup strictly re-decodes bound archives, exposes a candidate only alongside a shaping proposal, and fails closed on invalid or mismatched bindings. Production Chromium proves (1) accepted compiled HTML restores after reload, remains interactive in its isolated frame, and exports byte-for-byte identically, and (2) a compiled candidate restores for review and Reject removes it without replacing accepted state. Focused verification: typecheck passed; 17 capsule-store/controller/Git tests passed; 2 compiled Chromium persistence tests passed. This does not close #10: capability/provenance review, assets/framework bundles, URL install, update/fork/uninstall, portable extensions, signing, and packaged-host picker proof remain open. Accepting an already-restored candidate also exposes a pinned Wasm-Git commit edge tracked under #25. Evidence: docs/verification/2026-08-01-capsule-verification.md.

[robinbraemer]

Pre-activation review progress (2026-08-01): imported declarative and compiled capsules now carry a protected review projection containing publisher, artifact version, source revision, builder, signature presence, file/byte counts, supported platforms, and every requested capability. Required capabilities are treated as hard preconditions: while the broker cannot grant them, the isolated preview remains inspectable, but Keep is disabled and controller acceptance independently fails closed; Reject remains available and receives focus. Optional capabilities are explicitly shown as not granted. Production Chromium proves this flow, and 24 focused store/controller/Git/review-UI tests plus 3 focused Chromium compiled/capability flows pass. Signature identity verification, actual grants/revocation, assets/framework bundles, URL/update/fork/uninstall, and portable extensions remain open.

[robinbraemer]

Compiled asset projection progress (2026-08-01): a verified capsule HTML entrypoint can now resolve archive-local linked CSS, classic scripts, images/SVG, poster/font/audio/video classes, inline style URLs, and CSS url(...) references. Strict UTF-8 text is inlined; binary bytes become bounded data URLs. The opaque frame still receives no host filesystem, object URL, CDN, registry, or network authority, and unresolved/remote references remain unavailable under its CSP. Production Chromium proves packaged styling, SVG data, and interactive JavaScript. Framework source builds, ES module graphs/import maps, dependency resolution, and srcset remain open under the framework/build issues.