Capability Passport

The Capability Passport is the central product object of APAI. It translates a package's declared permissions, security posture, and scanner results into plain-English statements that a human can read and act on before installing.

A Capability Passport is generated from a package's manifest plus scanner findings. A human or LLM should be able to answer six questions from the passport alone:

1. What does this package install?
2. What can it read?
3. What can it write?
4. What does it cost?
5. What approvals does it need?
6. How do I roll it back?

schema: apai.passport.v0.1
package: prompt-preflight-starter
package_version: 0.1.0
publisher: apai-official
publisher_verified: true
risk_level: low

reads:
  - "Current user prompt or supplied task only"

writes:
  - "Optional local transcript or generated bounded prompt"

accesses:
  - "No secrets required"
  - "No paid API required"

spends:
  - "No direct spend by default"

exposes:
  - "No prompt collection by default"

approvals_required:
  - "Human approval required before destructive actions, external sends, purchases, deploys, or credential use"

rollback: "Remove installed adapter files or stop using the prompt protocol in hosted chat. No persistent state."

scanner:
  status: clean
  findings: []

generated_at: "2026-05-14T01:30:00Z"
generated_by: "apai-passport-generator@0.1.0"

Risk level is a coarse categorization. It is a starting point for a human reviewer; it is NOT a substitute for reading the passport.

• low - No secrets required, no paid API calls, no external sends, no destructive ops, no production-affecting changes. Scanner clean.
• medium- Requires connecting to external systems, may spend money, or makes writes outside the package's local scope. Scanner may have informational findings.
• high - May perform destructive operations, move credentials, ship to production, execute on remote systems, or aggregate data across users. Scanner findings are not necessarily blocking but must be reviewed.
• unknown - Risk could not be assessed (missing manifest fields, scanner unable to run, publisher unverified for a high-impact package type).

scanner:
  status: clean | findings | not-scanned
  findings:
    - severity: low | medium | high
      title: "Short human-readable title"
      detail: "Longer explanation. What was detected, where, why it matters."
      id: "stable-finding-id"

Scanner status clean means no findings on the v0.1 scanner ruleset (suspicious patterns, hidden Unicode). It does NOT mean the package has been fully audited. Real prompt-injection, OAuth-scope, and dependency scanning lands in Phase 5.

• HTML rendering: /packages/{slug} on apai.run
• JSON: /api/passports/{slug} (Day 2 stub, real in Phase 1)
• LLM install card: /packages/{slug}/llms.txt (text/plain)
• Generated locally: apai passport {slug}