capsule
An open file format and reference runtime for portable, sandboxed interactive documents. A `.capsule` is a self-contained zip you can email, drop in chat, or carry on a flash drive — it opens offline, runs inside a strict sandbox, and declares every capability it wants up front.
Capability-based security: by default a capsule cannot read files, the clipboard, env vars, tokens, or hit the network — every grant is allowlisted in the manifest and confirmed at run time. Opening one is inert.
The format is a deterministic zip with a manifest, content, and integrity metadata; content is hashed canonically so capsules are forkable with provenance and authors can sign them.
Ships with a CLI to make, inspect, and run capsules in a sandboxed window, starter templates, signed-installer pipeline, and a published V1 spec — the goal is to make interactive documents as portable as PDFs made static ones.