Capability packs

A pack is one signed JSON document adding skills, workflows, knowledge, prompts, policies, and eval suites. Trust chain: content sha256 → manifest signed with ed25519 → publisher key must already be trusted on the device. Packs never contain executable code.

1. 1

   Create a publisher identity (once)

   Keep the secret key in your CI vault; ship only the public key inside your app's trusted list.

   lybo keygen

2. 2

   Author the pack

   Start from packs/local-research-assistant/pack.json — manifest + declarative content.

3. 3

   Sign it

   lybo sign packs/my-pack/pack.json --key $SECRET -o dist/my-pack.lybopack

4. 4

   Verify like a device would

   lybo verify dist/my-pack.lybopack --publisher you --pubkey $PUBLIC

5. 5

   Install

   Bundle it in the app, load from file in development, or deliver over the air (see *Deliver packs over the air*).