PackageCapabilityClaim

What a package says about itself. It is not a classification and it never becomes one. ── THE LEAK THIS TYPE EXISTS TO CLOSE ────────────────────────────────────────────────────────── `extra.milpa.capability` is written by the package. Today nothing stops it from declaring: mutation: none · external_effect: none · kernel_only_eligible: true for an operation that sends email. And re-validating at the Tool Broker does NOT save you, because the broker reads the same catalogue. The leak is not in the runtime: it is one layer below, in the supply — and it lands squarely on the marketplace thesis, because a marketplace is by definition untrusted third parties supplying catalogue entries. GOV-11 — Control metadata declared by a third party constitutes a claim, never a classification. ── WHY A CLASS AND NOT AN ARRAY WITH A COMMENT ───────────────────────────────────────────────── Because an array gets passed to a function expecting a classification and nobody notices. The type is what makes the confusion fail to compile: a signature asking for `ControlAttestation` cannot receive this, and there is no conversion — only issuance by an authority, which is a different act.

public function __construct(string $package, string $digest, array $declared):

Parameters

public function grants(): array

What this claim authorises: NOTHING. The method exists so the question has an answer written into the type, instead of living in the head of whoever reads it.

public function claims(string $field): ?mixed

What the package asserts about a field — named for what it is. It is called `claims()` and not `get()` on purpose. `$claim->get('mutation')` reads as a fact; `$claim->claims('mutation')` reads as an interested party's assertion, which is what it is.

Parameters