Skip to main content

Task contract

Identify the recipient, channel, immutable revision, license terms, and exact files that would leave the machine. A request to prepare a share is not approval to upload or publish it.

Procedure

  1. Verify every component and its license or bundled terms.
  2. Scan the complete package for secrets, local paths, user data, and generated artifacts.
  3. Show the sealed manifest and destination.
  4. Request approval immediately before the remote write or publication.
  5. Verify the returned revision, Pack, or publication receipt.
Treat these as different mutations:
  • exporting a local archive;
  • creating a revocable Pack;
  • syncing a Workspace Skill Set;
  • sending a private recipient grant;
  • pushing source to Git; and
  • publishing a discoverable Registry version.

Stop conditions

Stop on changed bytes, missing rights evidence, ambiguous recipients, secrets, unintended user data, an expired preview, or a destination not named by the user. Never substitute a source URL or account token for a Pack authority.

Expected result

Report the channel, recipient scope, immutable revision, manifest, expiry or revocation behavior, receipt, and what data did not leave the machine.