capsulectl v0.1.0-rc13

capsulectl v0.1.0-rc13, from commit 7eb05ac.

Disclosure first. Deals where the user sells are new in this release. A seller's floor is never sealed in the clear and no shared copy carries it as a sealed field; the buyer's copy shows the offer, the task authority, the acceptance and the seller's agent's representations, and per-thread salted commitments keep two buyers' copies of one sale from being linked by any digest or commitment; both still show the item's name and the offer, the seller's own listing. A buyer's deal shares the same records with the same audiences as before. A new per-profile payee fingerprint is sealed only for the user's own copy, on a companion record that every shared copy withholds. The check that keeps the floor out of written text still misses some formats; a fix follows.

Wire changes (all additive; records sealed before re-derive unchanged). New deal records seal action taxonomy version "5". A refund's check carries reverses_ref. A check naming a payee is followed by a counterparty_profile companion record, and the rules checker's input gains optional counterparty_profile, item_ref and commercial_bounds_opening members.

Changes

Where the user sells: a seller profile, an exact acceptance, and one item for several buyers

• Added (wire, additive; every deal sealed before re-derives unchanged). party_role
  (buyer | seller) on the intent, set when a deal opens and fixed; absent means buyer.
  deliver_by and perform_by obligations with a due_by date. A not_selected close.
• A seller's floor stays private. min_total_minor is never sealed. Records that state it
  seal bounds_commitment, a salted commitment (sha256-jcs-nonce256) to a
  commercial-bounds/v0 document. Only the user's own copy carries its openings, and only the
  user's own rules checker is given the opening in force (commercial_bounds_opening). No
  shared copy, for any audience, carries the floor (see "Not yet"). A check below the floor asks
  (under_floor).
• An exact acceptance. offer is a check, allowed only where the user sells; a later offer
  supersedes the earlier one (supersedes). deal note --kind acceptance seals the buyer's
  acceptance of the exact offer by its digest. A seller's commit needs an acceptance of the
  latest offer with no change since, must equal that offer's amount, currency, terms and
  recourse, and cites the acceptance. A deal where the user sells must use typed records.
• A sale is money in. A seller's commit and offer count 0 toward any spend total.
• What the buyer's copy shows (seller deals only). The offer, the task authority in full,
  the acceptance, and the seller's agent's own representations to the buyer (claims, with an
  optional class: condition, warranty, refund_terms, delivery_promise, other) whose
  words hold none of the user's private details. A buyer's deal is shared exactly as before.
• One item, several buyers. deal sale new seals a sale's own log; deal open --sale ID
  opens a buyer's thread under it. Each thread seals the item reference and the sale's task
  authority only as per-thread salted commitments, so no digest or commitment links two buyers'
  copies; both still show the item's name and the offer, which are the seller's own listing.
  The user's own rules checker is given the plain item_ref.
• Not yet: the check that keeps the floor out of written text misses some formats
  ("$1,700.00", bare amounts); a fix follows.

The payee keyed per profile, for the user's own history

• Added (wire, additive; records sealed before re-derive unchanged). A check that names a
  payee is now followed, before any rules checker runs, by a counterparty_profile record.
  • What it holds: only {"fp_alg": "hmac-sha256-profile-key", "ids": {"payee": …}}, the
    payee fingerprinted with the same construction as the per-deal fingerprints. Its key is
    derived from the profile store's own secret, so one merchant has one value across the
    profile's deals and another in any other profile.
  • Where it points: it names its check with an about ref. Each deal record's per-deal
    counterparty fingerprints are unchanged.
• Never shared: no shared copy, for the counterparty or an adjudicator, carries it; the check
  itself stays shareable.
• The rules checker gets it: external-check-input/v0 gives the checker
  record.counterparty_profile for the check being decided, and history[i].counterparty_profile
  for each earlier act (from its approval's check). It is supplied beside the sealed capsule and
  never part of it. Acts checked before this release carry none.

New deal records seal action taxonomy version 5

• Changed (wire; records sealed before re-derive unchanged). A deal record's
  taxonomy_version is now "5": capsule-engine's capsule_engine/guards/action_taxonomy.json
  at e5ec2c1ba84f9d9269cbb164eb6a92400e4d5d49 (file sha256
  7d31e892cdea7352d0485c89430dba028bf02ce91fb0e932f4752c1f4066022f, JCS sha256
  af3a054cae880e13ce5d8d8bdaa64383e6f3af14fa2bf2ddb88aab226865b13a).
• Every action_class is unchanged. Against version 4 (5300e0b), version 5 changes only
  approver_role (to account_holder) on communication.send, a class no deal record carries;
  no class is renamed, removed or added, and none changes trigger class.
• Each step keeps its own version. A record sealed under "2", "3" or "4" re-derives with
  it.

A refund's check names the payment it returns

• Added (wire, additive; records sealed before re-derive unchanged). A deal check of a
  cancel that returns a sealed payment (a refund) now carries reverses_ref: that payment's
  action, by its record digest, as a typed reference ({"type": "record", "digest_alg": "SHA-256", "digest": …}). It names the same payment, by the same digest, as the refund
  action's reverses ref. A typed deal's proposed-action/v0 carries it too.
• Amounts unchanged: a refund's check and action both keep amount_minor. A partial
  cancel's keep cancelled_amount_minor and name no payment. No returned_minor is sealed.

deal checkpoint status: a deal log's latest checkpoint, read-only

• Added: capsulectl deal checkpoint status --deal ID returns, as JSON:

  • the deal log's latest checkpoint: its id (the SHA-256 of the signed statement), at, and
    the log head it covers (mmr_size, entries, root);
  • the log's log_entries;
  • the checkpoint's witness state as stored.

  A deal with no checkpoint yet has checkpoint and witness null, and exits 0.

• Read-only: it never seals, never cuts a checkpoint and never contacts the witness, and every
  file under the store is byte-for-byte the same after it. It works on a read_only profile.

• Fixed: opening a log that does not exist could panic while cleaning up the failed open. It
  now returns the log's error.

Verify

Prebuilt binaries: linux/amd64, linux/arm64, darwin/arm64.

V=v0.1.0-rc13; R=action-state-group/capsule-cli
gh release download "$V" --repo "$R"
sha256sum -c SHA256SUMS
for f in capsulectl-"$V"-*-*; do
  gh attestation verify "$f" --bundle "capsulectl-$V.sigstore.json" --repo "$R" \
    --signer-workflow "$R/.github/workflows/release.yml"
done

The deal skill is installed from this tag's source archive; its skills/deal/SKILL.md equals the tagged commit's.