The bundle.* family (1 verb). Every verb enters through the one front door: it is capability-checked, permission-checked, scope-checked and audited before it runs (see Security & permissions). Each entry below lists its capability, risk class (which fixes the minimum autonomy level), the minimum caller permission, its availability tier, whether it is idempotent, and any outbound egress.
Compilebundle.compile
| Property | Value |
|---|---|
| Capability | bundle.write |
| Risk class | Write - autonomy L1 |
| Min. permission | Member |
| Availability | Admin only (CLI/HTTP; never advertised over MCP) |
| Idempotent | No |
| Egress | None - in-box (pure Postgres, no outbound call) |
{ members: [ { fileId, dividerLabel? }, ... ], filename?, requiredFileIds? }. The members order
IS the bundle order (the manifest - caller config). Each member’s pages are concatenated (object-
level merge, NFR-DOC-7 no fidelity loss); a dividerLabel inserts a generated divider page first.
INV-9 coverage gate: requiredFileIds (config) is the set of members that MUST be present; a missing
required member BLOCKS (fail-closed) with a coverage report - never a silently-incomplete bundle. The
output is a NEW file_record (origin=BUNDLE, source_file_ids = the ordered inputs), bytes encrypted
(INV-7). Returns the new file id + the computed TOC (member start pages, INV-6).
Call POST /v/bundle.compile with a JSON body; returns JSON (or { error, code }). Not advertised over MCP (admin-only); reachable via the CLI and HTTP doors.