What is in a capsule

The .parc format as written by patcharc 0.2.0: ZIP layout, manifest fields, the Ed25519 signature, and every verification check.

validated against patcharc 0.2.0 · 2026-08-22

A .parc is a ZIP archive, stored uncompressed, with a signed manifest. You can open it with any ZIP tool. The format and the manifest schema are Apache-2.0.

Layout

Entries are written in this order: manifest.json, manifest.sig, manifest.pub, then data files sorted by path.

Entry	Contents
`manifest.json`	Canonical JSON (sorted keys, no whitespace): format, version, ids, every data file with size and SHA-256, totals, trust
`manifest.sig`	64-byte Ed25519 signature over the canonical manifest bytes
`manifest.pub`	The 32-byte Ed25519 public key, base64
`manifest/arc.json`	Arc id, session id, goal, branch, head before and after, started and stopped timestamps
`manifest/trust.json`	Trust model version, `offline_verifiable`, `redaction_applied`
`manifest/redaction.json`	Configured redaction rules (see Redaction)
`evidence/summary/review.json`	The six-section review
`evidence/git/commits/<sha>.json`	One record per observed commit
`evidence/git/diffs/<sha>.patch`	`git show --no-color --format= <sha>`
`evidence/scopes/index.json`	Scopes, cross-cutting files, unclassified files
`evidence/file_changes.json`	`{commit_sha, path, status, additions, deletions}` per file
`evidence/test_runs.json`	Empty in 0.2.0 (no test parsing yet)

Manifest fields

{
  "format": "parc",
  "format_version": "0.2.0",
  "schema_version": 1,
  "arc_id": "arc_8f2c1d4a9b",
  "session_id": "ses_…",
  "created_at": "2026-08-22T10:14:03Z",
  "created_by": { "cli_version": "0.2.0", "platform": "darwin/arm64" },
  "repository": { "id": "rep_…", "default_branch": "main", "head_before": "a1b2c3d…", "head_after": "f9e8d7c…" },
  "worktree": { "id": "wt_…", "path": "/Users/you/src/your-repo" },
  "files": [{ "path": "evidence/summary/review.json", "size": 4120, "sha256": "…", "kind": "summary" }],
  "totals": { "files": 9, "bytes": 48213, "commits": 4, "rewrites": 0, "scopes": 2, "test_runs": 0, "redactions": 0 },
  "trust": { "trust_model_version": "0.2.0", "offline_verifiable": true, "redaction_applied": false }
}

File kinds: metadata, git, scope, symbol, test, decision, risk, note, artifact, redaction, checkpoint, summary, audit, derived. Commits carry the trust level observed (the other levels are verified, declared, inferred, unsupported).

Signature

The private key lives at .patcharc/keys/arc-signing.ed25519 (hex, mode 0600). At seal time the manifest is serialised canonically and signed. Verification re-canonicalises the parsed manifest before checking the signature, so reordering keys or reformatting whitespace does not break a capsule, but changing any value does.

What verify checks

patcharc verify <capsule> performs, in order:

Path safety: no absolute paths, no .., no ./ prefix, no NUL bytes in entry names.
Compression ratio: any entry with uncompressed/compressed above 1000 fails (zip-bomb guard).
Presence of manifest.json, manifest.sig, manifest.pub.
Manifest validity: format name, exact version match, schema version, id patterns, non-empty heads and branch, 64-hex SHA-256 on every file.
Signature over the canonical manifest with the embedded public key.
Every listed file: re-hashed and size-checked; any archive entry not listed in the manifest is an issue.
Completeness: every listed file is present.

The result is valid only if all of these pass and there are zero issues. inspect prints each check:

$ patcharc inspect .patcharc/capsules/arc_8f2c1d4a9b.parc
Capsule:        arc_8f2c1d4a9b
Format:         0.2.0
Files:          9 (48213 bytes)
Signature:      true
Manifest:       true
Path traversal: true
Zip-bomb safe:  true

The cloud runs an independent TypeScript implementation of steps 3 through 6 on every upload before it will publish a link.

Limits

Default maximum capsule size 200 MB (limits.max_capsule_bytes); the cloud enforces the same cap on upload.
Default maximum 200,000 entries (limits.max_files).
Duplicate paths are rejected at seal.

Reading a capsule without PatchArc

$ unzip -l arc_8f2c1d4a9b.parc
$ unzip -p arc_8f2c1d4a9b.parc evidence/summary/review.json | jq .
$ unzip -p arc_8f2c1d4a9b.parc manifest.json | jq .totals

The signature can be checked with any Ed25519 library: canonicalise manifest.json (sorted keys, no whitespace), then verify manifest.sig against it with the key in manifest.pub.