docs: add universal context capsule

scripts/check_context.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+
+import json
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+CAPSULE_FILE = ROOT / "context" / "capsule.json"
+MANIFEST_FILE = ROOT / "context" / "manifest.json"
+
+
+def fail(message):
+    raise SystemExit(f"context_check_error={message}")
+
+
+try:
+    capsule = json.loads(CAPSULE_FILE.read_text(encoding="utf-8"))
+    manifest = json.loads(MANIFEST_FILE.read_text(encoding="utf-8"))
+except (OSError, json.JSONDecodeError) as error:
+    fail(f"invalid_capsule:{error}")
+
+if (
+    capsule.get("schema") != 1
+    or capsule.get("kind") != "jcm.repository-capsule"
+    or capsule.get("repository", {}).get("id") != "hulumath"
+    or capsule.get("repository", {}).get("remote") != "Jacky/Hulumath-Web"
+):
+    fail("invalid_identity")
+if (
+    manifest.get("schema_version") != "2.0.0"
+    or manifest.get("repository", {}).get("name") != "Hulumath-Web"
+    or "context/capsule.json" not in manifest.get("read_order", [])
+):
+    fail("invalid_manifest")
+
+paths = [
+    capsule.get("context", {}).get("entrypoint"),
+    *capsule.get("context", {}).get("read_order", []),
+    *capsule.get("current_state", {}).get("evidence", []),
+    *[fact.get("evidence") for fact in capsule.get("facts", [])],
+]
+for relative in paths:
+    if not relative or Path(relative).is_absolute() or ".." in Path(relative).parts:
+        fail(f"unsafe_path:{relative}")
+    if not (ROOT / relative).is_file():
+        fail(f"missing_path:{relative}")
+
+print("context_check=ok")