Pack

`read-only`

Plan-mode inspection allowlist — look, don’t mutate.

Default effect: allow inspect

Extend in policy

extends:
  - pack: read-only

Thin allow for common inspect tools. Default deny covers the rest. Still pair with secrets-safe.