[P2] Define portable Cycle Packages and registry imports before building a marketplace

[PullDakar]

Outcome

Create a portable, reviewable specification for reusable cycles before investing in a public marketplace.

Delivery stages

1. Cycle Package Specification.
2. Local and remote registry resolution.
3. Curated public catalog.
4. Marketplace features only after reuse and trust evidence exist.

Package contract

Declare loop and subloop contracts, typed inputs and outputs, local control flow, budgets, terminal outcomes, evidence contracts, capabilities, dependencies, compatibility, version, license, and provenance.

Do not embed credentials, absolute repository paths, permanent principals, mandatory model vendors, or activation authority.

Repository analysis may recommend packages and explain why. Import produces a proposed adaptation pinned to an exact version and digest; it never activates itself.

Success criteria

• A versioned package schema and canonical digest contract exist.
• Validation covers containment, bounded feedback, dependencies, compatibility, and authority escalation.
• A resolver supports pinned local and remote sources.
• At least 5 packages are reused across materially different repositories.
• Provenance, license, deprecation, and security updates are specified.
• Operator review precedes binding activation.
• Marketplace UI remains blocked until reuse and trust thresholds are met.