A sealed envelope for AI work.

One HTML file. No network. Manifest, sources, and provenance — all inside. Open it in any browser today, or in a decade.

Read the Core spec View on GitHub See examples

12 rules·5 required blocks·0 network deps

SEALED · MMXXVI

I — Two promises

What capsules guarantee.

Most modern documents phone home; most platforms let you unshare. Capsules do neither, by construction — not by policy.

Cannot be unshared.

Once a capsule reaches a recipient, the bytes are theirs. No retraction, no expiring link, no platform that revokes access. This forces honest authoring discipline: redact before sharing, because there is no undo. (Core Rule 10.)

ii.

Never phones home.

Zero fetch, zero analytics, zero tracking pixels. Once opened, the recipient's view is unobservable to the author. Hosting platforms can track wrapper-level activity; the capsule itself is mute. (Core Rule 2.)

II — What's inside

A file with discipline.

Five named blocks, one manifest, no hidden network. The same envelope serves a research note, a decision board, a design system, or a map.

capsule.html 47 kb · sealed 2026-05-20

#capsule-manifest

json

#capsule-data

json

#capsule-style

css

#capsule-root

html

#capsule-runtime

javascript

#capsule-manifest · specimen application/json

// abbreviated for display — full schema in spec/CAPSULE_SPEC.md
{
  "spec_version": "0.3.0",
  "uuid":         "7d1a1ac8-c6d9-4ed1-98a7-f5399466262a",
  "title":        "Q1 workflow assessment",
  "type":         "interactive_report",
  "generator": { "kind": "llm", "version": "claude-opus-4-7" },
  "source":    { "origin": "private_database", "included_records": 42 },
  "privacy":   { "visibility": "shared", "external_dependencies": false },
  "capabilities": ["about", "copy_as_json", "download_capsule"],
  "parents": [{ "uuid": "a7c3e9f8-…", "title": "Q4 baseline" }]
}

III — The contract

Twelve rules. One page.

Pasteable into any LLM prompt. Each rule traces to an observed failure mode — none is decorative. See CAPSULE_CORE.md for the canonical version.

One file.A single .html document. No companions, no sidecars.
No network.Zero fetch, CDN, ES modules. Works identically over file:// and http://.
Five required blocks.capsule-manifest, capsule-data, capsule-style, capsule-root, capsule-runtime.
Required manifest fields.Identity, generator, source, privacy, capabilities. Optional: parents[].
Honest provenance.generator.kind: compiler · llm · human · hybrid.
Read-only data.Runtime never mutates the data block.
Capabilities don't lie.Every declared capability has a working implementation.
Typed response exports.capsule_reference + payload, per the response schema.
Accessibility baseline.Semantic HTML, ARIA, keyboard nav, prefers-reduced-motion, lang.
Cannot be unshared.Once sent, the bytes are theirs. Redact before sharing.
Backtick string literals.Multi-line strings in runtime JS use template literals.
Render in HTML.Content lives in the body, not behind a script tag.

IV — Produce one

Paste this. Get a capsule.

Works in Claude, ChatGPT, Gemini, Codex. The simplest path from a conversation to a sealed file.

LLM prompt fragment

Produce a Capsule per Core v0.3.0.
Output a single .html file with five inline blocks:
capsule-manifest, capsule-data, capsule-style,
capsule-root, capsule-runtime.

Set generator.kind to "llm" and version to your model ID.
Include the "about" capability plus copy_as_json.
Pre-render content in HTML (rule 12). Use backtick
template literals for multi-line strings (rule 11).

[paste the twelve rules from CAPSULE_CORE.md]

Data to embed:
[paste your data]

V — Where it stands

Four phases. One shipped.

The format exists. The compiler is half-built. The network layer may never come, and that's a feature, not a delay.

i.	Format	Single-file HTML, manifest, sealed convention. Core v0.3.0, full v0.3.2.	Exists
ii.	Compiler	Reference compiler + validator + two templates. First independent compiler-kind producer (Mintel) validates clean at 26/26.	Half-built
iii.	Domain capsules	Schemas shipped for `implementation_notes`, `design_system`, `exploration_map`. Map, dataset, deal pending.	Partial
iv.	Network layer	Registry, lineage, importers. Deferred — possibly never. Local files travel further than infrastructure.	Not built

About this capsule

This page is itself a Capsule per Core v0.3.0 (full spec v0.3.2). All five required blocks inline. No network, no analytics. Validates against the reference validator.

Export this page

Manifest

Loading manifest…