# Oryseal capsule format

An Oryseal capsule is a bounded binary container with a public header, authenticated body records, and a final completion record. The profile identifier and format version are public; plaintext and secret key material are not.

The parser rejects unsupported profiles, unknown flags, invalid lengths, truncated records, record-order errors, authentication failures, and final-commitment mismatches. `/verify` inspects the public structure without attempting plaintext recovery.

See `/security/format` for the field-by-field presentation.