We have a SIP-4 which suggests merging in the package.json and manifest. But there should be a special, Living SIP that contains an up to date JSON schema for the manifest. It should link to all permission specifications and so would be a meta-SIP in a way since it would connect schemes from multiple.