For now, I decided to focus on add/delete/list only, as they are the most important actions.
Updates will definitely be handled though, and in a simple way. Here is what I have in mind:

if package version is different in the tarball name compared to what's installed, then:

0. remove file that are not in the tarball anymore
1. unpack files from the tarball, overwriting old file
2. update the "version" file in the metadata directory

For the two first step, the only condition would be that creation time == last modification time.
If the user modified it by hand, it means we shouldn't remove it, or replace. If it's the case, then two actions will be taken:

0. warn the user that the file shouldn't exist anymore and will not be removed in the future
1. write the new file as ${filename}.new and report it to the user

I can't think of why this process would not cover all cases :)