feat(agent-supply-chain): validate product capability-demand manifests against released extension evidence

[seonghobae]

Problem

CWL products must not install or invoke extensions from anthropics/claude-plugins-community merely because a marketplace entry exists. Noema #545 will own external-extension admission and scoped activation, Context Graph Contracts #27 will publish the shared artifact/evidence grammar, AppGuardrail #1099 will own exact package scan receipts, and macos_utility_packs #5 will consume approved developer-workstation activations.

The central governance gap is an organization-wide, exact-head reusable check that ensures product repositories declare capability demand, not mutable plugin installation commands, and that any referenced activation is an immutable released owner artifact scoped to that repository, role, purpose, client and validity interval.

This issue owns reusable validation and rollout policy only. It must not mirror the Anthropic marketplace, scan or execute plugins, issue admissions, install local extensions, route models, expose secrets, or absorb product-domain truth.

Required repository manifest

Define and validate .cwl/external-capabilities.yaml using the released repository-capability-demand:v1 contract from ContextualWisdomLab/context-graph-contracts#27.

A repository manifest names needs, not vendor packages:

schema_version: 1
capability_demands:
  - capability_code: rust_code_review_guidance
    purpose_code: maintainer_review
    adoption_mode: developer_assist
    activation_policy_ref: urn:cwl:noema:external_extension_activation:...
    required_evidence_ref: urn:cwl:noema:external_extension_receipt:...

No external source URL, branch, tag, install command, raw prompt, secret value, provider key, or copied plugin source belongs in the consumer manifest.

Reusable workflow

Add a centrally owned workflow such as:

.github/workflows/external-capability-admission.yml

and a thin-caller template. The reusable workflow must:

1. materialize and verify exact caller repository, PR number, submitted head SHA and independently resolved live protected base;
2. read only the exact submitted manifest bytes;
3. use an immutable released Context Graph Contracts package/schema/profile and verify its release/source/package/SBOM/provenance evidence;
4. resolve Noema activation evidence through a released, authenticated, read-only API/artifact contract, never a mutable PR/branch or self-asserted JSON;
5. require exact AppGuardrail and quarantine evidence references bound to the same artifact and policy identities;
6. verify activation scope includes exact repository, repository class, execution role, purpose, client and current time;
7. reject expired, suspended, revoked, superseded or rollback-marked activations;
8. reject product_runtime_adapter when the executable artifact is a Claude/Cowork/IDE plugin wrapper rather than an underlying product-owned released API/MCP/tool contract;
9. reject direct provider credentials/routing, broad GitHub authority, unrestricted shell/filesystem/network/Docker/browser-profile/secret access and undeclared MCP/hook behavior;
10. emit a bounded check/evidence receipt without plugin text, prompts, product data, secrets or hidden reasoning.

When no manifest exists, the check should report not_applicable according to explicit rollout policy, not silently assume approval. A repository that contains a marketplace/install command without a manifest/evidence must fail.

Concurrency and authority

For pull-request validation use:

concurrency.group = {workflow_name}-{repository}-{pr_number}
cancel-in-progress: true

Fail when an indirect invocation lacks a PR number. Cancel only older validation/review/repair runs for the same workflow/repository/PR; do not cancel merge, release, deploy or migration work.

The workflow is deterministic governance evidence only. It is not independent human approval, AppGuardrail scan, quarantine execution, Noema admission, merge, release, deployment, or product conformance.

Repository-content guards

Add central detection for at least:

• claude plugin marketplace add or claude plugin install outside the approved workstation owner and explicitly reviewed development tooling paths;
• wildcard, all, category-based, latest/floating or branch/tag-based plugin installs;
• direct references to anthropics/claude-plugins-community in product runtime/build/deployment images;
• copied plugin/skill/agent/hook source without provenance/license/admission;
• direct model-provider keys or routes in plugin config;
• plugin-owned GitHub review/merge/release/deploy permissions;
• raw secrets, cookies, tokens or product data passed to prompts/MCP arguments/logs;
• remote/stdio MCP declarations without released owner contract and exact bounded activation;
• bypass, allow-on-error, unsupported-success, missing-evidence-as-pass or stale/predecessor evidence reuse.

Avoid scanning harmless doctoring citations or architecture prose as execution. Scope findings to executable/configuration/adoption surfaces and provide precise path/evidence.

Rollout inventory

Before requiring the workflow organization-wide, inventory repositories that currently contain:

.claude-plugin
claude plugin
skills/**/SKILL.md
agents/**/*.md
commands/**/*.md
hooks/hooks.json
.mcp.json
external MCP configuration

Classify each as:

owner_implementation
approved_consumer
legacy_unadmitted
reference_only
not_applicable

Do not auto-delete or auto-rewrite valid local work. Open repair issues/PRs in canonical owners and preserve unique deltas.

TDD acceptance

RED/GREEN tests must cover:

1. valid capability-demand manifest with exact released evidence;
2. plugin-name/install-command manifest rather than capability demand;
3. mutable/PR-head/unreleased CGC or Noema evidence;
4. missing/stale/wrong-artifact AppGuardrail/quarantine evidence;
5. repository/role/purpose/client/time scope mismatch;
6. expired/revoked/superseded/rollback activation;
7. product runtime attempting to execute a Claude wrapper;
8. direct provider key/routing and broad GitHub authority;
9. wildcard/latest/category install and runtime image embedding;
10. benign documentation citation negative cases;
11. exact-head/live-base mismatch and indirect invocation without PR number;
12. same-PR old run cancellation without cross-workflow/repository/PR cancellation;
13. malformed YAML/JSON, duplicate keys, Unicode control/homoglyph and oversized/deep manifest;
14. bounded receipt free of secrets/plugin text/product payload;
15. zero-mutation read-only validation.

Retain 100% owned production statement/branch coverage and public docstrings, ShellCheck/actionlint, hostile fixture coverage, immutable action pins, least privilege, SBOM/provenance and exact-current-head evidence.

Documentation and rollout

Update reusable-workflow docs, thin-caller template, security/threat model, operator runbook, Context Fabric integration, rollout inventory, CHANGELOG and docs/product-technical-gap-baseline.md alongside executable behavior.

Rollout order:

1. wait for immutable CGC 🧹 코드 가독성 향상: valid_control 함수 리팩토링 #27, AppGuardrail fix(agent-mention): keep OpenCode dispatch under GitHub payload cap #1099, quarantine and Noema build(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0 #545 owner releases;
2. validate macos_utility_packs chore: Record lack of UI codebase in palette journal #5 discovery-only consumer as the first canary;
3. validate one Rust product manifest with no plugin installation;
4. expand by repository class after EA Core Document DX transfer and isolate scheduler action failures #45 records product-fit decisions;
5. make the workflow required only after positive and negative canaries, rollback and queue/capacity behavior are proven.

Pending/absent/queued/stale/predecessor/model-only/status-only evidence remains non-passing. Current Actions/dependency-review/governance incidents (#712, #772, #810 and successors) are independent owner lanes and must not be weakened or bypassed to introduce this check.

Non-goals

• no marketplace mirroring or periodic auto-install;
• no plugin execution in central Actions;
• no vendor/plugin popularity ranking;
• no automatic approval from Anthropic review;
• no product runtime dependency on Claude packaging;
• no direct provider credentials or product-domain data;
• no duplicate Figma/Vercel/official connector wrapper by default.

Related: ContextualWisdomLab/noema#545, ContextualWisdomLab/context-graph-contracts#27, ContextualWisdomLab/appguardrail#1099, ContextualWisdomLab/macos_utility_packs#5, ContextualWisdomLab/enterprise-architecture-core#45.