feat(tool-capability): govern external Claude community plugin admission and product-scoped activation

[seonghobae]

Buyer problem

CWL products and maintainers can benefit from the curated plugins published through anthropics/claude-plugins-community, but installing the marketplace wholesale would turn third-party prompts, hooks, subagents, MCP servers, shell commands, network access, and external account requirements into implicit runtime authority.

The upstream repository explicitly describes itself as a read-only mirror of an internally reviewed catalog, warns that bundled third-party connectors may not be fully vetted, and does not automatically install plugins. Anthropic review is useful upstream evidence, not CWL admission authority.

Observed upstream identity at issue creation:

• repository: anthropics/claude-plugins-community
• protected branch head: a727be1c7bd6064419b6f60d71993a19198adc17
• marketplace blob: .claude-plugin/marketplace.json@eb95bc96ea8434539aeb4cc1cec40abaca6d40aa
• repository role: discovery/distribution mirror, not a CWL runtime dependency or source of product truth

These identities become historical evidence after the upstream ref moves. Every admission must bind exact immutable source and package bytes again.

Canonical ownership

Noema's Tool / Capability Boundary owns versioned external-extension descriptors, admission decisions, least-authority activation, expiry, rollback, and invocation receipts. It does not absorb foreign plugin functionality or the following owners:

• context-graph-contracts: provider-neutral released schema/profile/conformance for external capability artifacts once the current contract stack produces an immutable release;
• appguardrail: package/manifest/hook/prompt/MCP supply-chain scanning and SARIF; extend current PR #1036 through a non-duplicative successor;
• quarantine-sandbox-runtime: isolated execution of untrusted hooks, scripts, MCP binaries, and package analysis;
• EgressWeave: outbound host/method/size/response policy;
• contextual-orchestrator: model/provider discovery, capability routing, and orchestrator/free; no plugin-owned provider routing or provider credentials;
• keyverse: human/service identity and secret handles; raw secrets never enter plugin prompts, manifests, traces, or receipts;
• macos_utility_packs: local developer-workstation reconciliation after released admission evidence exists;
• product repositories: consumer-owned ACLs and declared capability demand only, never copied plugin source or cross-repository SQL.

Noema may use a narrow local port/test double before a released shared contract exists, but must fail closed rather than read a sibling PR head, mutable branch, or unpublished package as authority.

Two distinct adoption modes

developer_assist

An approved plugin may be installed into a bounded maintainer/reviewer workspace. It can advise or propose changes, but it has no merge, release, deployment, secret, product-data, or production-state authority. Installation is disabled by default and scoped by repository class, role, client, and expiry.

product_runtime_adapter

A CWL product must not embed or invoke the Claude plugin wrapper as its production runtime. When a plugin exposes a useful MCP/API/tool, the canonical owner adopts the underlying released protocol/API through a product-owned port/ACL, with its own tests, security controls, provenance, and release. The community catalog remains discovery evidence only.

External extension descriptor

Define one versioned, fail-closed descriptor containing at least:

external_extension_id
capability_code
adoption_mode
upstream_repository
upstream_commit_sha
upstream_path
artifact_sha256
marketplace_entry_sha256
plugin_name
plugin_version
license_expression
license_evidence_reference
input_schema_reference
output_schema_reference
required_filesystem_capabilities
required_network_capabilities
required_process_capabilities
required_secret_handles
required_mcp_servers
allowed_product_repositories
allowed_execution_roles
isolation_profile_reference
egress_policy_reference
appguardrail_scan_receipt
quarantine_analysis_receipt
approval_status
valid_from
valid_to
supersedes_extension_id
rollback_reference

All hashes and repository/source identities are canonical lowercase exact values. Branches, floating tags, mutable marketplace names, self-asserted scan success, or a plugin author's prose are not admission authority.

Admission state machine

discovered
→ source_pinned
→ statically_scanned
→ quarantined
→ capability_reviewed
→ approved_for_pilot
→ active
→ suspended | superseded | rejected | expired

State transitions are append-only evidence. approved_for_pilot is not active; an activation is bound to exact product/repository, user/service role, policy version, artifact digest, and time interval.

Initial pilot portfolio

Only the following narrow candidates should enter evaluation first. None is active by this issue alone.

Candidate	Intended CWL use	Boundary
rust-best-practices	Review assistance for Rust-heavy owners such as fast-mlsirm, TEPP, RankWeave, pingora-gateway, OriginWeave, and quarantine runtime	developer_assist; advice only; repository rules and primary Rust documentation remain authoritative
security-scanning	Additional adversarial review input for AppGuardrail and security maintainers	developer_assist; never a required scanner/status and never a replacement for AppGuardrail/CodeQL/Semgrep/Strix
accessibility	UI review assistance for products with Figma/Storybook/WCAG work	developer_assist; no conformance/certification claim without executable WCAG/AT/E2E evidence
supabase-postgres-best-practices	Evaluation only in repositories that actually use Supabase contracts	no generic PostgreSQL rollout; reject for products whose canonical stack is plain PostgreSQL/SQLx

Do not adopt duplicate wrappers for capabilities already provided through installed official CWL connectors such as Figma and Vercel unless a measured gap and non-overlapping contract are recorded.

Mandatory rejection or escalation

Reject or require explicit security/owner review when an extension requests any of the following:

• direct OPENAI_API_KEY, NVIDIA_NIM_API_KEY*, BYTEZ_API_KEY, OPENROUTER_API_KEY, or provider/model routing outside contextual-orchestrator;
• GitHub review/merge/release/deployment/administration or broad repository write authority;
• unrestricted shell, host filesystem, Docker socket, package-manager execution, network, browser profile, or credential access;
• runtime download/curl | sh, mutable dependency refs, unsigned binaries, hidden post-install behavior, or source/artifact mismatch;
• raw secret values, cookies, tokens, PII, production records, or unrestricted logs in model/tool input;
• external MCP servers without exact released contract, bounded schemas, authenticated identity, isolation and egress policy;
• self-modifying instructions, safety/policy override text, exfiltration directives, unresolved templates, homoglyph identity, or concealed Unicode controls;
• license/NOTICE/provenance that cannot be reconciled for commercial use and redistribution.

TDD acceptance

RED tests must prove at least:

1. mutable branch/tag/local-path-only source is rejected;
2. marketplace metadata and retrieved artifact disagreeing on source/ref/path/hash is rejected;
3. missing, stale, forged, wrong-artifact, or wrong-policy AppGuardrail/quarantine receipt is rejected;
4. direct provider key/model route or broad GitHub authority is rejected;
5. undeclared shell/filesystem/network/secret/MCP authority is rejected;
6. one product cannot activate another product's approval;
7. expired, suspended, superseded, or rollback-marked activation cannot invoke;
8. source/catalog drift does not silently update an active extension;
9. duplicate/replayed activation and invocation events remain idempotent;
10. a plugin instruction cannot promote observed content into trusted policy or new capability;
11. product-runtime mode cannot execute a Claude plugin wrapper;
12. receipts contain no secrets, raw product data, or hidden reasoning.

GREEN requires the smallest Noema-owned implementation behind Tool / Capability ports, executable admission and activation APIs, deterministic receipts, 100% owned production statement/branch coverage, public API docs/docstrings, property/hostile-input tests, exact-head CI/security/package/SBOM/provenance, and rollback/disable rehearsal.

Product adoption manifest

Each consumer repository declares capability demand rather than a plugin name, for example .cwl/external-capabilities.yaml:

schema_version: 1
capability_demands:
  - capability_code: rust_code_review_guidance
    purpose_code: maintainer_review
    adoption_mode: developer_assist
    activation_policy_ref: urn:cwl:noema:external_extension_activation:...
    required_evidence_ref: urn:cwl:noema:external_extension_receipt:...

The repository contains no upstream source copy and no mutable installation command. Central .github validation must later verify this manifest against an immutable released Noema/contract artifact, exact current head, AppGuardrail evidence, and allowed repository scope.

Documentation and traceability

Alongside executable implementation, update PRD/TRD/ARCHITECTURE/Context Map/Ubiquitous Language/Threat Model/OPERABILITY/TEST_STRATEGY/ADR/UML and docs/product-technical-gap-baseline.md with:

• plugin wrapper versus underlying runtime protocol boundary;
• capability owner/consumer map;
• admission/activation/rollback state machines;
• trust, isolation, egress, secret, license, provenance and data-retention boundaries;
• initial pilot measurements: review finding precision, task success, latency/cost, unauthorized-action rate, injection success rate, and rollback success.

Delivery order

1. Finish the current atomic runtime state/checkpoint prerequisite (feat(runtime): add atomic workflow scheduler state-store and recovery boundary #541/feat(workflow): add atomic durable task claim and checkpoint CAS #542) without racing its writer.
2. Establish/release the shared external-capability artifact contract in context-graph-contracts; until then keep a local fail-closed port/test double only.
3. Complete AppGuardrail skill-supply-chain #1036 and its Claude-plugin package successor.
4. Implement Noema admission, activation, receipt, expiry and rollback.
5. Add central .github consumer-manifest validation.
6. Add macos_utility_packs discovery-only then approved-pilot reconciliation.
7. Run the three narrow pilots, compare against no-plugin baselines, and activate only measured, non-duplicative value.

Non-goals

• no wholesale marketplace installation;
• no fork of the Anthropic mirror as a CWL source of truth;
• no automatic trust because Anthropic scanned/reviewed a plugin;
• no direct production dependency on Claude Code/Cowork packaging;
• no plugin-owned model/provider routing, secrets, merge/release, or product-domain truth;
• no claim that plugin installation itself closes a buyer or commercial-readiness gap.

Related: #9, #27, #66, #227, #541, PR #542; ContextualWisdomLab/appguardrail#1036; ContextualWisdomLab/macos_utility_packs#3.

[seonghobae]

Executable owner graph created — 2026-09-03

The external-capability work is now split into canonical owner lanes. Preserve this order and do not consume mutable sibling heads:

1. ContextualWisdomLab/context-graph-contracts#27 — released provider-neutral artifact, scan/isolation evidence, admission, activation, invocation-receipt and repository-demand grammar. This remains behind the existing protected-source/release-evidence stack.
2. ContextualWisdomLab/appguardrail#1036 — current bounded skill/agent threat detectors; integrate normally without broadening.
3. ContextualWisdomLab/appguardrail#1099 — exact Claude-plugin package/marketplace provenance, capability inventory, SARIF and scan receipt, reusing #1036 rule identities.
4. ContextualWisdomLab/quarantine-sandbox-runtime#17 — credential-free rootless package/hook/command/MCP dynamic-analysis profile and cleanup receipt.
5. ContextualWisdomLab/EgressWeave#240 — enforceable exact-origin external-extension/remote-MCP egress policy and decision/execution receipts; unsupported local-client mediation must fail closed or remain offline.
6. This issue, Noema feat(tool-capability): govern external Claude community plugin admission and product-scoped activation #545 — compose only immutable released evidence into admission, scoped activation, expiry, suspension, supersession, rollback and invocation authority.
7. ContextualWisdomLab/.github#1795 — exact-head repository capability-demand manifest validation; no plugin execution in central Actions.
8. ContextualWisdomLab/macos_utility_packs#3 then #5 — fail-closed deny list, discovery-only validation, and finally exact approved-pilot workstation reconciliation.
9. ContextualWisdomLab/enterprise-architecture-core#45 — product portfolio adoption/exclusion, target-state scenario, impact and pilot measurement.

The first end-to-end candidate remains rust-best-practices in developer-assist mode on one Rust-heavy repository class. security-scanning and accessibility follow only after the first vertical proves exact source/artifact/evidence binding, independent adjudication, no unauthorized authority, and rollback. Figma/Vercel wrappers remain excluded as duplicate by default; provider-specific plugins remain outside the contextual-orchestrator boundary.

No current issue, PR, upstream catalog listing, AppGuardrail PASS, sandbox PASS, or local installation is activation authority. The first implementation may use a Noema-local fail-closed port/test double, but the first real external artifact admission must consume an immutable protected context-graph-contracts release rather than a PR head, branch, copied schema, or cross-repository SQL.

[seonghobae]

Quarantine owner-path handoff: ContextualWisdomLab/quarantine-sandbox-runtime#18@ddcdae949cce845bfa6c792c6d0c1e36d36c368b is now the Draft RED-only local lane for issue #17's credential-free claude_plugin_package_analysis contract, stacked exactly on current quarantine #14 rather than protected develop. It adds no production execution or admission behavior yet. The fixture binds immutable catalog/source/artifact identities, AppGuardrail receipt reference, profile id/digest, explicit fixed probe codes, bounded CPU/RAM/PID/disk/output/wall-time budgets, and network/filesystem policy references; current quarantine public request contract should reject it until the RED actually executes and the smallest strict local contract is implemented. context-graph-contracts still has zero immutable releases, so quarantine imports no CGC PR/branch and Noema should continue to treat any quarantine PR head as candidate evidence only. First usable Noema dependency remains a future immutable quarantine release whose isolation receipt is compatible with a released CGC external-capability evidence grammar; admission/activation authority remains exclusively Noema-owned.