Clarify first-party plugin tap governance and external tap trust policy

[eric-tramel]

Parent epic: #15

Depends on: #19

Why

A tap is not a sandbox. It points users toward executable Python packages. DDPlugins should stay curated as the default NVIDIA-maintained tap, while external and team-specific plugins can publish their own packages and taps without landing in the first-party repo.

Proposed governance policy

Document this policy for DDPlugins:

• DDPlugins is the NVIDIA-maintained first-party tap.
• Accept new plugins here when they are NVIDIA-maintained, broadly useful to DataDesigner users, and have an accountable CODEOWNER.
• Accept fixes, docs, tests, compatibility updates, and extensions to existing first-party plugins.
• Do not require unrelated external/team/community plugins to land in DDPlugins to be useful.
• Direct unrelated external plugins to publish their own package and tap catalog using the same schema v2 contract.
• The default NVIDIA tap is curated; external taps are explicit opt-in.

Proposed trust/install language

Docs should use language equivalent to:

A tap is a pointer to Python packages. Installing from a tap runs package-manager resolution and imports code after installation. Review the tap URL, package name, version, source/ref, and install command before confirming installs from non-default taps.

DataDesigner CLI follow-up work should mirror these defaults:

• Default NVIDIA tap: trusted/curated source, normal confirmation rules.
• Non-default tap: explicit opt-in via plugins taps add.
• Install from non-default tap: show tap URL, package name, version, source URL/ref/path, and exact command; require confirmation unless --yes is passed.

Work to do

• Add this governance/trust policy to docs.
• Add first-party contribution guidance to README or authoring docs.
• Add external tap guidance pointing to schema v2 and raw JSON tap URL requirements.
• Cross-link to Document the plugin tap contract, workflows, and ecosystem boundaries #25 for the final docs integration.

Acceptance criteria

• Docs state that DDPlugins is curated and first-party.
• Docs state which new plugins belong in DDPlugins and which should publish an external tap.
• Docs explain that adding a tap is a trust decision, not just a discovery preference.
• DataDesigner CLI follow-up work has concrete warning/confirmation language to reference.

Dependencies

• Depends on: Publish the generated catalog at a stable raw JSON tap URL #19.
• Blocks final tap documentation in Document the plugin tap contract, workflows, and ecosystem boundaries #25.