feat(tool-capability): govern external Claude community plugin admission and product-scoped activation

[seonghobae]

Buyer problem

CWL products and maintainers can benefit from curated external extensions, but a marketplace/catalog entry must never become implicit runtime authority for prompts, hooks, subagents, MCP servers, shell/process access, network access, secrets, GitHub write authority, or product data.

Anthropic/community marketplace review remains upstream discovery evidence only. Noema does not treat a mutable marketplace branch, plugin name, author prose, or sibling PR head as CWL admission/activation authority.

Current protected authority — 2026-09-10 KST

Fresh protected Noema is GitHub-verified main@b946d04236613544ceedb2160ed68b4e6d855dd8 after normal #582 integration. The original Noema admission/activation source work from this issue is now protected history through merged #560 and the subsequent external-extension lifecycle/operability chain #574, #577, #578, #579, #580, #581 and #582.

Protected source now separates source/catalog/scanner evidence from Noema Policy / Approval issuance; binds activation/invocation to exact admitted source identity, artifact/product/role/policy/time and current authority; seals replay semantics with platform SHA-256; rejects authority substitution and stale/revoked activation; persists append-only lifecycle transitions in the exact stream-scoped SQLite Durable Object; and exposes only bounded lifecycle operability metadata. ADR 0015 remains Proposed because source integration is not production activation or buyer completion.

Issue #561 is the current production-successor authority. A new active lifecycle transition remains intentionally fail-closed until Noema can re-read current Noema Policy / Approval plus immutable owner-issued AppGuardrail/quarantine/isolation/Egress evidence through a reviewed production adapter. Fresh 2026-09-10 reads show zero GitHub Releases for appguardrail, quarantine-sandbox-runtime, EgressWeave, and context-graph-contracts; mutable sibling branch/PR/package heads therefore remain ineligible authority.

Actual deployed acceptance is also still open in #561: realistic synchronous current-read/contended-append p95 ≤20 ms, exactly-one-winner CAS contention, >128-event audit/restart continuity, malformed/truncated-state rejection, exact-object SQLite storage growth, PITR/equivalent recovery rehearsal, and producer-authenticated deployment/release provenance.

Canonical ownership

Noema's Tool / Capability Boundary owns versioned external-extension descriptors, Noema Policy / Approval issuance, activation/expiry/rollback semantics, invocation receipts and lifecycle/state/checkpoint evidence. It does not absorb foreign extension functionality or the following owners:

• context-graph-contracts: provider-neutral released schema/profile/conformance for shared external-capability artifacts;
• appguardrail: package/manifest/hook/prompt/MCP supply-chain scanning and SARIF;
• quarantine-sandbox-runtime: isolated execution/analysis of untrusted hooks, scripts, MCP binaries and package artifacts;
• EgressWeave: outbound host/method/size/response policy;
• contextual-orchestrator: model/provider discovery, capability routing and orchestrator/free; no extension-owned provider routing or provider credentials;
• keyverse: human/service identity and secret handles; raw secrets never enter extension prompts, manifests, traces or receipts;
• product repositories: consumer-owned ACLs and declared capability demand only, never copied extension source or cross-service SQL.

A narrow local fail-closed port/test double is acceptable only where a released shared contract does not yet exist. It must never read mutable sibling source as production authority.

Adoption modes

developer_assist

An approved extension may advise in a bounded maintainer/reviewer workspace. It has no merge, release, deployment, secret, product-data or production-state authority. Installation remains disabled by default and must be scoped by repository/product, role, client and expiry.

product_runtime_adapter

A product must not embed a marketplace/Claude plugin wrapper as its production runtime. When a plugin exposes a useful MCP/API/tool, the canonical product/owner adopts the underlying released protocol/API through its own port/ACL, tests, security controls, provenance and release. Marketplace metadata remains discovery evidence.

Mandatory rejection or escalation

Reject or require explicit owner/security review when an extension requests direct provider keys/model routing outside contextual-orchestrator; broad GitHub review/merge/release/deployment/admin authority; unrestricted shell/filesystem/Docker/network/browser/credential access; runtime download or mutable refs; unsigned binaries or source/artifact mismatch; raw secrets/PII/production records/hidden reasoning; external MCP without exact released contract and bounded identity/isolation/egress; self-modifying/policy-override/exfiltration instructions; or unresolved commercial license/NOTICE/provenance.

Protected TDD invariants

Protected source covers the core hostile cases: mutable/unbound source and source/catalog drift; forged/stale/wrong-artifact/wrong-policy owner receipts; direct provider/GitHub authority; product/role/time over-broadening; expired/suspended/revoked/superseded activation; replay/idempotency and semantic-envelope binding; authority substitution; impossible chronology; public-error normalization; secret/product/hidden-reasoning retention boundaries; and exact-admission provenance.

Those tests prove Noema source invariants only. They do not prove live owner services, extension installation, production pilot value, immutable contract publication, buyer transfer rights, or production SLO/recovery.

Remaining acceptance / successor path

• Noema admission/activation/receipt source integrated through feat(tool-capability): admit external Claude plugins fail-closed #560.
• Append-only lifecycle/SQLite Durable Object source integrated through feat(tool-capability): persist external-extension lifecycle evidence #574–feat(lifecycle): expose exact storage-growth observation #582.
• Keep foreign owner truth, provider routing and product-domain truth outside Noema.
• Keep active fail-closed without immutable owner-issued evidence.
• Consume a released/versioned external-capability contract when context-graph-contracts publishes one; do not consume its mutable issue/branch.
• Bind production AppGuardrail/quarantine/isolation/Egress evidence through released/immutable owner contracts.
• Execute the actual deployed feat(tool-capability): persist append-only external-extension lifecycle evidence #561 operability/recovery/provenance acceptance.
• Run bounded developer_assist pilots against no-extension baselines and retain review precision/task success/latency-cost/unauthorized-action/injection/rollback evidence before activation.
• Add released central consumer-manifest validation only after the immutable Noema/shared contract exists.
• Preserve licensing/NOTICE/provenance and buyer-transfer authority separately from technical admission.

Do not close this issue merely because source code is protected. It can close only when its valid residual adoption/pilot/immutable-owner-contract acceptance is fully inherited and verified by #561 or another explicit successor, or when the user explicitly drops that scope.

Related: #5, #27, #29, #36, #66, #227, #531, #561, #582, #583; ContextualWisdomLab/context-graph-contracts#27; ContextualWisdomLab/appguardrail#1099.

[seonghobae]

Executable owner graph created — 2026-09-03

The external-capability work is now split into canonical owner lanes. Preserve this order and do not consume mutable sibling heads:

1. ContextualWisdomLab/context-graph-contracts#27 — released provider-neutral artifact, scan/isolation evidence, admission, activation, invocation-receipt and repository-demand grammar. This remains behind the existing protected-source/release-evidence stack.
2. ContextualWisdomLab/appguardrail#1036 — current bounded skill/agent threat detectors; integrate normally without broadening.
3. ContextualWisdomLab/appguardrail#1099 — exact Claude-plugin package/marketplace provenance, capability inventory, SARIF and scan receipt, reusing #1036 rule identities.
4. ContextualWisdomLab/quarantine-sandbox-runtime#17 — credential-free rootless package/hook/command/MCP dynamic-analysis profile and cleanup receipt.
5. ContextualWisdomLab/EgressWeave#240 — enforceable exact-origin external-extension/remote-MCP egress policy and decision/execution receipts; unsupported local-client mediation must fail closed or remain offline.
6. This issue, Noema feat(tool-capability): govern external Claude community plugin admission and product-scoped activation #545 — compose only immutable released evidence into admission, scoped activation, expiry, suspension, supersession, rollback and invocation authority.
7. ContextualWisdomLab/.github#1795 — exact-head repository capability-demand manifest validation; no plugin execution in central Actions.
8. ContextualWisdomLab/macos_utility_packs#3 then #5 — fail-closed deny list, discovery-only validation, and finally exact approved-pilot workstation reconciliation.
9. ContextualWisdomLab/enterprise-architecture-core#45 — product portfolio adoption/exclusion, target-state scenario, impact and pilot measurement.

The first end-to-end candidate remains rust-best-practices in developer-assist mode on one Rust-heavy repository class. security-scanning and accessibility follow only after the first vertical proves exact source/artifact/evidence binding, independent adjudication, no unauthorized authority, and rollback. Figma/Vercel wrappers remain excluded as duplicate by default; provider-specific plugins remain outside the contextual-orchestrator boundary.

No current issue, PR, upstream catalog listing, AppGuardrail PASS, sandbox PASS, or local installation is activation authority. The first implementation may use a Noema-local fail-closed port/test double, but the first real external artifact admission must consume an immutable protected context-graph-contracts release rather than a PR head, branch, copied schema, or cross-repository SQL.

[seonghobae]

Quarantine owner-path handoff: ContextualWisdomLab/quarantine-sandbox-runtime#18@ddcdae949cce845bfa6c792c6d0c1e36d36c368b is now the Draft RED-only local lane for issue #17's credential-free claude_plugin_package_analysis contract, stacked exactly on current quarantine #14 rather than protected develop. It adds no production execution or admission behavior yet. The fixture binds immutable catalog/source/artifact identities, AppGuardrail receipt reference, profile id/digest, explicit fixed probe codes, bounded CPU/RAM/PID/disk/output/wall-time budgets, and network/filesystem policy references; current quarantine public request contract should reject it until the RED actually executes and the smallest strict local contract is implemented. context-graph-contracts still has zero immutable releases, so quarantine imports no CGC PR/branch and Noema should continue to treat any quarantine PR head as candidate evidence only. First usable Noema dependency remains a future immutable quarantine release whose isolation receipt is compatible with a released CGC external-capability evidence grammar; admission/activation authority remains exclusively Noema-owned.

[seonghobae]

Current owner handoff — Noema #560

• Exact head: 675bf99767251ada9bea451df24ab31d3cad681e (Draft, protected base 36e5cf957ee20a8bb3e19ff50fea6c97771d2ba1, behind 0 at publication).
• Plaintext replay-retention RED 3f41d94af1454926b65b1801004fe245098742b0 / CI 34237704683, job 102099615873 led to digest-only retention. Repository-owned SHA rejection was captured by CI 34240985563, job 102111324942; production 80292ed53943c61aa9d282ed18024b0f98f4cb1f delegates SHA-256 to Worker Web Crypto and 396514c8f5183324e6c8d0a16d7a5d339b2cbb72 withholds publication until digest success.
• Exact 739dd8ee4489f07217cfdea61f82d927351c6b23 passed all 4,209 functional tests in CI 34246678309, job 102130337423, then failed mandatory global coverage at 99.98% because the Web Crypto rejection normalization path was unexecuted.
• Test 6ab6056b535e20bb00a1532835a7b7cb616f5f06 covers that public failure. Hostile-authority RED d015e70d0767a83cb9ed11303c459702e88e9c01 then proved a mutating Policy / Approval getter could change between validation and snapshot; GREEN 3c0c4bc9d811b3c07334dc2450e15e7530cda02d reads every scalar/scope once.
• ee0ccef75e0758a0bb737bb2cff07d9ef273c0ce removes the now-unreachable nested catch and consolidates the 134-line standalone provider fixture into the existing shared-fixture suite. Current 675bf99767251ada9bea451df24ab31d3cad681e adds a direct throwing Policy / Approval accessor regression. Together they prove stable normalization and that a failed digest retains no replay/publication authority.
• Fresh exact-tree focused verification: 11 files / 69 tests; owned production statements 427/427, branches 278/278, functions 64/64, lines 397/397; typecheck and git diff --check GREEN. Local full execution had 4,201 passing / 1 skipped; eight acquisition/package-manager cases remain sandbox/runtime-environment failures and are not treated as hosted authority.
• Exact-head runs: CI 34249352022, reviewer-ci 34249351261, and Security Scan 34249351193 are terminal SUCCESS. patch-validator-image 34249351237 remains in progress. No predecessor result transfers.
• Immutable context-graph-contracts#27, real AppGuardrail/quarantine/isolation/EgressWeave evidence, protected-main integration, release, rollback rehearsal, and measured pilot remain open. Keep Draft.

[seonghobae]

Fresh owner-boundary update, 2026-09-08: durable workflow/state prerequisite #542 is already protected source at main@0dbfceb850cda3a016ceb39ae1c8a1a96a9f2ad5. The shared successor is now explicitly owned by context-graph-contracts#27; that repository still has no immutable GitHub release, so Noema #560 continues to use only its local fail-closed ACL/test-double and does not consume a mutable sibling ref. AppGuardrail package/provenance work remains active under appguardrail#1099 (with its own current detector stack), so Noema does not claim scanner/isolation completion. Current #560 source line has separately repaired six-field live-catalog revalidation and fabricated admitted-object provenance; a fresh review found activation provenance itself still structurally cloneable, and test-only exact 3b072f8f9c07959187006fa926812bbc713aff99 now requires a cloned-but-field-identical activation to fail closed. Hosted exact-head gates for that test generation are queued; no RED/GREEN, issue completion, pilot activation, or release authority is claimed from the queued generation.

[seonghobae]

2026-09-08 current execution adds one missing Policy / Approval acceptance criterion to the active #560 lane. Fresh source review of production predecessor 81bff2f61ab6c323845116acd9622334f9dcfadd found that source/catalog identity and AppGuardrail/quarantine receipts are independently pinned, but the descriptor still self-asserts approval_status, allowed product repositories/roles, validity and policy scope. Module-private admission/activation provenance cannot authenticate those grant contents; it only proves the self-asserted object passed the existing admission function.

Test-only exact 7ca9aebee6f92053913c0bbc665c8de77650891f now holds source/catalog/scan pins constant and broadens only the product approval fields. It requires fail-closed admission when no independently trusted Noema Policy / Approval issuance exists. Current exact runs are ci 34206149899, reviewer-ci 34206149930, Security Scan 34206149849, patch-validator-image 34206149861; all were queued at the fresh read, so hosted RED is not yet claimed.

Minimum causal repair: bind product/role/status/validity/policy grant fields to a separately pinned Noema Policy / Approval authority or receipt. Do not treat Anthropic catalog metadata, AppGuardrail/quarantine scan receipts, TypeScript readonly/freeze, or in-process WeakSet provenance as product-approval truth. Keep ADR 0015 Proposed and issue #545 open until this RED is repaired, exact-head gates/review are clean, normal integration occurs, and immutable shared-owner/live pilot evidence exists.

[seonghobae]

TRACEABILITY note for the Policy / Approval repair: the separation is supported by current authoritative NIST access-control guidance, not just a local modeling preference. NIST SP 800-162 defines authorization as evaluation of subject/object/action/environment attributes against policy rather than accepting the requesting artifact's self-asserted scope. NIST SP 800-207 separates the policy engine that makes/logs grant-or-deny decisions from enforcement/administration that establishes the permitted session. The production fix should therefore model an independently issued approval/grant identity and treat the Tool / Capability seam as an enforcement consumer, not let the external descriptor mint its own authorization.

APA 7 references to add when the production/docs head moves after the hosted RED:

Hu, V. C., Ferraiolo, D. F., Kuhn, D. R., Schnitzer, A., Sandlin, K., Miller, R., & Scarfone, K. (2019). Guide to attribute based access control (ABAC) definition and considerations (NIST Special Publication 800-162, Update 2). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-162

Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-207

These sources support the Noema Policy / Approval owner boundary only; they do not move AppGuardrail, quarantine, EgressWeave, Keyverse, or contextual-orchestrator authority into Noema.

[seonghobae]

2026-09-08 fresh Policy / Approval finding and repair status:

7ca9aebee6f92053913c0bbc665c8de77650891f made the missing issuance authority executable: exact catalog/AppGuardrail/quarantine pins remain valid while only approval_status, product repository, and execution role are self-broadened. Hosted application CI 34206149899 / job 101995980303 passed exact checkout, live-base, lockfile, install and typecheck, then failed at release tests, so this is a real RED rather than a documentation-only claim.

Production c6e91dbe8b452e067d30890aae993b04b7cd814c now separates Noema Policy / Approval issuance from marketplace/catalog/scanner evidence. Current exact 9b6d2dc3371c74cb8e49bfa14a58fc0ae0d596b7 adds hostile/edge coverage for absent/broadened/malformed/throwing/duplicate grants, activation policy-version mismatch, and invocation-time policy revocation/drift. Unknown extensions have no implicit approval. AppGuardrail/quarantine/EgressWeave/contextual-orchestrator ownership is unchanged.

Issue #545 remains open: current exact four-gate evidence is still pending, ADR 0015 stays Proposed, and immutable shared-contract/live pilot/release evidence is not yet present.

[seonghobae]

현재 구현 PR #560의 fresh public-boundary review에서 Policy / Approval wrapper가 core normalizer보다 먼저 hostile 값을 읽는 결함을 확인해 수리했습니다. Legitimate admission 이후에도 null activation request, throwing policy_version getter, null invocation activation, null authority가 raw JavaScript 예외를 경계 밖으로 흘릴 수 있었습니다. Test-only 2096510f097b31e614fb788a5f4228ee45bec890에 네 hostile case를 추가했고, descendant가 즉시 생성되어 hosted runs 34213406650 / 34213406552 / 34213406673 / 34213406654는 실행 전 cancelled되었으므로 hosted RED로 주장하지 않습니다. Production 83a54b699e9b5678b6f41125f57cb36fc5ce9597은 public activation/invocation seam을 ExternalExtensionAdmissionError로 fail-closed 정규화합니다. Test-only parent 대비 production delta는 source 1개 파일 +26/-16입니다. 현재 exact-head CI/reviewer/Security/image는 새 세대로 queued이며 predecessor GREEN은 merge authority로 사용하지 않습니다. ADR 0015는 계속 Proposed; live plugin installation, immutable shared-contract consumption, isolation/egress operation, pilot measurement, release/rollback evidence는 아직 별도 acceptance입니다.

[seonghobae]

추가 fresh review에서 resolvePolicyApproval()이 resolver 호출 자체는 try/catch로 감싸지만 authority.resolvePolicyApproval property read는 그 바깥에서 수행하는 것을 확인했습니다. 따라서 core catalog/scan authority는 정상이어도 optional policy resolver accessor가 throwing getter이면 raw attacker exception이 admission boundary 밖으로 누출됩니다. 현재 test-only exact 53eab9615dee8e5c859c1ad3cd6f9df41745bbe5가 그 hostile accessor를 ExternalExtensionAdmissionError로 정규화하도록 요구합니다. Current exact의 application CI 34213929649, reviewer-ci 34213929780, required Security 34213929477, patch-validator-image 34213929565는 아직 queued/pending이므로 RED/GREEN을 선취하지 않습니다. 이 test-only generation이 실제 결과를 내기 전에는 production source를 다시 움직이지 않습니다.

[seonghobae]

Current execution authority (2026-09-08 KST): PR #560 is the active Noema Tool / Capability implementation lane on protected main@36e5cf957ee20a8bb3e19ff50fea6c97771d2ba1. Fresh review found a separate public-admission hostile-input seam: a revoked Proxy in a descriptor capability list could make Array.isArray() throw raw TypeError. Test-only exact f30f67328efbcd0b8bed7ac89f7c64c40528ea44 produced hosted application-CI RED 34218780676 / job 102036728526 after checkout, live-base guard, lockfile, install and typecheck had passed. Production exact 802b0bff0f32c170ada328b04e87e0db43ee7cd4 now normalizes only non-domain hostile exceptions at public admitExternalExtension() into ExternalExtensionAdmissionError; list/capability validation remains unchanged. Current exact-head CI 34219296338, reviewer-ci 34219296283, and required Security 34219296330 are terminal SUCCESS; patch-validator-image 34219296355 remains in progress, so this is not merge authority yet.

Foreign-owner prerequisites remain separate: ContextualWisdomLab/context-graph-contracts#27 is the immutable shared external-capability contract owner and currently has no release; ContextualWisdomLab/appguardrail#1099 is the current exact-plugin scanner/provenance owner. Historical references in this issue to AppGuardrail #1036 are predecessor context, not current completion authority. Noema does not synthesize shared-contract, scanner, quarantine, egress, installation, provider/model-routing, or product-domain evidence while those owner lanes remain open.

[seonghobae]

Current owner handoff — Noema #560 authority-provenance repair

Fresh exact-head review found an invocation-time complete-mediation gap after the earlier policy/replay repairs: admission stores the trusted composite authority in the module-private BOUND_POLICY_APPROVALS binding, but the public invocation seam still accepted a caller-supplied structurally compatible authority for live catalog/scan/policy lookups. A lookalike port returning equivalent values could therefore substitute for the authority that actually issued admission.

Test-only abcd1fea4b28b826826fed6b23296b59ceda98ca added the hostile caller-substitution case. Hosted application CI 34229792451, job 102072775696, checked out that exact head, passed live-base/lockfile/install/typecheck, reached release tests, and completed FAILURE; reviewer-ci and required Security on the same generation were SUCCESS. This is a real source-contract RED, not runner starvation.

Production f8814b8fd7b66f40335df85c6aadab12aa760bc1 now requires invocation to use the same authority object bound at admission and performs policy/catalog/scan live revalidation through that bound authority. It does not copy scanner, isolation, egress, or provider-routing authority into Noema.

The first production repair exposed that older catalog-drift tests had intentionally created a second live authority object, so 1acbf2f464cbfb0c5ad6e3991ecc9b04f17fb895 repaired those fixtures to mutate the same admission-bound port after admission while retaining a distinct hostile lookalike-authority rejection. Current exact-head CI/reviewer/Security/image are fresh and nonterminal; predecessor GREEN does not transfer. Keep #560 Draft until the unchanged exact head reaches the required terminal gates and fresh review/ancestry remain clean.

[seonghobae]

Fresh exact-source review found one additional admission invariant that is implicit in the issue's exact-source requirement but was not directly executable: an authentic activation or replay receipt issued for admission A must never authorize admission B, even when the same trusted authority object now resolves B and the artifact digest/product/role/policy/time fields happen to match. Exact upstream repository/commit/path/marketplace identity is part of the admitted authority, not merely artifact bytes.

Reality RED: test-only 0a32ee0a88378931a07b7e3b61cc31e3b494a7ab admitted source A, issued a legitimate activation, moved the same trusted authority to source B with the same artifact digest, admitted B, and attempted B invocation with A's activation. Hosted application CI 34235691056, job 102092675348, passed exact checkout/live-base/lockfile/install/typecheck and failed in release tests. Test-only 49115306b4abf7656f7fd136de8a3ff0c5a1968b extends the contract to retained activation replay and retained public invocation-receipt replay.

Production 84a93a2ffcd539df0deb96a9037a31fa863bdcaf binds issued/replayed activations and public invocation receipts to the exact AdmittedExternalExtension that authorized them, while keeping AppGuardrail/quarantine scanner/isolation evidence, EgressWeave outbound authority, Keyverse identity/secret handles, and contextual-orchestrator provider/model routing outside Noema. Current exact-head gates are fresh/nonterminal; this does not close #545 or claim pilot/release completion.

[seonghobae]

Fresh P1 retention finding noema#560 comment 5586356333 is now through reality RED → production repair. Test-only 3f41d94af1454926b65b1801004fe245098742b0 required replay equality to stop retaining reversible JSON.stringify(normalizedRequest) and instead bind every semantic field into a versioned/domain-separated fixed-width SHA-256 identity. Hosted application CI 34237704683, job 102099615873, passed exact checkout/live-base/lockfile/install/release typecheck and then completed FAILURE in release tests, so this is real current-lineage RED rather than a queue inference.

Production 79182c7be196c42fb94450cae9a7857ae67b5434 now retains only noema.external_extension.invocation_envelope:v1:sha256:<digest>, using fixed-order canonicalization of every invocation semantic field plus a known-vector regression. It adds no Node compatibility and no dependency. ADR 0015 exact ac6b6c088f034a8778bdc8a859f7157223883b8d records FIPS 180-4 SHA-256 authority, process-local WeakMap lifecycle, fail-closed restart semantics, no plaintext migration, explicit future digest-version migration, and platform-primitive replacement conditions. This remains candidate source: current exact-head CI/reviewer/Security/image evidence is fresh/nonterminal and no release/pilot/buyer completion is claimed.