[wanglongan587]

Summary

frozen execution configuration
  verify artifact receipt + declaration + settings + protocol
  acquire scoped mTLS grant -> private live plugin context
  exact adapter acknowledgement -> first prompt
  end / revoke -> stop owned processes, revoke grant, remove private state

Controller forwards the immutable non-secret snapshot and reports exact target/contract/protocol capability. Declared plugin/child processes inherit an empty environment. Only historical official OpenCode bindings use the legacy conversion. Package proof is retired before replacement, and unproven pre-upgrade packages require verified re-downloads.

Stack: merge SDK #703 first and Cloud #106 for the pinned control contract. New host admission remains gated by Cloud deployment configuration; no plugin declaration is published here.

ADR: plugin-owned-model-adapters remains approved. Concrete adapters and final rollout are separate coordinated changes.

Refs ora-space/circus#336

Evidence

• Before: Node generated OpenCode configuration for every model binding and had no declared startup proof.
  After: a real generic plugin process applies exact scalar JSON before its first prompt; missing acknowledgement gets no prompt, and revocation ends the session and releases the grant.
• Linux tests passed for Node, Controller, runtime, plugin/Node protocols, configuration and process packages. Workspace library clippy passed with warnings denied. Rust size gate passed.
• Real mTLS fixture verifies grant lifecycle; an OS process test verifies empty environment inheritance. Numeric settings survive the Controller/Node/plugin boundary. Runtime tokens are absent from host session history.
• SDK feat(plugin-sdk): add confirmed model adapter startup contract #703 independently passed Linux/macOS/Windows, frontend, Tauri and e2e CI. This branch's full CI remains required before readiness.

Merge Danger

Door: two-way

No database migration in this repository. Adds a management-owned receipt layout under plugins/.node-receipts without adopting legacy directories as verified artifacts.

Blast Radius: agent-runtime

Keep model admission disabled until Cloud/Controller/Node and published SDK/concrete plugins are deployed together. Controlled fixtures do not replace production multi-user sandbox acceptance.

Refs ora-space/circus#354