Filtered to Area F

Every part of the bundle MUST be a first-party plugin, installed, updated, removed and validated by the path any plugin takes, and the bundle and its first-party manifests MUST be embedded in the binary.

The vocabulary MUST name proxy.front, dashboard.show, quality.sync, archive.extract, stream.guard, invite.decline and request.gate, each with a contract, and every capability in the vocabulary MUST be asked by something in the bundle or by the core over its contract.

A plugin MUST NOT fill a capability unless its adapter conforms to that capability's contract, proved by recordings against its pinned upstream and by a live conformance pass at install, and first-party adapters MUST be held to the same suite; a first-party plugin the bundle assembles, which has no adapter, MUST fill a capability only through its claims, each proved against its recordings as F9-R2 holds a bundled service's.

Every first-party plugin MUST live in a repository of its own, every first-party adapter MUST be built on the adapter kit, and every image a first-party plugin builds MUST be published from every commit on its repository's main and by the release train (OPS-R90).

The flow check MUST be performed statically, before any of the recipe's calls is made.

Every capability in the vocabulary MUST have a published, versioned contract generated from the core's port types, and the core MUST reach every service only through a contract it speaks.

The core MUST hold no code specific to any service, and an architecture check MUST refuse a bundled service's name in core code outside the bundle.

A service MUST declare the contracts it speaks, and a manifest MUST NOT name an in-process adapter.

Substituting a filler MUST stop the part it replaces and take it out of its form while keeping its data, undoing it MUST bring that part back with its data, and the rehearsal MUST say what does not carry over.

An adapter MUST declare the upstream releases it supports, each proved by its own recordings, and the core MUST NOT compare versions.

Every capability MUST be proved by a substitute other than its first-party filler, run end to end against its pinned upstream through install, its first-run flow, conformance, substitution, the features the capability serves, and undo.

A plugin MUST be first-party only where the build embeds its id, the digest of its manifest and the digest of its tree in its first-party set, as the signed default bundle names them at the release the build pins; any other plugin MUST be third-party however it was installed.

A third-party plugin MAY be granted one named credential for a capability it fills; the grant MUST be part of the install or update offer and approved by the operator, MUST be journalled and revocable, and MUST be shown on the credentials surface, and without a grant no credential MUST cross to it.

Where the media server is a plugin's service that speaks identity.source, its first-run setup MUST go over that contract with an administrator's password lemonfiber mints and keeps under that server's own setting, and the request service's identity setup MUST be given that password with the stack-network address and the native API of the service the adapter fronts; where that service declares no native API, the setup MUST NOT be attempted and the run MUST say so, naming the plugin.

Setup MUST accept a key link (C10-R18) in place of the address, key and pin: it MUST collect the key once over the TLS the link's fingerprint verifies (C10-R20), keep only what the reply carries, and name the reason when the claim is refused.

Setup MUST accept a key link (C10-R18) in place of the address, key and pin: it MUST collect the key once over the TLS the link's fingerprint verifies (C10-R20), keep only what the reply carries, and name the reason when the claim is refused.