first commit

openspec/changes/implement-plugin-registry-and-manifest-validation/proposal.md

@@ -0,0 +1,27 @@
+## Why
+
+Plugin installability is now the next platform dependency: server creation, plugin marketplace display, and plugin bridge work all need a trusted registry of game management plugin manifests. This change adds the manifest validation and registry surface so only safe, well-formed plugins become available to the platform.
+
+## What Changes
+
+- Define the first plugin manifest contract for game management plugins, including identity, server type, create form schema, lifecycle actions, run capabilities, UI contribution, and scoped permissions.
+- Add manifest validation in `plugins/` with schema fixtures and tests for valid and unsafe manifests.
+- Add platform domain, repository, service, DTO, validator, and API handling for registering, listing, and inspecting installed plugin metadata.
+- Reject or disable unsafe manifest requests such as raw host paths, direct run sockets, raw credentials, or raw AI provider keys.
+- Keep plugin marketplace metadata focused on game server management plugins, not billing, cloud host sales, or unrelated SaaS marketplace features.
+
+## Capabilities
+
+### New Capabilities
+
+- `plugin-registry-and-manifest-validation`: Validates game management plugin manifests and exposes installed plugin registry metadata through platform APIs.
+
+### Modified Capabilities
+
+- None. This change builds on the bootstrap plugin and platform-core constraints, which have not yet been archived into `openspec/specs/`.
+
+## Impact
+
+- Affects `plugins/` manifest schemas, fixtures, SDK-adjacent types, and validation tests.
+- Affects `platform/` plugin domain, DTOs, models, repositories, services, validators, routes, and API tests.
+- Adds or updates verification commands for plugin schema tests, platform API tests, `scripts/check-structure.sh`, and strict OpenSpec validation.