## 1. Runtime Profile Contract

- [x] 1.1 Add typed runtime profile declarations to platform domain, DTO, model, copy, and response projections.
- [x] 1.2 Validate profile keys, references, capabilities, safe strings, and cross-profile references during manifest registration.
- [x] 1.3 Persist registered runtime profiles through file/MySQL snapshots and prove reload behavior with tests.

## 2. Runtime Binding Persistence and API

- [x] 2.1 Add runtime binding snapshot persistence and repository reload coverage.
- [x] 2.2 Implement required logical-key derivation and binding validation against the selected plugin profile.
- [x] 2.3 Implement authorized list/update binding services and redacted DTO projections.
- [x] 2.4 Add documented server runtime-binding routes and API authorization/non-disclosure tests.

## 3. Lifecycle and Action Gating

- [x] 3.1 Extend server creation DTO/domain flow with a required profile key and initial logical bindings.
- [x] 3.2 Persist the binding before install dispatch and reject incomplete or undeclared create inputs.
- [x] 3.3 Gate start/stop and runtime-dependent actions on a present, current, complete binding with safe reasons.
- [x] 3.4 Add service/API regressions for missing/invalid bindings, successful dispatch, and reload survival.

## 4. Management Console

- [x] 4.1 Add frontend API types/client methods and form contracts for runtime profiles and redacted bindings.
- [x] 4.2 Connect plugin profile selection and declared logical binding inputs to the create-server workflow.
- [x] 4.3 Add a server-detail review/update workflow with safe missing reasons and no runtime value disclosure.
- [x] 4.4 Add frontend regressions proving real request submission, review/update behavior, and secret/path/socket non-disclosure.

## 5. Verification and Documentation

- [x] 5.1 Update platform, plugin, and web API/domain documentation for persisted profile and binding behavior without claiming later roadmap readiness.
- [x] 5.2 Run plugin manifest/SDK tests, platform Go tests, platform_web tests/typecheck/build, and risk-relevant run tests if run changes are required.
- [x] 5.3 Run `openspec validate persist-runtime-profiles-and-server-bindings --strict` and `scripts/check-structure.sh`, then record only evidence-backed completion.