## 1. Plugin Manifest Validation

- [x] 1.1 Extend the plugin manifest schema and SDK-adjacent types with registry metadata, lifecycle actions, pages, AI purposes, artifacts permission, and explicit safe permission/capability allowlists.
- [x] 1.2 Extend `plugins/scripts/validate-manifest.ts` to reject unsafe raw host path, direct run, raw credential, and raw AI/provider key requests beyond JSON Schema shape validation.
- [x] 1.3 Add plugin validation fixtures/tests for the valid development manifest, invalid create form schema, and unsafe manifest requests.

## 2. Platform Registry Contracts

- [x] 2.1 Add platform domain, DTO, model, copy, and conversion contracts for game plugin manifest registration metadata including server display metadata, pages, AI purposes, and validation violations.
- [x] 2.2 Add platform validator rules for manifest registration, allowed permissions/capabilities, unsafe string detection, duplicate-free lists, and registry response safety.
- [x] 2.3 Add service and repository behavior that registers a manifest as an installed game plugin while preserving existing metadata create/list/detail behavior.

## 3. Platform Registry API

- [x] 3.1 Add a manifest registration endpoint under the game plugin API surface using named DTOs and the core service.
- [x] 3.2 Extend game plugin list/detail responses with registry metadata required by marketplace and server creation workflows.
- [x] 3.3 Add platform API/service/validator tests for valid manifest registration, duplicate rejection, filtering, unsafe manifest rejection, and no raw internal/key fields in responses.

## 4. Documentation And Handoff

- [x] 4.1 Update platform route/protocol documentation and plugin documentation to describe manifest validation and registry registration boundaries.
- [x] 4.2 Add a fresh-chat handoff block for this change.

## 5. Verification

- [x] 5.1 Run `npm test` from `plugins/` and record evidence.
- [x] 5.2 Run `npm run typecheck` from `plugins/` and record evidence.
- [x] 5.3 Run `go test ./...` from `platform/` and record evidence.
- [x] 5.4 Run `scripts/check-structure.sh` and record evidence.
- [x] 5.5 Run `openspec validate implement-plugin-registry-and-manifest-validation --strict` and record evidence.

## Evidence

- 2026-07-03: `npm test` from `plugins/` passed with 4 manifest/SDK tests.
- 2026-07-03: `npm run typecheck` from `plugins/` passed.
- 2026-07-03: `go test ./...` from `platform/` passed across api, config, domain, dto, model, repo, service, and validator packages.
- 2026-07-03: `scripts/check-structure.sh` passed with `structure check passed`.
- 2026-07-03: `openspec validate implement-plugin-registry-and-manifest-validation --strict` passed with `Change 'implement-plugin-registry-and-manifest-validation' is valid`.

## Fresh-Chat Handoff

```text
Implement OpenSpec change: implement-plugin-registry-and-manifest-validation

Scope:
- Implement only openspec/changes/implement-plugin-registry-and-manifest-validation/.
- Preserve root ownership boundaries in AGENTS.md.
- Do not add billing, cloud host sales, agent-provider/cloud-provider workflows, or unrelated marketplace features.

Read first:
- AGENTS.md
- openspec/changes/bootstrap-game-server-platform-architecture/proposal.md
- openspec/changes/bootstrap-game-server-platform-architecture/design.md
- openspec/changes/bootstrap-game-server-platform-architecture/specs/game-plugin-system/spec.md
- openspec/changes/bootstrap-game-server-platform-architecture/specs/game-server-platform-core/spec.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/proposal.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/design.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/specs/plugin-registry-and-manifest-validation/spec.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/tasks.md

Required closure:
- Complete task checkboxes only after evidence exists.
- Run `npm test` and `npm run typecheck` from `plugins/`.
- Run `go test ./...` from `platform/`.
- Run `scripts/check-structure.sh`.
- Run `openspec validate implement-plugin-registry-and-manifest-validation --strict`.
- Stop after this change is closed; do not start the next backlog item unless explicitly asked.
```