browser/openspec/changes/implement-plugin-registry-and-manifest-validation/tasks.md

1. Plugin Manifest Validation

• 1.1 Extend the plugin manifest schema and SDK-adjacent types with registry metadata, lifecycle actions, pages, AI purposes, artifacts permission, and explicit safe permission/capability allowlists.
• 1.2 Extend plugins/scripts/validate-manifest.ts to reject unsafe raw host path, direct run, raw credential, and raw AI/provider key requests beyond JSON Schema shape validation.
• 1.3 Add plugin validation fixtures/tests for the valid development manifest, invalid create form schema, and unsafe manifest requests.

2. Platform Registry Contracts

• 2.1 Add platform domain, DTO, model, copy, and conversion contracts for game plugin manifest registration metadata including server display metadata, pages, AI purposes, and validation violations.
• 2.2 Add platform validator rules for manifest registration, allowed permissions/capabilities, unsafe string detection, duplicate-free lists, and registry response safety.
• 2.3 Add service and repository behavior that registers a manifest as an installed game plugin while preserving existing metadata create/list/detail behavior.

3. Platform Registry API

• 3.1 Add a manifest registration endpoint under the game plugin API surface using named DTOs and the core service.
• 3.2 Extend game plugin list/detail responses with registry metadata required by marketplace and server creation workflows.
• 3.3 Add platform API/service/validator tests for valid manifest registration, duplicate rejection, filtering, unsafe manifest rejection, and no raw internal/key fields in responses.

4. Documentation And Handoff

• 4.1 Update platform route/protocol documentation and plugin documentation to describe manifest validation and registry registration boundaries.
• 4.2 Add a fresh-chat handoff block for this change.

5. Verification

• 5.1 Run npm test from plugins/ and record evidence.
• 5.2 Run npm run typecheck from plugins/ and record evidence.
• 5.3 Run go test ./... from platform/ and record evidence.
• 5.4 Run scripts/check-structure.sh and record evidence.
• 5.5 Run openspec validate implement-plugin-registry-and-manifest-validation --strict and record evidence.

Evidence

• 2026-07-03: npm test from plugins/ passed with 4 manifest/SDK tests.
• 2026-07-03: npm run typecheck from plugins/ passed.
• 2026-07-03: go test ./... from platform/ passed across api, config, domain, dto, model, repo, service, and validator packages.
• 2026-07-03: scripts/check-structure.sh passed with structure check passed.
• 2026-07-03: openspec validate implement-plugin-registry-and-manifest-validation --strict passed with Change 'implement-plugin-registry-and-manifest-validation' is valid.

Fresh-Chat Handoff

Implement OpenSpec change: implement-plugin-registry-and-manifest-validation

Scope:
- Implement only openspec/changes/implement-plugin-registry-and-manifest-validation/.
- Preserve root ownership boundaries in AGENTS.md.
- Do not add billing, cloud host sales, agent-provider/cloud-provider workflows, or unrelated marketplace features.

Read first:
- AGENTS.md
- openspec/changes/bootstrap-game-server-platform-architecture/proposal.md
- openspec/changes/bootstrap-game-server-platform-architecture/design.md
- openspec/changes/bootstrap-game-server-platform-architecture/specs/game-plugin-system/spec.md
- openspec/changes/bootstrap-game-server-platform-architecture/specs/game-server-platform-core/spec.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/proposal.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/design.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/specs/plugin-registry-and-manifest-validation/spec.md
- openspec/changes/implement-plugin-registry-and-manifest-validation/tasks.md

Required closure:
- Complete task checkboxes only after evidence exists.
- Run `npm test` and `npm run typecheck` from `plugins/`.
- Run `go test ./...` from `platform/`.
- Run `scripts/check-structure.sh`.
- Run `openspec validate implement-plugin-registry-and-manifest-validation --strict`.
- Stop after this change is closed; do not start the next backlog item unless explicitly asked.