ContextualWisdomLab · seonghobae · Sep 9, 2026 · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
@@ -65,6 +65,8 @@ Noema remains independently deployable. CWL composition is through versioned pro
 
 These are separate ownership domains. Noema does not duplicate their internal authority.
 
+This revision adds a candidate Tool / Capability admission port at `src/tool-capability/external-extension-admission.ts` for external Claude community plugins. It is not an HTTP route and does not change `/health`, `/ready`, or `/exchange`. Marketplace discovery, Anthropic review, and plugin packaging are not runtime authority. The port stays a local fail-closed ACL until an immutable `context-graph-contracts` artifact contract exists.
+
 ## 5. Evidence and authority separation
 
 | Plane | Meaning | Not equivalent to |

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,7 @@
 # Changelog
 
 ## Unreleased
+- Tool / Capability Boundary에 Claude community plugin 외부 확장 승인 포트를 추가한다. 마켓플레이스 메타데이터, 가변 브랜치/태그, Anthropic 리뷰, 플러그인 지시문은 승인 권한이 아니다. exact commit/path/digest, AppGuardrail·격리 영수증, 제품/역할 범위, 만료·롤백, 중복 활성화 재현만 통과하고, 제품 런타임에서 플러그인 래퍼를 실행하지 않는다. `context-graph-contracts` 불변 계약이 나오기 전에는 로컬 포트와 테스트 더블만 쓴다. issue #545, ADR 0015.
 - `noema-core` provider-neutral Shared Kernel을 추가하여 이미 해석된 PydanticAI `Model`과 역할별 prompt/schema만 받아 Agent를 구성한다. 문자열 model identifier와 provider discovery·credential·routing·retry·failover는 Shared Kernel 밖에 두고 `Agent(..., retries=0)`으로 repository-local model-attempt authority를 만들지 않는다. Reviewer wheel·sdist·editable 설치는 canonical `packages/noema-core` source를 포함하거나 참조하며 별도 100% coverage·docstring과 clean install smoke로 검증한다. 외부 소비는 immutable versioned publication·exact source identity·SBOM/provenance·licensing/NOTICE·compatibility/rollback evidence 전에는 허용하지 않는다.
 - `writeAcquisitionPrivateFile`의 기존 대상 사전-교체 검증 read(`existingDescriptor` open)에 `O_NONBLOCK`을 추가해 fail-closed를 강화한다. 이 open은 이미 필수 filesystem capability로 `O_NONBLOCK`을 검증했지만 실제로는 사용하지 않아, 로컬 권한을 가진 행위자가 사전 `lstatSync` 정규 파일 확인과 이 open 사이에 대상 경로를 FIFO로 교체하면 writer가 나타날 때까지 무한정 블로킹해 writer lease를 계속 점유할 수 있었다. `O_NONBLOCK`은 정규 파일에는 영향이 없고, FIFO에서는 open이 즉시 반환되어 이어지는 descriptor 타입 검증이 그대로 fail-closed로 거부한다. 회귀 테스트(`test/acquisition-private-output-existing-target-nonblocking.test.ts`)와 기존 open-flags 계약 테스트 갱신으로 고정했다.
 - `readStableFile`의 close-후 재검증 단계(`afterClosePath` lookup 실패)와 `writeAcquisitionPrivateFile`의 cleanup-시점 `O_NONBLOCK` 소실 분기에 대한 fail-closed 회귀 테스트를 추가해 `scripts/lib/acquisition-data-room-integrity.mjs`/`scripts/lib/acquisition-private-output.mjs`의 100% coverage 게이트를 복구한다. 동작 변화는 없다.

diff --git a/docs/CONTEXT_MAP.md b/docs/CONTEXT_MAP.md
@@ -54,6 +54,8 @@ Protected `main` also includes the durable execution slice integrated through #5
 
 Owns versioned allowlisted tool/capability descriptors, least-authority invocation, expiry, input/output bounds, and capability provenance. Arbitrary caller/model shell or network authority is not a Noema tool contract.
 
+This revision adds a local fail-closed admission port for external Claude community plugins (`src/tool-capability/external-extension-admission.ts`, ADR 0015, issue #545). Marketplace metadata, Anthropic review, mutable branch/tag refs, and plugin instructions are not admission authority. Exact repository/commit/path/digest identity, independently pinned AppGuardrail and quarantine receipts, product/role scope, expiry/rollback, and idempotent activation/invocation receipts are. Product-runtime execution of a Claude plugin wrapper is rejected. Until `context-graph-contracts` publishes an immutable shared artifact contract, this port is a local ACL/test double rather than a released shared-kernel dependency. The slice is candidate truth on this revision until protected integration.
+
 ### State / Checkpoint
 
 Owns versioned runtime checkpoint semantics needed for restart/cancellation/idempotency. Checkpoints contain only Noema runtime state and canonical foreign references; they must not copy another product's domain truth, provider credential state, or unrestricted reasoning/tool payloads.

diff --git a/docs/PRD.md b/docs/PRD.md
@@ -98,7 +98,7 @@ The protected Workflow / Task foundation admits one canonical execution identity
 
 Protected `main` also includes the durable Workflow / Task Execution slice integrated through #542: Durable Object state binding/routing, complete execution-plan authority, atomic task claim and checkpoint CAS/replay, effect-start and terminal evidence, cancellation/recovery authority, retained provenance, and hostile stored-record validation. This protected slice grants Noema runtime authority only under an explicit retained claim identity; it does not prove deployed Durable Object transaction compatibility, successful external side effects, or production runtime operation. ADR 0013 therefore remains `Proposed` until its deployment/runtime acceptance evidence exists.
 
-`contextual-orchestrator` remains the sole model discovery and routing owner; Noema does not add direct provider SDKs, provider credentials, provider fallback lists, or local routing policy. Tool / Capability Boundary, Isolation Integration, Policy / Approval, Observability, and Recovery remain separate bounded contexts under ADR 0012 and the canonical Context Map. Context Graph/EA integration requires an immutable released `context-graph-contracts` contract/profile and preserves EA Core as the authoritative Decision Plane; cross-service SQL is forbidden.
+`contextual-orchestrator` remains the sole model discovery and routing owner; Noema does not add direct provider SDKs, provider credentials, provider fallback lists, or local routing policy. Tool / Capability Boundary, Isolation Integration, Policy / Approval, Observability, and Recovery remain separate bounded contexts under ADR 0012 and the canonical Context Map. This revision adds a fail-closed Tool / Capability admission port for external Claude community plugins (issue #545, ADR 0015): marketplace metadata, Anthropic review, mutable refs, and plugin instructions are not admission authority, and product-runtime Claude plugin wrappers are rejected. Until `context-graph-contracts` publishes an immutable shared artifact contract, Noema keeps a local port and test double only. Context Graph/EA integration requires an immutable released `context-graph-contracts` contract/profile and preserves EA Core as the authoritative Decision Plane; cross-service SQL is forbidden.
 
 ## 5. Functional requirements
 

diff --git a/docs/TEST_STRATEGY.md b/docs/TEST_STRATEGY.md
@@ -26,7 +26,8 @@ Coverage 대상과 제외는 `vitest.config.ts` 및 reviewer CI가 source of tru
 - URL/origin/ref/SHA validators;
 - review/check/status reduction logic;
 - duplicate-key/UTF-8/path validators;
-- KPI/evidence schema logic.
+- KPI/evidence schema logic;
+- Tool / Capability external-extension admission, activation, and invocation receipts.
 
 핵심은 attacker-controlled input에 대한 closed-set acceptance입니다.
 

diff --git a/docs/TRACEABILITY.md b/docs/TRACEABILITY.md
@@ -58,6 +58,7 @@ Each arrow is a separate authority. Success at an earlier stage cannot fabricate
 | Patch-validator image supply chain | issue #66 + protected implementation | `Dockerfile.patch-validator`, image workflow, validator runtime/profile, SBOM/scanner/receipt validators | exact build/runtime/smoke/SBOM/vulnerability/receipt/final-head verification | protected-main operational receipt and later publication/signing/activation evidence | Source/runtime/supply-chain implementation is integrated on protected main; later operational/publication authority remains separate |
 | Licensing/IP authority | licensing/IP contract | rights/evidence validators | duplicate-key/UTF-8/exact-artifact and rights-metadata tests | owner/legal grant and transfer evidence | Technical controls exist; legal authority external |
 | Release/acquisition readiness | release/provenance/acquisition contracts | release verification and evidence scripts, digest-bound revenue/transfer source documents | exact-source package/SBOM/provenance/readiness and retained-source byte-integrity tests | immutable release/deployment/customer/revenue/legal authority | Technical byte binding implemented; commercial/legal authenticity remains external |
+| External Claude plugin admission | ADR 0015 + issue #545 + FR-022 | `src/tool-capability/external-extension-admission.ts` local fail-closed port/ACL | `test/external-extension-admission.test.ts` covering mutable source, catalog mismatch, forged receipts, forbidden authority, cross-product activation, expiry/rollback, catalog drift, replay, instruction promotion, product-runtime wrappers, and secret/product/reasoning receipts | immutable `context-graph-contracts` artifact contract, AppGuardrail successor evidence, isolation/egress operation, measured pilots | Implemented on active PR / In review; protected-main maturity follows integration |
 
 ## 3. Live governance traceability
 
@@ -78,6 +79,7 @@ Historical or integrated PR numbers are deliberately omitted from current owners
 | Patch-validator operational/publication proof | issue #66 | Source/image verification is integrated; protected-main operational receipt and later publication/signing/attestation/activation remain distinct authorities. |
 | Authentic production KPI evidence | issue #3 | Requires real production-window data; repository fixtures or synthetic evidence cannot satisfy it. |
 | Acquisition coordination | issue #5 | Coordinates evidence families without promoting earlier evidence into buyer/legal/commercial authority. |
+| External Claude plugin admission | issue #545 | Local fail-closed Tool / Capability port only; marketplace installation, Anthropic review, isolation runtime, and shared-contract GA remain separate authorities. |
 
 Canonical architecture/documentation is code-current by revision and is not owned by a historical documentation PR. Transient queue/green states belong to observation-scoped evidence, not timeless architecture claims.
 

diff --git a/docs/TRD.md b/docs/TRD.md
@@ -32,6 +32,10 @@ src/runtime-entrypoint.ts
 
 자세한 구현과 route ownership은 `ARCHITECTURE.md`, `docs/api-spec.md`를 따릅니다.
 
+### 2.2 External Claude plugin admission
+
+Tool / Capability Boundary의 로컬 포트 `src/tool-capability/external-extension-admission.ts`는 Claude community plugin 서술자를 exact repository/commit/path/digest와 독립적으로 pin된 AppGuardrail·격리 영수증에 결합한다. 가변 브랜치/태그, 로컬 경로, 마켓플레이스/카탈로그 불일치, 공급자 키, 광역 GitHub 권한, 미선언 셸/파일/네트워크/비밀/MCP, 다른 제품 승인, 만료·롤백, 카탈로그 drift, 관측 내용의 정책 승격, 제품 런타임 플러그인 래퍼는 실패-폐쇄한다. 이 포트는 HTTP API가 아니며 `/exchange` 권한을 바꾸지 않는다. `context-graph-contracts` 불변 계약이 나오기 전에는 로컬 ACL/테스트 더블이다.
+
 ### 2.1 `/exchange` inbound body deadline
 
 `POST /exchange`의 JSON body는 UTF-8 wire bytes 기준 최대 **8,192 bytes**이고, body read가 시작된 뒤 전체 stream은 **10,000 ms의 절대 wall-clock deadline** 안에 완료되어야 합니다. 작은 chunk를 반복해서 보내더라도 deadline은 재설정되지 않습니다. 제한시간을 넘긴 incomplete stream은 best-effort로 취소하고 **HTTP 408**의 Noema 표준 JSON error envelope로 실패-폐쇄하며, 이 경계는 distributed rate-limit delegation, OIDC/JWKS 검증, GitHub App private-key 사용과 GitHub API 호출보다 앞에서 적용됩니다.

diff --git a/docs/UML.md b/docs/UML.md
@@ -14,6 +14,7 @@ flowchart LR
     READY[runtime readiness]
     RATE[NoemaRateLimiter]
     REPLAY[NoemaOidcReplayGuard]
+    TOOL[tool-capability admission]
   end
 
   subgraph ReviewPlane[Review and model plane]

diff --git a/docs/adr/0015-external-extension-admission.md b/docs/adr/0015-external-extension-admission.md
@@ -0,0 +1,52 @@
+# ADR 0015: Fail-closed admission for external Claude community plugins
+
+Status: Proposed
+
+## Context
+
+CWL products can discover curated plugins through `anthropics/claude-plugins-community`, but wholesale marketplace installation would turn third-party prompts, hooks, MCP servers, shell commands, and network access into implicit runtime authority. Anthropic review of that catalog is useful upstream evidence, not CWL admission authority. Issue #545 assigns the Tool / Capability Boundary the job of versioned external-extension descriptors, least-authority activation, expiry, rollback, and invocation receipts.
+
+`context-graph-contracts` does not yet publish an immutable shared artifact contract for this descriptor. AppGuardrail, quarantine-sandbox-runtime, EgressWeave, and Keyverse remain the owners of scanning, isolation, egress, and secret handles. Waiting for those foreign GA releases would stall an independently verifiable Noema port.
+
+## Decision
+
+Noema keeps a local fail-closed Tool / Capability port in `src/tool-capability/external-extension-admission.ts`:
+
+- Admission binds exact `upstream_repository`, lowercase commit SHA, relative path, artifact digest, and marketplace-entry digest.
+- Mutable branches, tags, `latest` versions, absolute paths, and parent-segment paths are rejected.
+- Marketplace metadata that disagrees with an independently pinned catalog is rejected.
+- AppGuardrail and quarantine receipts must be pinned separately and must match the artifact and isolation policy.
+- `developer_assist` admits no filesystem, network, process, secret, or MCP capabilities. Provider keys and broad GitHub authority are forbidden.
+- Product-scoped activation cannot use another product's approval. `approved_for_pilot` is not invocation authority.
+- Expired, suspended, superseded, rejected, or rollback-marked extensions cannot be invoked.
+- Catalog drift after admission cannot silently update an active extension.
+- Duplicate activation and invocation events are idempotent replay; conflicting retained events fail closed.
+- Plugin instructions cannot promote observed content into trusted policy or new capability.
+- Product-runtime mode cannot execute a Claude plugin wrapper.
+- Invocation receipts contain only identity fields and must not carry secrets, raw product data, or hidden reasoning.
+
+This port is a test double and Anti-Corruption Layer until an immutable `context-graph-contracts` release exists. Noema does not copy plugin source, install the marketplace, or treat Anthropic review as CWL trust.
+
+The decision follows least privilege and complete mediation (Saltzer & Schroeder, 1975) and fail-closed verification of untrusted software components (National Institute of Standards and Technology, 2022).
+
+## Consequences
+
+Operators can reject hostile plugin metadata deterministically without waiting for foreign GA. The cost is a local descriptor that must later be replaced by a released shared contract without changing the fail-closed invariants. AppGuardrail and quarantine receipts remain pins, not proof that those owners have completed their own product work.
+
+## Rejected alternatives
+
+- **Wholesale marketplace installation:** rejected because unreviewed connectors would inherit runtime authority.
+- **Trust Anthropic catalog review as CWL admission:** rejected because upstream review is not this organization's authority.
+- **Copy plugin source into Noema or product repositories:** rejected because it creates a mutable foreign system of record.
+- **Wait for `context-graph-contracts` GA before any Noema port:** rejected because a local fail-closed ACL is independently verifiable and can later consume the released contract.
+- **Allow product-runtime Claude plugin wrappers:** rejected because product execution must use product-owned protocol/API ports, not community plugin packaging.
+
+## Acceptance
+
+This ADR remains `Proposed` until the local port is protected source, exact-head CI/security/review evidence is terminal clean, and later slices bind trusted research/execution producers, immutable shared-contract consumption, AppGuardrail successor evidence, and measured pilot activation. Source tests do not prove live plugin installation, isolation runtime operation, or buyer completion of issue #545.
+
+## References
+
+National Institute of Standards and Technology. (2022). *Secure software development framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). https://doi.org/10.6028/NIST.SP.800-218
+
+Saltzer, J. H., & Schroeder, M. D. (1975). The protection of information in computer systems. *Proceedings of the IEEE, 63*(9), 1278–1308. https://doi.org/10.1109/PROC.1975.9939
diff --git a/docs/adr/README.md b/docs/adr/README.md
@@ -18,6 +18,7 @@ ADR은 **왜 이 구조를 선택했는지**를 기록합니다. 구현 상태
 | [0012](./0012-runtime-orchestration-bounded-contexts.md) | Proposed | Agent Runtime, Workflow / Task Execution, Tool / Capability, State / Checkpoint, isolation, policy, observability, recovery의 소유권을 분리하고 provider routing·foreign truth·cross-service SQL을 Noema 경계 밖에 둔다. |
 | [0013](./0013-durable-workflow-execution-authority.md) | Proposed | runnable candidate와 durable claim/effect start/terminal recovery/checkpoint commit을 분리하고 bounded transition provenance를 Noema state-store 경계에 둔다. |
 | [0014](./0014-shared-noema-core-package.md) | Proposed | role-neutral PydanticAI `Agent(...)` construction만 `packages/noema-core` Shared Kernel로 추출하고 provider routing·credential policy·verdict·tool/deps·tenant truth는 canonical owner에 남긴다. |
+| [0015](./0015-external-extension-admission.md) | Proposed | Claude community plugin은 exact commit/path/digest와 별도 scan 영수증으로만 승인하고, 마켓플레이스 설치·Anthropic 리뷰·제품 런타임 래퍼는 실패-폐쇄한다. |
 
 ## ADR lifecycle
 

diff --git a/docs/threat-model.md b/docs/threat-model.md
@@ -16,6 +16,7 @@
 6. Cloudflare가 허용하는 대용량 또는 chunked JSON request를 이용한 isolate 메모리·CPU 고갈
 7. GitHub OIDC/JWKS 또는 GitHub App API subrequest가 응답하지 않아 `/exchange` 요청과 Worker 자원을 장시간 점유하는 가용성 저하
 8. 신뢰된 GitHub endpoint가 과대 또는 길이 미상 response body를 반환해 `response.json()` 이전에 isolate 메모리를 고갈시키는 가용성 저하
+9. Claude community plugin 마켓플레이스 메타데이터, Anthropic 리뷰, 가변 브랜치/태그, 또는 플러그인 지시문을 런타임 권한으로 승격하려는 시도
 
 ## 대응
 - `iss`, `aud`, `repository_owner`, `workflow_ref` 엄격 검증
@@ -47,6 +48,7 @@
   - 유출 의심 시 즉시 비밀키 폐기 후 신규 발급
   - 대상 조직 권한 재검토
 - 로그에서 `Authorization`, `token`, `pem`, JSON request body 제거
+- Claude community plugin은 exact commit/path/digest와 별도 AppGuardrail·격리 영수증으로만 승인하고, 마켓플레이스 설치·제품 런타임 래퍼·비밀/제품 데이터 영수증은 실패-폐쇄함 (ADR 0015)
 
 ## 참고
 - Cloudflare Workers limits: https://developers.cloudflare.com/workers/platform/limits/