ADR-0025 M3 — third-party tier: T1 sandbox dispatch to QuickJS, publish-side secret / vulnerability scans, secret-refs to the settings/KV store, the fs / network enforce-or-remove decision, the deferred §7 answers #27125

Part of #27108 (M3). Blocked-by: #27124. Filing gate: ③ maintainer-directed — ruling 6461953053 on objectstack#26553 and ADR-0025 v2 §3.6 / §3.7 / §3.10 / §7 (PR #27118, merged). Filed by the director seat (session_01KrKXQVvgYk2AJ4VkqMobyb, ledger objectstack#12708). ⛔ Not a claim. ⛔ No domain:*: spans runtime (sandbox), cloud (scans), spec (secret-refs, the fs/network decision); triage sets the lanes and splits as needed.

维护者速读

第三方插件才需要的那一层：① runtime:'sandbox' 的插件在加载时分派到 QuickJS（packages/runtime/src/sandbox/quickjs-runner.ts 今天只跑脚本体），PluginSandboxRuntime 要么接上要么删；② 云端发布侧加密钥/漏洞扫描；③ 连接器凭据走 settings/KV 的 secret-refs（ADR-0007），不进包；④ permissions.fs / permissions.network 两类按 ADR-0049 定「执行或删除」；⑤ §7 推迟的三题：发布者密钥轮换/吊销、T2 进程外 RPC 面（仍预留）、插件间依赖冲突。每项一张子卡或一个 PR，M3 落完才允许未验证发布者的插件装进租户。

What lands

1. T1 dispatch: the M1 tier dispatch point routes sandbox to a QuickJS-backed PluginContext exposing only capability-gated ctx.api / crypto / log; PluginSandboxRuntime (core/src/security/sandbox-runtime.ts, zero production construction sites today) is either wired as that runtime or removed. The cloud publish-time rule (unverified publisher ⇒ not node) stays; the runtime now honours it.
2. Publish-side scans (cloud package-publish.ts): secret scan of the archive, known-vulnerability scan of the bundle's SBOM, per-file integrity re-verification on the server; findings block published.
3. Secret-refs (ADR-0007): configuration fields marked secret resolve to the settings/KV store at install; the artifact never carries a value; the first real connector is the acceptance.
4. fs / network enforce-or-remove: either enforceFileRead/Write and enforceNetworkRequest gain their call surface in the sandbox context, or the two classes leave PluginPermissionsSchema under ADR-0049 with a migration note. The lane proposes; the maintainer rules on a decision card if the two options differ in what a plugin may declare.
5. §7 answers: host trusted-root key set + rotation/revocation; the minimal T2 RPC contract (design only, T2 stays reserved); requires diamond resolution at install.

Acceptance

• An unverified publisher's runtime:'sandbox' plugin installs and runs under QuickJS with no Node API reachable; a node-tier plugin from the same publisher is refused at publish and at load.
• A planted secret and a known-vulnerable dependency are refused at publish with one finding each.
• No "NOT ENFORCED" / "never reached" self-description about tiers or fs / network remains in the tree; ADR-0025 v2 §3.6 / §3.7 become ✅ lines.

Size: XL (several cards; triage splits by lane). Clause-②: likely yes for item 4 if a permission class is removed (the lane declares the arm). Metadata-protocol: none.

Related

#27108 (epic, Q3, Q4, Q7, Q8), ADR-0025 v2 §3.6 / §3.7 / §3.10 / §7, ADR-0007, ADR-0049, ADR-0026 (UI plugins stay out).