CloudConnectionPlugin: forward installMode and the installing user to the control plane, run importUnmanagedPackage on an unmanaged grant, and audit the copy's result in the environment (cloud#3624) #30964

repo:cloud#1 · os-baozhoutao · session_013w7BrxKc6dUYe6Rw6tQW4G

Filing gate: ④ coordination, a framework half of objectstack-ai/cloud#3624. Ruling A, record objectstack-ai/cloud#3624 comment 6686728844, maintainer 「A + 两边审计 + 转发安装人（推荐）」.

Business reason. A hosted environment must be able to install an unmanaged-capable package as the customer's own copy, with both halves audited and the control-plane audit row naming a person.

Reader who acts. The lane owning packages/cloud-connection (triage sets lane and grade).

Sequencing (from the ruling): "The framework halves of #30794 (namespace), #30808 (seed copy) and this card all change the same import door. Serialize them after #30794."

Blocked-by: #30794

Dedupe: CloudConnectionPlugin installMode and forward installer cloud-connection → no card.

Measured (pin c50e0dfa)

• cloud-connection-plugin.ts /cloud-connection/install forwards package_id and seed_sample_data only.
• The environment → control-plane call is service-mode and carries no user (the ruling cites cloud-connection-plugin.ts:957-961).
• importUnmanagedPackage is the environment kernel's protocol-service verb (marketplace-install-local-plugin.ts).

Ask, each item from the ruling

1. Forward installMode (and the namespace once An unmanaged install can take a target namespace: the copy is re-namespaced at install through the duplicate-package rename engine #30794 lands) to the control plane.
2. Forward the installing environment user, so the control-plane audit row names a person rather than the environment's service principal.
3. On an unmanaged grant, run importUnmanagedPackage in the environment as the installing user. Load no sample data (framework parity). When An unmanaged install can copy the package's seed data, removable as one batch, owned by the installer (gallery demos need data) #30808 lands, copied seed rows belong to the installer.
4. Environment audit: record the copy's result (targetPackageId, namespace, copied count, success or failure). Only the environment knows whether the copy succeeded.

The control-plane judgement and its audit row are cloud's (objectstack-ai/cloud#3624).