[fffonion]

Scope

Draft implementation of RSS plugin graphs and Native tool/effect virtualization. This update closes the local first-A slice: one trusted stateless ToolOnly tool linked to one pure leaf library, using the existing read_file authorization, library transformation, and managed commit path.

• Capture and validate the full immutable graph lock, package closure, exports and code identity before admission; keep existing A/B run pinning and strict replay identities.
• Retain the original persistence owner and cancellation/deadline for Native execution and managed replay. Re-read the exact graph authorization at execution boundaries; do not cache positive authority.
• Keep historical receipt queries separate from executable restoration. Revocation or missing/substituted packages do not rewrite history or authorize a new execution.
• Cache only immutable bundled schema and builtin-source material, returning isolated owned values.
• Preserve real Native prepare/commit, original grants, exact cancellation/error classification, one-effect completion, and cleanup boundaries.

Local validation

On the reviewed final code, with Rust 1.99.0, locked/offline dependencies, default test-harness concurrency, and unchanged feature/profile settings:

• Library: 611 passed, 0 failed, 6 ignored (617 outer cases).
• Six affected integration targets: 103 unique tests passed, 0 failed:
  • plugin_effect_api_e2e_tests: 12
  • plugin_graph_tests: 36
  • plugin_hot_reload_tests: 11
  • tools_pin_invoke_tracer: 17
  • tools_pin_production_ab: 10
  • tools_pinned_commit_outcome: 17
• cargo fmt --all -- --check: passed.
• cargo clippy --locked --all-features --all-targets -- -D warnings: passed without new suppressions.
• plugin_schema_sync --check: passed.
• Six focused cancellation/replay cases also passed; they are a subset of the library count, not additional unique tests.
• Independent source review accepted the production integration and subsequent fixture/lint changes, including the final Luna review. Nonblocking setup-failure cleanup advisories remain recorded.

Four readonly replay fixtures establish their initial 10-second budget before their single admission. Their negative probes still close the same original root or wait for its actual original deadline, keeping the query cut and strict error/history assertions. The separate 2-second Native/child-clock cases, production defaults, and management budgets are unchanged.

The accepted stack was rebased onto current master, without a merge. Upstream added only LICENSE; all 481 pre-rebase paths were preserved exactly. Compared with the locally tested source, the additional plan-status edit is documentation-only; production, tests, RSS bodies and schemas are byte-identical.

Remaining boundary

This PR remains Draft and unmerged. The documentation-only follow-up documents the four existing, primary-only host plugin-control environment variables, with no Rust, test, or guard changes. The original documentation target reproduced the missing-doc failure (8 passed, 1 failed), then passed all 9 cases with both all features and default features; targeted Clippy also passed with warnings denied. Each gate compared all 482 frozen source paths byte-for-byte before and after execution; the other 481 paths are unchanged. Current-head CI 41698082251 passed the original documentation target (9/0) but failed gateway_tests (65 passed, 3 failed). Two terminal-recovery cases reported plugin_graph_pin_required; the read-only replay case returned 503 instead of 202. A single unchanged local execution reproduced the same three failures. Focused causal analysis is in progress; this full all-target gate remains unsuccessful, with no unchanged-head rerun. Prior run 41685803714 remains a historical documentation failure; it was not rerun on the unchanged head.

Formal T07 tool-to-tool calls, multi-library/all-tool T14 expansion, stateful children, and the new topology's complete checkpoint/restore and related remaining T15/T16 flows remain subsequent work. Existing typed unsupported boundaries are retained. No new OS isolation backend or arbitrary third-party process confinement is claimed.

Earlier failed candidates and CI runs remain historical evidence. This update does not relabel their causes or claim that unrelated historical lifecycle/PID timing failures have been solved.