Summary

• Publish the public policy, schemas, client, verifier, skills, and release projections for a closed standalone managed-provider bundle.
• Keep provider executors, authentication mechanics, raw command construction, and host-specific implementation exclusively in the private workspace-built artifact.
• Link the exact private runtime implementation in sumitake/agent-collab-workspace#1886.
• Do not publish a public plugin release during this private development-channel phase.

Exact source pair

• Public head: bff69a49e19c04a0c5d7be4dfbbc7965c3de019f (GitHub signature: verified).
• Private workspace head: 75e4912dbbc81c68509c09af5af2c83a304b7a86 (GitHub signature: verified).
• Workspace dependency PR #1882 is merged.

Public/private boundary

• Public code defines policy, roles, routing, family independence, request/result schemas, client validation, lifecycle projections, and a policy-only bundle verifier.
• Public code does not contain a provider executor, raw provider command, credential, private absolute path, retired package tree, downloader, post-install hook, or workspace bootstrap path.
• The verifier authenticates the closed member manifest without revealing private executor implementation.
• The plugin can operate standalone after an operator installs the signed/private runtime artifact; it never requires access to the workspace repository at runtime.
• Shared real-HOME plus PTY is policy-authorized for reliable Gemini, Grok, Composer, OpenCode, and eligible Codex execution, with role-specific authority and typed failure.
• Claude remains asynchronous/inbox-only; autonomous Claude invocation through OpenCode is prohibited.
• Read-only advisory calls and mutation-capable worker calls are separate contracts with no silent promotion or fallback.
• No replacement provider-specific plugin or compatibility preset is created.

Lifecycle and resource contract

• Bundle schema 2, runtime contract 3, broker protocol 2, provider result schema 1.
• Exact source/member identity is projected through install, refresh, rollback, uninstall, and public transition.
• The broker starts on demand and has zero idle process or wake cost after its idle teardown. The optional private development watcher is separate, briefly polling once per minute, and removable.
• Deployment and rollback require immutable artifact verification, bounded typed responses, exact state readback, and residue checks.
• Developer ID signing/notarization is documented as a future production gate; it is not falsely claimed for this private build.

Generated and release surfaces

• Skill specs and generated SKILL.md files are in parity.
• Claude and Codex marketplaces/manifests are in parity.
• Version metadata is bumped from 3.2.0 to 3.3.0.
• A unique changelog.d/ fragment is present; generated CHANGELOG.md remains unchanged under the fragment-only convention.
• Policy-only archive generation succeeds without private runtime source.

Verification

• Focused closed-bundle/provider/lifecycle suites — 213 passed.
• python3 -m unittest discover -s tests -t . — 292 passed.
• python3 -m unittest discover -s scripts -p 'test_*.py' — 254 passed.
• python3 scripts/build_skills.py --check.
• python3 scripts/build_marketplace.py --check.
• python3 scripts/build-changelog.py --dry-run.
• python3 scripts/check_release_consistency.py — version 3.3.0 consistent.
• python3 scripts/build_plugin_archive.py --output /private/tmp/agent-collab-3.3.0-policy-contract3.plugin.
• python3 scripts/secret_scan.py — 181 text files scanned, clean.
• python3 scripts/check-public-export-safety.py --active-tree --history.
• git diff --check.

Review and post-condition

Tier 3: this changes the runtime verification contract, routing authority, family provenance, lifecycle state, and release boundary. Antigravity approved the exact pair at high confidence and Claude approved it at medium confidence, both with zero blockers. Claude's remaining negative-path coverage suggestions are explicitly nonblocking.

Keep this PR draft until exact-head CI, both independent reviews, the disposable launchd probe, private activation, and fresh-session managed routing pass. After merge, verify exact merged commits and the linked workspace dependency. Do not publish a public plugin release without separate operator authorization.

Compliance trace

author: codex
standing_directives: public policy-only boundary; closed private runtime bundle; managed-provider-only routing; fragment-only changelog; signed commits; deterministic release and export validation; no public release in this phase
tier: 3
cross_check: APPROVE — Antigravity 2f3a5806-7e4e-4b42-9ab5-54b2ff4a2ba1 approved the exact 75e4912/bff69a4 pair at high confidence; Claude a4e16c6d-c352-4425-aacc-a2b4fcfa0c12 approved the same pair at medium confidence with zero blockers
post_condition: preserve draft until exact-head CI and reviews plus linked private activation and fresh-session route verification pass; no public plugin release in this phase
mcp_coverage_gap: NONE
contributor_rights: OPERATOR-CONFIRMED
operator_reserved: no
peer_review_verdict: APPROVE
peer_review_message_id: 2f3a5806-7e4e-4b42-9ab5-54b2ff4a2ba1
peer_review_agent: antigravity
peer_review_model: Antigravity managed reviewer
peer_review_effort: N/A
peer_review_reviewed_sha: bff69a4
peer_review_concerns_integrated: workspace f5c45b5 removes a second following replay lookup and guarantees cleanup of frozen publish staging; same-UID arbitrary replacement remains explicitly outside the threat model; typed malformed-frame handling matches the protocol; remaining suggested negative-path coverage is nonblocking