refactor!: centralize dynamic plugin validation and host APIs

[willkill07]

Warning

BREAKING CHANGE: [Rust, Python, Node.js, Go, and C API/source compatibility] The previous plugin initialization, validation, dynamic activation-spec, and global lifecycle APIs are removed without compatibility aliases. Migrate to each binding's initialize and validate entry points, passing programmatic configuration and an optional explicit plugins.toml; keep the returned PluginHostActivation alive for the full plugin lifetime and close it explicitly for deterministic teardown.

Overview

Centralize dynamic plugin validation, attestation, configuration layering, and activation ownership in the Rust core so every language binding uses the same fail-closed runtime path. This intentionally replaces the pre-0.8 plugin host APIs with a smaller breaking API built around initialize and validate.

• I confirm this contribution is my own work, or I have the right to submit it under this project's license.
• I searched existing issues and open pull requests, and this does not duplicate existing work.

Details

• Move artifact hashing, Ed25519 verification, trust-policy evaluation, bounded reads, schema validation, lifecycle-state selection, snapshotting, tamper checks, and cleanup from the CLI into core.
• Resolve plugin configuration with system-authoritative precedence: programmatic configuration, explicit plugins.toml, discovered user configuration, then discovered system configuration.
• Preflight all selected dynamic plugins before loading code and roll back partial activation on failure.
• Introduce a single activation handle that owns static registrations, native libraries, worker processes, snapshots, and the process-wide activation lease.
• Standardize the public surface as initialize and validate across Rust, Python, Node.js, Go, and C; both operations accept the same programmatic configuration and optional explicit configuration path.
• Remove the former dynamic activation-spec loaders, parallel initialization variants, global clear/report functions, and compatibility aliases.
• Keep plugin install/remove and managed Python-environment attestation in the CLI.
• Update binding declarations, examples, documentation, and cross-language tests for the breaking API.

Validation completed:

• just test-rust
• just test-python
• just test-node
• just test-go
• just test-python-plugin
• just docs
• uv run pre-commit run --all-files

Where should the reviewer start?

Start with crates/core/src/plugin.rs for the unified API and activation ownership model, then review crates/core/src/plugin/dynamic/configuration.rs for configuration discovery and precedence and crates/core/src/plugin/dynamic/trust.rs for artifact attestation. Binding projections are implemented in crates/python/src/py_plugin.rs, crates/node/src/api/mod.rs, crates/ffi/src/api/plugin.rs, and go/nemo_relay/plugin.go.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Closes RELAY-652
• Closes RELAY-475
• Closes RELAY-800
• Closes [Enhancement]: Initialize discovered [[plugins.dynamic]] without caller-built specs in Python #673

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

License Diff

Compared against origin/main.

Lockfile license changes

Lockfile License Changes

Rust

Added

• None

Removed

• None

Updated/Changed

• None

Node

Added

• None

Removed

• None

Updated/Changed

• None

Python

Added

• None

Removed

• None

Updated/Changed

• None

Status output

[license-diff] selected languages: rust, node, python
[license-diff] generating current inventory
[license-diff] current: generating Rust inventory
[license-diff] current: Rust inventory complete (446 packages)
[license-diff] current: generating Node inventory
[license-diff] current: Node inventory complete (367 packages)
[license-diff] current: generating Python inventory
[license-diff] current: Python inventory complete (105 packages)
[license-diff] current inventory complete
[license-diff] checking out base ref origin/main into a temporary worktree
[license-diff] base: generating Rust inventory
[license-diff] base: Rust inventory complete (446 packages)
[license-diff] base: generating Node inventory
[license-diff] base: Node inventory complete (367 packages)
[license-diff] base: generating Python inventory
[license-diff] base: Python inventory complete (105 packages)
[license-diff] base inventory complete
[license-diff] removing temporary base worktree
[license-diff] comparing inventories
[license-diff] rendering Markdown output
[license-diff] done

[github-actions]

Fern docs preview: https://nvidia-preview-pull-request-943.docs.buildwithfern.com/nemo/relay/dev