feat: implement dynamic plugin host policy and attestation gates

crates/cli/Cargo.toml

@@ -30,6 +30,7 @@ nemo-relay-adaptive = { workspace = true, features = ["redis-backend"] }
 nemo-relay-pii-redaction.workspace = true
 async-stream = "0.3"
 axum = "0.8"
+base64 = "0.22"
 bytes = "1"
 clap = { version = "4", features = ["derive", "env"] }
 clap_complete = "4"
@@ -39,10 +40,12 @@ http = "1"
 http-body-util = "0.1"
 dialoguer = { version = "0.11", default-features = false }
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-native-roots-no-provider", "stream"] }
+ring = "0.17"
 rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
+sha2 = "0.11"
 strum = { version = "0.27", features = ["derive"] }
 thiserror = "2"
 tokio = { version = "1", features = ["macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }

crates/cli/src/config.rs

@@ -11,10 +11,12 @@ use nemo_relay::plugin::dynamic::DynamicPluginManifest;
 use nemo_relay::plugin::{PluginError, merge_plugin_config_documents};
 use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
-use strum::Display;
+use strum::{Display, IntoStaticStr};
 
 use crate::error::CliError;
 use crate::plugin_shim::PluginShimCommand;
+use crate::plugins::lifecycle::enforce_required_dynamic_plugin_startup;
+use crate::plugins::policy::DynamicPluginHostPolicy;
 
 #[derive(Debug, Clone, Parser)]
 #[command(name = "nemo-relay")]
@@ -590,6 +592,7 @@ pub(crate) struct ResolvedConfig {
     pub(crate) gateway: GatewayConfig,
     pub(crate) agents: AgentConfigs,
     pub(crate) dynamic_plugins: Vec<ResolvedDynamicPluginConfig>,
+    pub(crate) dynamic_plugin_policy: DynamicPluginHostPolicy,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -601,7 +604,7 @@ pub(crate) struct ResolvedDynamicPluginConfig {
     pub(crate) source: PathBuf,
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Display)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Display, IntoStaticStr)]
 #[serde(rename_all = "snake_case")]
 #[strum(serialize_all = "snake_case")]
 pub(crate) enum DynamicPluginHostConfigStatus {
@@ -731,6 +734,7 @@ impl Default for GatewayConfig {
 pub(crate) fn resolve_server_config(args: &ServerArgs) -> Result<ResolvedConfig, CliError> {
     let mut resolved = load_shared_config(args.config.as_ref())?;
     apply_server_overrides(&mut resolved.gateway, args)?;
+    enforce_required_dynamic_plugin_startup(args.config.as_ref(), &resolved)?;
     Ok(resolved)
 }
 
@@ -771,6 +775,7 @@ pub(crate) fn resolve_run_config(
     resolved.gateway.bind = "127.0.0.1:0"
         .parse()
         .expect("valid transparent bind address");
+    enforce_required_dynamic_plugin_startup(config, &resolved)?;
     Ok(resolved)
 }
 
@@ -1041,13 +1046,16 @@ fn apply_file_plugins_config(gateway: &mut GatewayConfig, plugins: Option<FilePl
 struct PluginTomlConfig {
     value: Option<Value>,
     dynamic_plugins: Vec<ResolvedDynamicPluginConfig>,
+    dynamic_plugin_policy: DynamicPluginHostPolicy,
     sources: Vec<PathBuf>,
 }
 
 #[derive(Debug, Clone, Default, Deserialize)]
 struct PluginTomlPluginsSection {
     #[serde(default)]
     dynamic: Vec<FileDynamicPluginConfig>,
+    #[serde(default)]
+    policy: Option<crate::plugins::policy::FileDynamicPluginHostPolicy>,
 }
 
 #[derive(Debug, Clone, Deserialize)]
@@ -1070,6 +1078,7 @@ where
 {
     let paths = paths.into_iter().collect::<Vec<_>>();
     let mut dynamic_plugins = Vec::new();
+    let mut dynamic_plugin_policy = DynamicPluginHostPolicy::default();
     let mut seen_plugin_ids = HashSet::new();
     let mut runtime_documents = Vec::new();
 
@@ -1087,14 +1096,13 @@ where
                     path.display()
                 ))
             })?;
-        dynamic_plugins.extend(resolve_dynamic_plugin_refs(
-            path,
-            &mut parsed,
-            &mut seen_plugin_ids,
-        )?);
+        let resolved_plugins =
+            resolve_dynamic_plugin_refs(path, &mut parsed, &mut seen_plugin_ids)?;
+        dynamic_plugins.extend(resolved_plugins.dynamic_plugins);
+        dynamic_plugin_policy.merge_from(resolved_plugins.dynamic_plugin_policy);
         runtime_documents.push((
             path.clone(),
-            serde_json::to_value(remove_dynamic_plugin_section(parsed))
+            serde_json::to_value(remove_dynamic_plugin_sections(parsed))
                 .expect("toml value serializes to JSON"),
         ));
     }
@@ -1109,11 +1117,15 @@ where
         Some((value, sources)) => Ok(Some(PluginTomlConfig {
             value: plugin_toml_runtime_value(value),
             dynamic_plugins,
+            dynamic_plugin_policy,
             sources,
         })),
-        None => Ok((!dynamic_plugins.is_empty()).then_some(PluginTomlConfig {
+        None => Ok((!dynamic_plugins.is_empty()
+            || dynamic_plugin_policy != DynamicPluginHostPolicy::default())
+        .then_some(PluginTomlConfig {
             value: None,
             dynamic_plugins,
+            dynamic_plugin_policy,
             sources: Vec::new(),
         })),
     }
@@ -1140,21 +1152,33 @@ fn apply_plugin_toml_config(
         resolved.gateway.plugin_config = Some(value);
     }
     resolved.dynamic_plugins = plugin_toml.dynamic_plugins;
+    resolved.dynamic_plugin_policy = plugin_toml.dynamic_plugin_policy;
     Ok(())
 }
 
+struct ResolvedDynamicPluginRefs {
+    dynamic_plugins: Vec<ResolvedDynamicPluginConfig>,
+    dynamic_plugin_policy: DynamicPluginHostPolicy,
+}
+
 fn resolve_dynamic_plugin_refs(
     source: &Path,
     value: &mut toml::Value,
     seen_plugin_ids: &mut HashSet<String>,
-) -> Result<Vec<ResolvedDynamicPluginConfig>, CliError> {
+) -> Result<ResolvedDynamicPluginRefs, CliError> {
     let Some(root) = value.as_table_mut() else {
-        return Ok(Vec::new());
+        return Ok(ResolvedDynamicPluginRefs {
+            dynamic_plugins: Vec::new(),
+            dynamic_plugin_policy: DynamicPluginHostPolicy::default(),
+        });
     };
 
     let plugins_value = root.get("plugins").cloned();
     let Some(plugins_value) = plugins_value else {
-        return Ok(Vec::new());
+        return Ok(ResolvedDynamicPluginRefs {
+            dynamic_plugins: Vec::new(),
+            dynamic_plugin_policy: DynamicPluginHostPolicy::default(),
+        });
     };
 
     let plugins: PluginTomlPluginsSection = plugins_value.try_into().map_err(|error| {
@@ -1166,6 +1190,7 @@ fn resolve_dynamic_plugin_refs(
 
     if let Some(toml::Value::Table(plugins_table)) = root.get_mut("plugins") {
         plugins_table.remove("dynamic");
+        plugins_table.remove("policy");
         if plugins_table.is_empty() {
             root.remove("plugins");
         }
@@ -1191,7 +1216,10 @@ fn resolve_dynamic_plugin_refs(
             source: source.to_path_buf(),
         });
     }
-    Ok(resolved)
+    Ok(ResolvedDynamicPluginRefs {
+        dynamic_plugins: resolved,
+        dynamic_plugin_policy: plugins.policy.map(Into::into).unwrap_or_default(),
+    })
 }
 
 fn resolve_dynamic_manifest_path(source: &Path, manifest: &str) -> PathBuf {
@@ -1213,11 +1241,12 @@ fn plugin_toml_runtime_value(value: Value) -> Option<Value> {
     }
 }
 
-fn remove_dynamic_plugin_section(mut value: toml::Value) -> toml::Value {
+fn remove_dynamic_plugin_sections(mut value: toml::Value) -> toml::Value {
     if let Some(root) = value.as_table_mut()
         && let Some(toml::Value::Table(plugins)) = root.get_mut("plugins")
     {
         plugins.remove("dynamic");
+        plugins.remove("policy");
         if plugins.is_empty() {
             root.remove("plugins");
         }

crates/cli/src/error.rs

@@ -18,6 +18,14 @@ pub(crate) enum PluginLifecycleFailureKind {
     Refused,
 }
 
+pub(crate) type PluginLifecycleErrorContext<'a> = (
+    &'static str,
+    Option<&'a str>,
+    PluginLifecycleFailureKind,
+    Option<&'static str>,
+    &'a str,
+);
+
 #[derive(Debug, thiserror::Error)]
 pub(crate) enum CliError {
     #[error("guardrail rejected: {0}")]
@@ -43,6 +51,7 @@ pub(crate) enum CliError {
         command: &'static str,
         target: Option<String>,
         kind: PluginLifecycleFailureKind,
+        code: Option<&'static str>,
         message: String,
     },
     #[error("NeMo Relay runtime error: {0}")]
@@ -60,16 +69,17 @@ impl CliError {
         }
     }
 
-    pub(crate) fn plugin_lifecycle(
+    pub(crate) fn as_plugin_lifecycle_error_context(
         &self,
-    ) -> Option<(&'static str, Option<&str>, PluginLifecycleFailureKind, &str)> {
+    ) -> Option<PluginLifecycleErrorContext<'_>> {
         match self {
             Self::PluginLifecycle {
                 command,
                 target,
                 kind,
+                code,
                 message,
-            } => Some((command, target.as_deref(), *kind, message.as_str())),
+            } => Some((command, target.as_deref(), *kind, *code, message.as_str())),
             _ => None,
         }
     }

crates/cli/src/plugins.rs

@@ -23,6 +23,7 @@ use crate::error::CliError;
 pub(crate) mod config_io;
 mod editor_model;
 pub(crate) mod lifecycle;
+pub(crate) mod policy;
 
 use self::config_io::*;
 use self::editor_model::*;