[P2] Finish deferred portable-client record corrections from #723 without reopening native-adapter scope

[ScriptedAlchemy]

Current scope and baseline

Follow-up to merged #721/#723/#727, checked against main b5cf7575e0bcfa6da23e12d2c5628146bdbe5cb1. This is a records/rendering/conformance correction, not another host-adapter project. #723's self-review explicitly deferred the items below; current source still contains them. Source/document review only; no native clients or local test suite were executed during this reconciliation.

Closed host-research issues are not proof of native adapters. The delivered feature describes how clients consume the existing portable artifact. Preserve that distinction and the per-surface limits. Amp's native implementation remains #711. Aider #713 and Jules #712 remain not planned and excluded.

Existing implementation to reuse

• Pinned portable client records
• Shared validation and projection
• Installation rendering
• packages/agent-bundle/tests/{portable-adapter,install-surface}.test.ts
• #723 deferred-review record

Corrections still required

1. Copilot CLI (#698): precedence and evidence scope

clients.copilot-cli.discovery.shadowedBy is empty. The official plugin reference orders .plugin/plugin.json before root plugin.json; the current VS Code record even notes this Copilot contrast. Record the appropriate affected surfaces and add a composite fixture rather than claiming both manifests are read independently.

The MCP support evidence attached to this record is a listed stdio server, not an executed remote/streamable-http server. Qualify the supported subset or add pinned evidence for the broader claim; do not promote static listing into successful launch or authenticated operation. Keep the recorded local-install deprecation and unverified placeholder launch visible.

2. CodeWhale (#709): remote policy restrictions

Its narrowed MCP reason currently describes only environment-value restrictions. The pinned upstream MCP guide also imposes endpoint-host, remote-header, secret-bearing URL and redirect restrictions at the plugin boundary.

Reflect the applicable network_hosts/endpoint agreement and other material limits in the record. If ordinary portable output lacks a required native declaration, say so; never invent a new portable schema field or silently relax the host's trust policy. A general transport capability is not proof that this particular plugin configuration is accepted.

3. VS Code (#706): registration is not copying installation

The record labels chat.pluginLocations as action role install, although both its own evidence and the official local-plugin documentation describe loading an existing directory in place. Use the already-supported register role so generated instructions distinguish it from a copied/install-managed source.

Cline (#705) must be checked in the same test but not changed mechanically: its recorded cp -R action creates a copy, so install remains appropriate unless the actual action changes. A role change must follow behavior, not consistency of wording.

4. Hermes (#697): Git repository source is not a marketplace source

The action is hermes plugins install <owner>/<repository> --no-enable, but install.source is marketplace. The official plugin guide distinguishes explicit repository/Git inputs from indexed names. Represent the actual source using the smallest compatible metadata change; preserve disabled-by-default installation and do not claim a local-directory command exists without proof.

5. Lock the records to concrete per-client output

Add per-client assertions for tier, affected paths, action role/source and degraded/unknown explanations. Cover empty, skills-only, MCP-only and combined inventories plus relevant composite shadows. Assert emitted INSTALL.md text and generated English/Chinese reference behavior, not merely JSON shape.

Already fixed — do not repeat

#727 removed nine duplicate authored client keys, restored Pi's live-probed skills-tier record, and added a duplicate-key regression. It also fixed Swival's registration/precedence and stopped claiming that its skills registration reads mcp.json. Preserve those tests. Qoder's install-versus-validation order and optional-inventory gating are also already implemented.

Acceptance / boundaries

• Each correction has a pinned source and a focused record/rendered-output test.
• Unknown, unsupported, partially supported, registered, installed and executed remain distinct.
• No broader transport or native-hook claim is inferred from a tier label or closed issue.
• Metadata-source changes pass the existing validator and both generated locales; no hand-editing generated pages.
• pnpm build, typecheck/lint, the affected unit tests and the docsite gate pass on the corrected head; report native runs separately if any occur.

No new adapter registry, universal discovery interpreter, host cache writer, account requirement, automatic enablement, broad AB4106 removal, or reimplementation of #651/#652.

[ScriptedAlchemy]

Landed in #732, squash-merged as 62e5c3a315 on main.

Correction matrix

#	Client	Change	State on main	Evidence
1	GitHub Copilot CLI (#698)	Precedence and evidence scope	supported (agent-plugins); mcp and placeholders partial	discovery.shadowedBy records .plugin/plugin.json → manifest and .mcp.json → mcp, quoting the file-locations table verbatim: the manifest order is .plugin/plugin.json, plugin.json, .github/plugin/plugin.json, .claude-plugin/plugin.json, and MCP configuration is published as .mcp.json, .github/mcp.json. The emitted root manifest still wins over .claude-plugin/plugin.json, asserted against a claude+portable composite fixture rather than claimed. mcp is now degraded: the 1.0.83 probe listed one stdio server, and no streamable-http server was registered, launched, or authenticated. The local-install deprecation warning and the unspawned-server placeholders row stay recorded.
2	CodeWhale (#709)	Remote policy restrictions	mcp partial; a remote server is not accepted without an authored declaration	The reason names the whole plugin boundary from docs/MCP.md#plugin-contributed-mcp and the same commit's docs/PLUGIN_BUNDLES.md: HTTPS-or-loopback endpoints with no user information, query, or fragment; literal headers rejected in favor of env_headers/bearer_token_env_var; redirects held to the reviewed origin; capabilities.network_hosts matching the normalized endpoint host set exactly. That declaration rides in extensions["net.codewhale"], which ordinary portable output omits — only an authored portable.extensions writes it — and a remote server without it is a validation error ("an active bundle must be … free of validation errors"), so the record says the bundle stays inactive there rather than loading partially. No portable schema field was invented and no trust policy relaxed.
3	VS Code (#706)	Registration is not installation	registered, not installed	chat.pluginLocations carries the register role, per the local-plugin documentation ("register it with the chat.pluginLocations setting … false to keep it registered but disabled"). The generated INSTALL.md prints Register: for it, and the validator now refuses a register anchor against any non-local-directory source.
3b	Cline (#705)	Checked, deliberately unchanged	installed (a copy)	Its recorded action is cp -R skills/<skill> ~/.cline/skills/<skill>, a real copy, so install remains. It is asserted in the same test as VS Code, so the two roles cannot drift together.
4	Hermes (#697)	A Git repository is not a marketplace	installed from a Git repository, disabled	install.source is the new repository value: the plugin guide separates hermes plugins install <name> (index name, resolved to repo @ pinned ref) from hermes plugins install user/repo ("install from Git"; "Explicit owner/repo or Git-URL identifiers never touch the index"). --no-enable is preserved, so the install still leaves the plugin disabled, and no local-directory command is claimed.
5	Every recorded client	Locked to concrete output	—	packages/agent-bundle/tests/install-surface.test.ts asserts whole rendered lines per client across four inventories (no component, skills only, MCP only, skills and MCP) — tier sentence, paths this build wrote, action role, install source, Not loaded list, both hypothetical shadows — with each MCP narrowing asserted present only when the build wrote mcp.json, plus the composite-shadow case. packages/agent-bundle/tests/portable-adapter.test.ts holds every record above to its pinned source and covers the validator's new rules. The generated en/zh reference was verified through pnpm docs:site:build: new install-source column, the repository/register/install rows, both shadow cells, both intro rewrites.

Boundaries honored

• One metadata addition: the install-source enum genuinely lacked Git, so it gained repository and nothing else. No new adapter registry, discovery interpreter, host cache writer, account requirement, automatic enablement, or AB4106 change.
• Unknown, unsupported, partial, registered, installed and executed stay distinct; no tier label or closed issue is used as transport or hook evidence.
• feat(portable): record Swival, Junie, and Cascade as skill readers #727's fixes are intact: the duplicate-client-key regression test, Pi's live-probed skills record, Swival's registration and precedence rows, and Qoder's install-versus-validate order with inventory gating.
• Amp's native adapter remains Host support: Amp — native plugin factory, explicit skill registration, and skill-scoped MCP #711; Aider Host support: Aider — explicit read-only instruction loading and configuration-safe content installation #713 and Jules Host support: Jules — repository instruction projection and explicit cloud-environment compatibility #712 stay excluded.

Gate on the merged head

pnpm build, pnpm typecheck and pnpm lint pass; pnpm test:unit 4439 passed / 0 failed / 6 skipped; pnpm docs:site:build passes with language parity and 0 broken links across 28329 anchors. No native client was executed for this change — the corrections are document review over pinned sources.

Self-review: two reviewers (claude-fable-5-1-thinking-high and gpt-5.6-sol-max), two rounds each; nine findings fixed and one dismissed with both reviewers' agreement. Dispositions are in #732's description.