feat: Build Task 3B native installed API composition #617

Task 3B

PlatformApplication native root, HTTP/operation/status/loader plugins, real database/identity/Admin readiness and API-owned runtime image/service plugin. Parent integration: treeseed-ai/platform#713. The maintainer approved API/Identity/Admin setup, authorized publication of their exact cordis baselines, and resumed Task 3B. All pluggable capabilities, including Dockerized services, must have typed owner contracts and actual Cordis plugin registrations; fixed ownership/integrity/admission invariants remain mandatory and cannot be disabled by providers.

Legacy capability mapping

legacy c8e18e2 src/api/support/server.ts and control-plane routes → same-owner native API hosting/plugins. Keep canonical repository boundaries and integrate exact public packages/artifacts only. Initialization issues api#616, identity#43, admin#134 remain open.

Acceptance criteria

• Fresh verified origin/cordis issue branch, owner docs/plugin map/protocol schemas committed before outside-in tests/implementation.
• Default native construction and actual built program tests; Dockerized services represented as plugins with declarations generated from the same class source.
• Required scope/engine/artifact/format/ownership/idempotency and stale-plan boundaries fail safely, with no secret output or general privileged hooks.
• Required owned capability behavior implemented without cross-checkout source imports or competing lifecycle authority.
• Owner strict checks/build/nonempty suites/actual programs and exact-artifact assembled installed_composition_has_real_contexts pass, with actual identity/database/edge/server/browser readiness and durable worker survival.
• Exact candidate source/artifact/CI evidence recorded, bounded PRs target cordis and hand back for review; issues stay open until release.

No Task 3C acquisition/installer, Agent/Task 3D implementation, legacy staging/main/services change, production publication or global Docker/DNS/trust-store mutation. Only isolated fixture-owned resources may be activated for qualification. Keep all issues, including platform#678, open. Split >10-file or >15-minute CI changes into independently reviewable PRs.

Reviewed candidate evidence

Source 0d80374; owner strict check/build and 6 unit/integration/built-program smoke tests passed this review. Current exact-head CI and required admission checks passed. Real installed verification passed 293 assertions with actual PostgreSQL/Keycloak/API/Caddy, configured OIDC and verified HTTPS browser status, scoped denial, worker survival, private journal and cleanup. Historical assembled/skill checks: 15 passed.

Candidate: #619 (container #618 already integrated at dd992c1; server #619 reviewed after the typed HTTP 404 regression fix).

Exact artifact/source record: https://github.com/treeseed-ai/platform/blob/19fa101e01651f32eb4d8b3e9f083c21d5741e06/composition/task3b.json. Final Platform integration follows owner merges. Review repairs documentation links that referenced branches scheduled for cleanup.

#621 restored exact pre-existing policy blob b1a687db754ee2fac141919e6c63052d12bf2812. Both runtime PRs now pass real base-owned authorization, metadata and verify checks. The historical admission deficit is resolved without adding approved identities. #620 remains open for release and its separate proposed initializer prevention work.\n\nMaintainer authorized review/fixes/cordis merges and task-branch cleanup. Integration is not release: keep this issue and every other issue, including platform#678, open. Task 3C/3D, legacy branches/services and production channels remain outside scope.