I3302 — An installed plugin or mod that differs from what the repository generated is a doctor finding

✕BLOCKED wave 2 · p3 · implementation profile · parallel safe

Part of a-provider-carries-the-contract-natively — Each agent client carries the contract through its own extension points, generated once and checked for drift.

Objective

Extend the existing installed-versus-source comparisons with each generated extension's digest, version and declared permissions, and report an unknown or drifted active extension in doctor and /ui.

Why

Mods run unsandboxed (dated vendor claim 2026-10-02), so provenance and trust are the value; federating discovery is preferred to owning a marketplace. current_state is corrected: installed mods and shims are already compared with their sources (lib/capture.sh mj_capture_mod_same, mj_capture_shim_body) and the hooks' wiring is reported (mj_lifecycle_state); this issue extends those checks. Proposed in ADR 0214 (A provider's native extension points carry the contract as generated projections; Majordomus neither embeds nor patches the worker's runtime) (proposed; it carries no authority until the owner accepts it). Sources: chatgpt-majordomus:c174#18.

Current state

Installed mods and shims are compared with their sources (lib/capture.sh mj_capture_mod_same, mj_capture_shim_body) and capture install rewrites a drifted copy; mj_lifecycle_state reports each provider's hook wiring; doctor fails a hand-edited projection. Nothing records digests, versions or declared permissions, and an unknown active mod is not reported.

Desired state

doctor names each drifted or unknown extension with the remedy.

Scope

• apps/majordomus-cli/src/editors
• lib/doctor.sh
• lib/capture.sh
• apps/majordomus-cli/src/ui/skills.rs
• apps/majordomus-cli/src/capability/builtin/editors.rs
• apps/majordomus-cli/tests/skills.rs

Dependencies

• I3300✕BLOCKED Majordomus installs into Claude Code as one generated plugin carrying its skills, hooks, mods and MCP server

Acceptance criteria

• A modified installed mod is reported with both digests
• An unknown active mod is a finding, not an error
• The comparison extends mj_capture_mod_same, mj_capture_shim_body, mj_lifecycle_state and doctor's projection check with digests, versions and declared permissions; no second comparison is built
• The edit-guard shim and any unknown active mod are reported
• The provenance report is shown on /ui and proven by a case

Validation

• bin/majordomus doctor
• majordomus generate --check

Evidence required

• case_extension_drift_is_reported

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3302.yaml. Read it back with majordomus plan show I3302.