I3305 — A scripted capability installed from outside the repository registers like one inside it

✕BLOCKED wave 3 · p3 · implementation profile · parallel safe

Part of repository-automation-is-typed — Repository automation is typed capabilities that Rhai orchestrates, and domain-logic shell only shrinks.

Objective

Discover scripted-capability packages from a declared install location outside the tree and hand them to the registration I3157 proves, so they reach CLI, MCP and HTTP with their origin and no second registration.

Why

The owner's audit (10-13) put an external plugin vertical first; the scripted-capability kind (I1801) is the mechanism, so a plugin is a scripted capability from elsewhere, not a new plugin system. Critique 2026-10-18: this issue duplicates I3157 except for discovery from an install location outside the tree. It moves to milestone repository-automation-is-typed and serves repository-automation-is-typed#scripted-capability-runs, reduced to that remainder. It extends milestone automation. Sources: chatgpt-majordomus:c244#8, chatgpt-majordomus:c035#7, chatgpt-majordomus:c031#12, chatgpt-majordomus:c031#24.

Current state

automation milestone: I1800 sandboxed engine, I1801 scripted capability kind; I3157 proves an adopter-declared capability in the layer reaches its surfaces; nothing loads from outside the tree.

Desired state

A fixture package outside the repository shows in capabilities.list with its origin.

Scope

• share/kinds.yaml
• apps/majordomus-cli/src/capability/registry.rs
• apps/majordomus-cli/src/capability/model.rs
• apps/majordomus-cli/src/capability/module.rs
• apps/majordomus-cli/src/capability/builtin/capabilities.rs
• apps/majordomus-cli/src/script/mod.rs
• share/schemas/majordomus/manifest/manifest.v1.schema.json
• apps/majordomus-cli/tests/external_extension.rs

Out of scope

• Registration on CLI, MCP and OpenAPI with origin and the over-ceiling refusal, which I3157 already proves
• Anything about a client carrying the contract (ADR 0214)

Dependencies

• I1801○READY A scripted capability is a kind, discovered and registered, runnable and projected like any capability
• I3157✕BLOCKED A scripted capability declared in an adopting repository's layer reaches its surfaces with no change to the tool, and says where it came from and what it may do

What waits on this

• I3306✕BLOCKED An external scripted capability runs under default-deny grants, bounded, and leaves an audit record

Acceptance criteria

• A package from a temp directory registers a capability visible on CLI and MCP
• An invalid manifest is refused and named

Validation

• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test external_extension
• majordomus generate --check

Evidence required

• case_an_external_scripted_capability_registers

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3305.yaml. Read it back with majordomus plan show I3305.