Marketplace buyer protection: pinned install + plugin runtime least privilege

[ReBoticsAI]

Goal

Protect buyers when a marketplace (or local) plugin is installed and runs on their Bridge/SaaS tenant. Companion to intake verification in GodMode-Marketplace#3 (GitHub Actions as verify VMs).

Marketplace CI smoke + optional Copilot review raise the floor but cannot guarantee benign runtime behavior (time bombs, env-gated exfil, abuse of allowed APIs against real tenant data).

Part of track-b / marketplace trust. Related: #112 (coding isolation), #172 (VM-grade coding jobs; different surface), #96 (kill switches).

Clarifications (product)

• Coding jail (SaaS coding isolation: tenant worktrees, sandboxed shell, optional build containers #112 Layers 1–4): per-tenant coding root + per-command bubblewrap on a shared Bridge host. Tenants do not share one bwrap; they share the machine/Bridge. Design: path to Cursor-Cloud-like VM-grade coding isolation #172 would mean disposable VMs/machines for untrusted coding/build jobs, not "give each tenant a jail" (they already have path+bwrap isolation).
• Installed plugin code today: loads into the Bridge Node process for that deployment. That is a different trust boundary than the coding terminal jail and different from "we smoke-tested once on GitHub."
• True plugin runtime sandbox: isolate plugin execution on the buyer hub (separate process/container/VM per plugin or per tenant plugin host). Strongest, most expensive. Not required to ship Marketplace#3.

Protection stack

1. Intake: Marketplace#3 (public repo, pin, Actions verify)
2. Pin at install: honor pluginRef / artifact digest (no floating main)
3. Least privilege at runtime: capability allowlists (network, tools, records), confirmations, CSP
4. Trust tiers + revoke (Core: Authority, audit, and kill switches #96)
5. Optional later: true plugin runtime sandbox

Acceptance (first slice: design + pin + threat note)

• Design note in SECURITY.md / MARKETPLACE.md: intake vs buyer runtime vs coding jail vs Design: path to Cursor-Cloud-like VM-grade coding isolation #172
• Install path pins pluginRef / digest for Official/Community plugin installs (fail closed on drift)
• Issue or checklist for capability allowlist follow-up (network deny-by-default for plugins)
• Explicit: extending CI smoke/Copilot is encouraged but not sufficient alone

Out of scope (this issue)

• Implementing Firecracker coding VMs (Design: path to Cursor-Cloud-like VM-grade coding isolation #172)
• Full plugin-per-container runtime (child issue if we go there)
• Windows/Sierra native verify

[ReBoticsAI]

Tracked under #180 with GodMode-Marketplace#3.