Allow coding agents to author safe tool-source proposals

[pengfei-threemoonslab]

Summary

This is the narrow contract-v18 UX repair that separates proposal authorship from approval for missing Shipgate coverage.

• Let a coding agent author one exact manifest shape: append-only additions of valid built-in tool_sources rows.
• Keep path-only plans and every broader manifest change fail-closed.
• Route the authored proposal to deterministic verification; the concrete shipgate.yaml trust-root diff still requires human review.
• Stop classifying conventional test/golden fixtures as undeclared deployed capability surfaces unless shipgate.yaml explicitly declares them.
• Preserve contract v18 and all existing schemas; there is no v19 or new surface.

Security boundary

The proposal-safe classifier requires both manifest sides to resolve and validate, all non-tool_sources values and existing rows to remain identical, and the diff to be insertion-only. The exemption is available only when exactly one diff record targets shipgate.yaml; duplicate records remain path-wide unclassified and human-routed regardless of ordering. Added rows are limited to built-in adapters and id/type/path/mode; trust, optional, custom adapters, comments, blank additions, removals/reordering, mixed edits, nonexistent/out-of-tree/root paths, and symlinked artifacts remain human-routed.

For Codex plugin packages, the package directory and .codex-plugin/plugin.json must exist without symlink traversal. A safe classification authorizes authorship only—it supplies no effect, authority, binding, policy, approval, merge, or execution claim.

The fixture exclusion only affects undeclared-surface inference. An explicitly declared test/fixture path still routes through verify.

Validation

• python -m ruff check .
• python scripts/generate_schemas.py --check
• Full non-performance suite passed in parallel (packaging split out because build isolation needs network access).
• python -m pytest tests/test_packaging.py -q: 8 passed.
• Focused proposal-classifier coverage: 86.47%.
• Composite shipgate.yaml regressions pass in both safe-first and unsafe-first orderings.
• A production MCP surface under services/fixtures/ remains undeclared-surface detectable; conventional test/golden and explicitly declared fixture cases remain covered.
• Committed verify against origin/main: base/head succeeded, control.state=complete, release_decision=passed, merge_verdict=mergeable.

After this merges, the release-candidate branch can use the new mode to propose the missing Codex plugin package declaration, obtain normal human review over the concrete diff, and resume the v0.16.0 ceremony.