Independent source delivery for NocoBase 2.4.0-alpha.9, inside the authorized WorkDSH checkout. Upstream NocoBase is not modified. This is an internal P1 draft archive plugin; P2 approval/business save is not implemented or enabled.

The standard Plugin owns projects/membership, immutable input revisions, controlled runs, staged text uploads, draft artifacts, receipts and minimal audit records. NocoBase users and OAuth are reused. Administrator configuration supplies the fixed issuer, /afos resource audience, same-origin JWKS URL, allowed client IDs, releaseId and policyRevision. Provisioning afosClientAccess requires active principal/client access, a logical deviceId and notBefore in epoch milliseconds. This is a server-managed binding, not hardware attestation. Nothing auto-grants access. No credentials are included.

Gateway: POST <issuer-path>/afos with { "contractVersion": "afos.bridge.v1", "action": "materials.listAllowed", "params": { "projectId": "..." } }. GET requires X-AFOS-Contract: afos.bridge.v1 and lists authorized projects. Only the ten fixed actions in core.ts are accepted; unknown/nested extra fields, generic CRUD/MCP, caller-selected identity/roles/endpoints/paths and non-gateway calls with an AFOS token are rejected. Pagination cursors are authenticated and bound to actor/organization/query; they expire after ten minutes and server restart invalidates them. Repository queries are bounded before ACL filtering (51 membership/material rows); current permissions are rechecked on every page. Empty filtered pages can advance a cursor.

Every operation verifies an RS256 at+jwt access token, current user/client/Grant, explicit client access policy, project membership and native record/field ACL. The original bearer is verified before internal-token conversion. The minimal patches/nocobase-idp-grant-binding.patch adds the signed grant_id used for current Grant checks; it has only passed git apply --check against source HEAD 68fa52702d804df8ea720ab46fc7cd2369aa9072. It is not applied or deployed. Existing unpatched tokens are rejected. Client registration must use public/native metadata, PKCE, auth method none and loopback /oauth/callback; actual IdP integration remains NOT_RUN.

P1 supports UTF-8 text snapshots/drafts up to 1 MiB, 32 fixed source references and a single immutable artifact per authorized run. Drafts are explicitly draft-needs-review. Source hashes and uploaded bytes are verified; artifact and receipt are created in a SERIALIZABLE local database transaction. A repeated identical commit returns the existing receipt; changed data conflicts. On an unknown response, query runs.getReceipt({runId, projectId}) before deciding whether to retry. Its wrapper returns server-owned original authorization pins, including after expiry; this does not grant execution or write capability. Never interpret model text as an archive receipt.

runs.authorizeLocal accepts projectId/releaseId/inputRefs/clientRequestId. The public response matches the supplied contracts/run-authorization.schema.json, including issuer/subject/organization/device, policy revision, action ceiling and ISO times; internal row digests are omitted. stageUpload accepts runId/attempt/mime/bytes/sha256; artifacts.upload accepts the issued uploadId and bounded UTF-8 content as the stage's fixed transport. commitDraft accepts runId/attempt/uploadId/inputRefs/clientRequestId. The public receipt contains receiptId/runId/attempt/artifactId/revisionId/sha256/committedAt. Private state and artifacts have no generic API access; material/artifact/receipt revisions reject individual and bulk updates/deletes. These hooks do not constrain trusted raw SQL or database administrators.

Run corepack pnpm install --frozen-lockfile --ignore-scripts, corepack pnpm test, corepack pnpm typecheck:core and corepack pnpm build in this independent workspace. Tests use generated in-memory RSA keys and injected repositories/ACL; they are local contract checks, not deployment or desktop acceptance. Exact published NocoBase peers have gitHead values different from the reference source despite matching version strings; source compatibility needs a real integration run. The dependency tree has upstream peer warnings recorded in the development evidence.

This unreleased alpha contract adds identity.current({projectId}) and runs.getAuthorization({runId}). Identity snapshots are derived from current server records and expire within five seconds. Recovery revalidates immutable release, policy, input and device pins. Older receipt callers omitting projectId are explicitly rejected; client and server must be upgraded together.

Administrator provisioning, actual IdP/ACL/repository hooks, database isolation across processes, retention cleanup, business UI mapping, Desktop Broker/identity/profile wiring, fixed model gateway and real execution require integration verification before activation. No client execution report or cost data is implemented; server receipt status never asserts that a local process completed. P1/G3 has not passed. Archived business data is never deleted on rollback. No server, production database or OAuth registration is changed by building this deliverable.

Optional model configuration is disabled unless enabled: true is explicitly supplied by the trusted server owner. The fixed afos.model.v1 stream on the same gateway uses the original owned Run and the official DSH Adapter. Its provider/model/HTTPS endpoint and secret resolver are server configuration, not wire fields. Current token/Grant/client/device/project/source/release/policy and uncached native users.roles association are rechecked at admission, each chunk and a one-second idle poll. Initial selected roles cannot expand during a stream; unverified department attachRoles are denied. Disconnect listeners start before asynchronous admission and plugin disable aborts all streams.

Private afosModelBudgets and afosModelCalls repositories reserve and settle in SERIALIZABLE transactions with row locks. Only canonical accounting fields are stored, never prompts or vendor keys. Unknown usage retains the reservation; known provider usage records the actual counter even if higher than reserved. Fixed contextWindow must be verified against the real provider as a reservation bound. This source does not establish a strict monetary cap, real vendor billing, or isolation in an unknown deployed SQL dialect. An additional isolated check uses exact official NocoBase packages and real SQLite repositories/native transactions; it includes independent connections and two-process contention, rollback, unique constraints, immutable hooks and current role/member revocation. Identity/ACL service admission remains a fixture. SQLite SERIALIZABLE uses BEGIN DEFERRED and one competing write fails with SQLITE_BUSY; it does not establish PostgreSQL or MySQL row-lock behavior. No production database is opened.

From the authorized repository root run node enterprise/plugin-agent-bridge/scripts/run-sql-integration.mjs. It copies source into a fresh temporary staging area, uses its own caches/store, adds only [email protected] in that staging manifest and runs six recorded install/build/test stages. The 13 AFOS-SQL checks support AT-18/20/22/33/38/39/47 without promoting formal acceptance. The owning product manifest and lock remain unchanged. Logs, staging locks and source hashes are retained for review. Rollback removes the four optional test files; no business data is deleted.

The optional src/server/__tests__/main-ipc-flow.integration.mjs suite exercises the original published Core/Loader/Agent/Session through two real Node processes and Main-owned private IPC. Its 66-second stream renews one committed publication for one Run and one Agent under fresh authority and the absolute server Run expiry. Release and stale-renewal races are covered in the provider's real fork suite. Identity, ACL repositories and model replies are controlled fixtures; these checks do not certify native Client/Conversation, target desktop, real enterprise credentials or a paid model. This publication-lifetime scope leaves the original acceptance ledger at 2 PASS / 12 BLOCKED / 46 NOT_RUN and G3 unpassed. Rollback omits or reverses only the optional source patch and preserves Sessions, Recovery drafts, credentials and server receipts.