Public plugin API readiness

Decision: Deferred for general compiler hooks and isolated untrusted plugins. Trusted external lowerers are available.

Pulse 1.0.0-beta.9 supports versioned trusted package lowerers independently of npm package versions. Provider bootstrap is explicit and exact. The current boundaries are:

• Lowerers: trusted first-party and third-party build dependencies admitted by versioned contracts; import-resolved package ownership; no package allowlist or compiler-release version equality; no sandbox.
• Providers: explicit package selection through pulse.provider-toolchain.v1; bare host IDs use the @pulse-compute/provider- convention, scoped names are exact, and none is internal; no scanning or self-registration.

Readiness requirements

Requirement	Status
trustModel	Not implemented
packageDiscovery	Not implemented
versionNegotiation	Not implemented
securityPolicy	Not implemented
compatibilityContract	Not implemented
isolatedPackageLoading	Not implemented

The trusted package-lowerer contract and explicit provider toolchain are available scoped extension seams. This readiness record concerns general compiler hooks and isolated untrusted plugins; it does not gate trusted external lowerers.

The machine-readable readiness record and release validation enforce this boundary. See the trusted package-lowerer contract and provider toolchain. Lowerers run ordinary Node code without a sandbox; providers use explicit selection.

Machine-readable status is published as plugin-readiness.json.