Skip to main content

ADR-0158: SLSA provenance, G6/G9 gates, pack contents, kill switch and offline import of the marketplace

Context​

The architecture reference asks of the marketplace (B7.4, B8.1, B8.3, B8.4, B8.5, B10.3, G6, G9, G11): a verifiable provenance of every version, privacy and resilience gates, the package identity (namespace, category, publisher, display name), the installation of every pack content (rules, OpenFGA models, MCP servers, workflows, RAG templates, dashboards, alerts, migrations), a real MCP connection test, a validated configuration, an immediate suspension of a pack or of one of its capabilities, the supervision of an installation and a local repository for air-gapped sites.

Before this decision, publication checked ten gates (schema, signature, SBOM, vulnerabilities, tests, evaluations, licence, permissions, docs, secrets); rules, OpenFGA models, workflows, RAG templates, dashboards, alerts and MCP servers stayed in the archive without a registry; no route suspended an installed pack.

Decision​

  1. Provenance: the publication body carries provenance: {statement, signature}, an in-toto Statement v1 with the SLSA provenance v1 predicate whose subject is the archive digest and whose byproducts bind the SBOM and the reports. enterprise-ai plugin publish --key produces it and signs it with the publisher key; the provenance gate checks the digest, the subject, the SBOM and the signature again with the registered publisher key. eai.marketplace_versions.provenance and provenance_status (V190) keep it.
  2. Six more gates: provenance, privacy (G6: PII detection and masking, DLP, residency, externalExportDefault: deny), security (signed artifact, sandbox, dynamic authorization, audit), approvals (requiredFor covers install, upgrade, sensitivePermissions, production, resume), configuration (configSchema JSON Schema), resilience (G9: bounded timeout, idempotent side effects with a key, workflows that stop or compensate). The plugin-manifest schema gains namespace, category, publisher, displayName, security, testFlags, configSchema and approvals.requiredFor, copied byte for byte into the four SDKs.
  3. Contents without a registry of their own: eai.marketplace_assets (V191, forced RLS) keeps per installation every rule, OpenFGA model, MCP server, workflow, RAG template, dashboard, alert and migration with its digest and state (active, blocked, pending_endpoint, suspended). An MCP server whose address is given in the configuration is registered in the MCP gateway (eai.mcp_servers) and tested by a real initialize then the tools listing; a RAG template creates its knowledge base.
  4. The configuration of an installation is validated against the pack configSchema (config_invalid).
  5. Kill switch: POST /v1/marketplace/installations/{id}/status suspends at once an installation or some of its permissions (tools blocked, agents suspended, MCP servers disabled, contents suspended); POST /v1/marketplace/packages/{name}/status suspends every installation of a package at once and refuses installs, upgrades, publications and promotions. Resuming always needs an approval of two other people.
  6. GET /v1/marketplace/installations/{id}/supervision aggregates activity, quality, costs and incidents from the platform records.
  7. Offline import: the --body-out body, the artifact and its cosign signature travel in an OCI layout (oras), are pushed into the local registry then imported (client.marketplace.import_publication). Every gate is checked again offline.

The cores stay under MIT or Apache-2.0; in-toto, SLSA, cosign, oras and zot are open source projects under Apache-2.0.

Consequences​

  • A pack without a signed provenance, without configSchema or that turns a security requirement off can no longer be published.
  • The existing packs (packs/hr, packs/finance, packs/templates/*) carry the new fields.
  • Migrations V190 and V191 extend the marketplace tables (V130) without recreating them.

Evidence​

services/control-plane/tests/test_marketplace_governance.py (pure gates, recorded and forged provenance, installed contents, refused configuration, real MCP connection, suspension and four eyes resume, package kill switch, isolation, supervision, import through an OCI layout into a second zot registry), services/control-plane/tests/test_marketplace.py, sdks/python/tests/test_governance_clients.py, sdks/go/endpoints_v13_test.go.