Check a plugin before you trust it

tovio plugin validate <path>tovio plugin verify <id>

validate checks that a manifest is well-formed, over a path, without installing anything and without writing anything. verify checks an installed plugin's artifact hash, publisher signature, publisher trust, and revocation state.

Publisher trust

tovio plugin trust listtovio plugin trust add <did:key:...> --label <name>tovio plugin trust revoke <did:key:...> --reason <why>

Trust is per publisher identity, not per artifact — you decide once whose plugins you will run. An identity is an Ed25519 key in did:key:<64 hex digits> form; the package carries a detached ed25519: signature over the canonical manifest plus the artifact hash, so changing the manifest, the identity, or the artifact invalidates it.

Four properties of the trust store are worth knowing, because they are what make it useful rather than decorative:

• It is independent of package content — a package cannot vouch for itself.
• Revocation is enforced at installation and before every execution, not only at install time.
• Revocation is permanent, and there is no un-revoke. trust add on an identity you previously revoked is refused outright rather than silently re-trusting it — the recovery is a new signing identity, not a second trust add. Revoke deliberately.
• A malformed trust store fails closed. It does not degrade to trust-everything.

Local and development packages are not verified

A hash-only local package, and an explicit integrity = "local_dev" package, install and run only under a visibly reported local development policy. verify reports them as such. They are never described as publisher-verified, and they are refused outright by a remote install and by a hosted Forge registration.

What to check before enforcing mode

1. Signature verifies, and the publisher is one you trust for a reason you could explain to someone else.
2. The capabilities it requests. A formatter asking for network access deserves a question.
3. Whether it asks for protected plaintext. Most plugins have no business reading your secrets, and the sandbox will not hand it over on a flag anyway.
4. Test it in advisory mode first, on real changes, for long enough to see it behave.

Failures are fail-closed

TVO-PLUGIN-003 covers integrity, signature, untrusted publisher, and revoked publisher together — the package did not establish the trust state it needs. TVO-PLUGIN-005 is a capability denied by the manifest-and-binding intersection. Neither can be overridden, deliberately.

Hosted registration is stricter

A hosted deployment refuses unverifiable or local_dev integrity, hash mismatches, over-cap artifacts, non-WASM files, and org-policy denials at upload — TVO-PLUGIN-016. A package that is fine to run on your laptop is not automatically fine to run as a server-side gate authority.