flows: plugin registry / flows add — SURFACE §3 (tracked; awaits slice B)

[kjgbot]

Tracks SURFACE §3 (Plugins: the kernel is closed, the surface is open).

Scope (later)

• flows add helper-<name> installs npm @flows/helper-<name> and merges its verbs into Ctx
• Plugin contract: helper namespaces + trigger sources + gate predicates
• Every plugin verb compiles to a kernel primitive (run/llm/agent/effect/wait) — the 7-word kernel vocabulary stays closed
• Preflight declaration is required for every plugin (credentials, server reachability, scope grantability)
• Plugin registry + npm scope + versioning
• Receipts, budget attribution, identity scoping apply to plugin verbs by construction (via compile target)

Dependency

This issue is not dispatched yet because it depends on slice B (#299 — f.slack helper namespace) landing to fix the helper-namespace contract shape. Once #299 merges, this can be dispatched: the plugin contract is "how do first-party helpers work, but named and packaged externally."

Spec quote

The herdr model: first-party helpers are just plugins that ship in the box; the community brings the rest.

• A plugin contributes helper namespaces (verbs), trigger sources (on(x.y(...))), and gate predicates. Install: flows add helper-datadog (registry + npm @flows/helper-*).
• The plugin contract: every plugin verb must compile to kernel primitives (a run, an llm, an agent, an effect write, a wait). Plugins extend the surface, never the kernel — the seven-word kernel vocabulary is closed, which is what keeps specs portable, journals replayable, and gate 9's self-authoring safe.
• Preflight is part of the contract: a plugin declares what must be provable before a run using it starts (credentials present, server reachable, scope grantable). A plugin that can't state its preflight doesn't load. Covenant 2 extends to the ecosystem by construction.
• Receipts, budget attribution, and identity scoping apply to plugin verbs exactly as to first-party ones — they come from the compile target, so a plugin can't opt out.

Acceptance evidence (later)

• flows add helper-datadog produces a working helper install
• A plugin's verbs appear as f.datadog.* in TS + datadog: YAML
• Refusal on plugin lacking preflight declaration
• Version pin + lockfile treats plugins as first-party