Build a bounded KFIF integration.

Synchronized public edition. Canonical source: KFIF Enterprise backend documentation.

python -m kshield.plugin_contract.cli create-plugin \
  --plugin-id com.example.kfif.status-connector \
  --name "Status Connector" \
  --publisher-id com.example \
  --publisher-name "Example Publisher" \
  --destination status-connector

The command creates a valid development manifest, source skeleton, tests and local validator. It does not create keys, issue licenses or authorizations, package, install, enable or access production.

Read one bounded UTF-8 JSON request from stdin and write one canonical JSON response to stdout. Preserve protocol and request_id; return stable error codes.

{
  "protocol": "kfif-plugin-ipc/1.0",
  "request_id": "request-1",
  "status": "ok",
  "output": {},
  "error": {}
}

• do not discover host files
• do not import KFIF internals
• do not open network connections
• do not spawn processes or invoke a shell
• do not request root or enforcement access
• do not publish directly to host output paths

• manifest identity, SemVer and bounded compatibility
• permission and capability denial
• canonical IPC and stable errors
• timeout and output limits
• unsafe archive rejection
• digest and publisher trust
• license, entitlement and authorization gates
• disabled execution and rollback
• semantic parity with any legacy integration

Create canonical payload hashes, obtain an approved publisher signature outside the source tree, produce deterministic ZIP or TAR.GZ bytes and record the complete-archive SHA-256. Never reuse a version for different bytes.