RuntimeConfigPlugin reports features.marketplace: true unconditionally — the Console is told browse is live whether or not the proxy mounted

[os-zhuang]

Found while fixing #8343. Filed rather than fixed: that card's file surface was the CLI wiring block plus tests, and this is a packages/cloud-connection behaviour change with its own blast radius.

packages/cloud-connection/src/runtime-config-plugin.ts builds its response with marketplace hardcoded:

features: {
    installLocal: this.installLocal,
    marketplace: true,
    // aiStudio + autoPublishAiBuilds + any distribution keys.
    ...features,
},

installLocal is at least config-driven. marketplace is a literal, so /api/v1/runtime/config tells the Console the catalog is browsable on every runtime that mounts this plugin — including one where MarketplaceProxyPlugin was never mounted because no control-plane URL resolved. That is the same declared-is-not-enforced shape as #8343's second symptom, one key over: an affordance the SPA renders and the runtime cannot serve.

This is a live constraint, not a hypothetical. It is the reason #8343's fix mounts install-local alone on a cloud-less runtime and deliberately does not also mount RuntimeConfigPlugin there: doing so would have restored the Console's knowledge of install-local at the cost of asserting a browse capability that is definitively absent — trading the reported bug for its mirror image. So a cloud-less framework runtime currently has a working install-local route that the Console cannot discover.

Why it should be the plugin's own answer, not the host's

Adding a marketplace?: boolean config knob would work but repeats the mistake one layer up: every host must then remember to keep the flag in step with its own mounting, which is precisely what the objectos-ee config and the package README both failed to do. Preferable is for the flag to be derived from what is actually mounted — the proxy registers a service or is discoverable on the kernel at kernel:ready, and the runtime-config handler reports presence rather than a constant. The handler already runs per request and already reads the kernel (env-registry), so the seam exists.

That is a design call rather than an obvious edit, which is why this is filed for triage rather than folded into #8343.

Acceptance

• features.marketplace reflects whether a marketplace browse surface is actually mounted on the kernel serving the response.
• A cloud-less runtime can report installLocal: true truthfully without also claiming browse.
• Coverage pinning both directions (mounted proxy reports true; no proxy reports false).

Backlink: #8343. Related: #8355.

---

Generated by Claude Code

[hotlong]

Triage: lands in packages/cloud-connection/src/runtime-config-plugin.ts → domain:cli (cloud-connection family). → pm:queue, type Bug — declared ≠ enforced: features.marketplace is a literal true regardless of whether a browse surface is mounted.

Not escalated as a decision card: the direction is already settled on the record — the #8343 ACCEPT ruling (2026-08-13 08:30Z) adopted option A "fix the flag at its source under #8356, deriving features.marketplace from what is actually mounted", explicitly judged not-maintainer-floor (widens no contract, restores declared = enforced). The card's own acceptance list is the spec: mounted proxy reports true, no proxy reports false, install-local reportable without claiming browse — with pins in both directions.

Note for the lane seat: prefer presence-derivation over a config knob, per the card's argument and the adopted ruling; a knob repeats the every-host-must-remember failure that produced the P1.

Size/model suggestion: M, mode:subagent, model: opus.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 1 (domain:cli seat #6024)
Session: session_01P7vaLs7bhBPi9m3JyzkhDj
Branch: claude/issue-8356-marketplace-feature-derived
Worktree: objectstack-issue-8356
Domain: domain:cli
File surface: packages/cloud-connection/src/runtime-config-plugin.ts + tests in the same package. ⛔ NOT packages/cloud-connection/README.md — that is #8355, held behind this card and re-priced on your result. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Serial constraints cleared: same-package #8355 (README) is held, not in flight — deliberately sequenced behind this card because its corrected example's content depends on what you land here. No other in-flight claim touches packages/cloud-connection; open PRs #8377 / #8369 / #8342 / #8365 / #8363 / #8325 / #8302 / #7996 checked, none touches this package.

Premise re-verified on origin/main before dispatch — runtime-config-plugin.ts:289 is marketplace: true, a literal, exactly as the card states.

Direction is settled, not open. The #8343 ACCEPT ruling (2026-08-13 08:30Z) adopted option A: fix the flag at its source here, deriving features.marketplace from what is actually mounted. Judged not-maintainer-floor — it widens no contract and restores declared = enforced. ⛔ Do not add a marketplace?: boolean config knob: that repeats one layer up the every-host-must-remember failure that propagated the original P1 into the EE image.

Acceptance is the card's own list: mounted proxy reports true; no proxy reports false; a cloud-less runtime can report installLocal: true truthfully without also claiming browse; both directions pinned.

⚠️ Verify the seam, do not inherit it. The card proposes the proxy "registers a service or is discoverable on the kernel at kernel:ready", and notes the handler already reads the kernel via env-registry. That is the filer's reading, not a measurement — go look at how MarketplaceProxyPlugin actually announces itself and derive from whatever is really observable at response time. If no honest presence signal exists, say so and report the fork rather than manufacturing one; inventing a registration just to read it back is a mechanism, not a fix.

---

Generated by Claude Code