Playbook plugin API

Generated typed BPDL contracts for the bmux.playbook execution service. This crate contains no executor, process ownership, terminal acquisition or runtime state implementation.

playbook-commands provides preparation, start, pause/resume, single-action stepping, stop and fresh restart. playbook-state provides retained status, revision-based snapshot polling and settlement inspection. Every operation after preparation identifies the attempt generation; stale generations are rejected.

Preparation explicitly selects source and allowed root, native executable and attempts root, and requires consent to executable deck input. request_id is a UUID for idempotent preparation and lookup-preparation reconciliation in the current owner lifetime; different fields under the same identity are rejected. expected_closure_sha256 must be the approved full-include-closure identity from bmux_playbook::parser::source_closure_sha256. The service verifies and freezes the exact same bounded bytes before admission; a changed include is rejected. An unknown lookup is not successful cleanup and must not cause automatic replay. Host enforcement of bmux.playbook.execute remains necessary: the consent field does not grant permissions. Read operations use bmux.playbook.read.

An attempt snapshot carries explicit isolated configuration/runtime/data/state paths and session identity for the normal BMUX committed-display attachment. Lifecycle responses and diagnostics are not a terminal display feed. Stop is a request, not successful cleanup; fresh restart requires acknowledged sandbox cleanup and worker settlement. Pause/step operates on complete actions, never pretends arbitrary executable side effects can be sought or rewound.

The service schema is bpdl/playbook-plugin.bpdl; use its generated clients rather than handwritten request/response transport wrappers. Execution ownership and worker protocol implementation belong to bmux_playbook_plugin.