magma-plugin 0.1.23

magma-plugin — HashiCorp go-plugin handshake + mTLS bootstrap + gRPC client lifecycle + subprocess management for Terraform / OpenTofu providers.

Load-bearing layer per theory/MAGMA.md §IV. Spawn a provider binary, complete the go-plugin handshake (magic cookie validation, stdout-handshake-line parse, mTLS cert exchange), and return a typed Plugin handle ready for gRPC calls.

Handshake protocol:

1. Parent generates a self-signed cert + key via rcgen; DER-encodes the cert; base64-encodes it; sets the env:
   • PLUGIN_MIN_PORT, PLUGIN_MAX_PORT (port range)
   • <MAGIC_COOKIE_KEY> = cookie value
   • PLUGIN_PROTOCOL_VERSIONS=5,6
   • PLUGIN_CLIENT_CERT=<base64 PEM>
2. Parent spawns provider as subprocess.
3. Provider validates magic cookie; exits 1 if mismatch.
4. Provider generates its own self-signed leaf cert, binds to a port in the allowed range, prints one handshake line: CORE_PROTOCOL|APP_PROTOCOL|NETWORK|ADDRESS|PROTO_TYPE|CERT.
5. Parent parses the line, builds a tonic gRPC Channel to the address. Production builds layer mTLS via tokio-rustls using parent_cert (own identity) + provider_cert (trusted root); M0 ships the plain TCP dial — the cert exchange happens but encryption layering ships in M0.x once tonic's TLS config is pinned to a known-good rustls version pair.
6. Subsequent calls go over the gRPC channel.
7. Parent sends SIGTERM (then SIGKILL after grace period) on Drop.