[intel352]

Summary

• Adds strict proto admin config contracts for workflow-plugin-auth: step.auth_admin_config_describe and step.auth_admin_config_validate.
• Exposes grouped admin controls mapped to real auth plugin config keys, with write-only secret metadata and no secret echo.
• Validates unsafe patches: production password enablement, zero-primary configs, incomplete passkey/OAuth settings.
• Bumps plugin manifest/downloads to 0.2.9; release tag v0.2.9 is already published and workflow-registry sync was triggered.

Design

See: docs/plans/2026-05-27-auth-admin-contracts-design.md

Implementation Plan

See: docs/plans/2026-05-27-auth-admin-contracts.md

Scope Manifest

• PR Count: 2
• Tasks: 7
• Status: Locked 2026-05-27T06:23:26Z
• This PR row: 1 | Auth plugin admin contracts | Task 1, Task 2, Task 3, Task 7 | feat/auth-admin-contracts

Verification

• GOWORK=off go test ./... -> pass
• wfctl plugin validate-contract --for-publish --tag v0.2.9 . -> PASS
• PLUGIN_MANIFEST_EXPECT_VERSION=0.2.9 GOWORK=off go test ./internal -run TestIntegration_PluginManifestAndStepTypes -count=1 -> pass
• GitHub Actions Release run 26495297114 -> success; GoReleaser, runtime capability verification, GitHub release publish, and workflow-registry notification all green.

Notes

• The plugin validates and returns sanitized accepted config patches. Host/admin config persistence remains owned by the Workflow host/admin surface, not this plugin.