Epic: Deploy plugin family

[rickylabs]

Umbrella for the deploy plugin family — NetScript's deploy story rebuilt as a plugin composed the way auth composes, under the goal frame "Deno native first, then Node compat where needed".

Canonical RFC: #891 (corpus r5 under .llm/runs/plan-deploy-plugin--seed/ — five hardening passes, formal PLAN-EVAL PASS on the open-model lane). Supersedes the unified-runtime seed #824; re-scopes the deploy half of #823; continues Deployment epic #327.

plugins/deploy                    @netscript/plugin-deploy        A5 thin plugin (depends on core only)
packages/plugin-deploy-core       @netscript/plugin-deploy-core   A2 core: eight-op port, capability +
                                                                  topology contracts + compiler, registry,
                                                                  conventions, two-phase config loader
packages/deploy-aspire            compose/docker/k8s/azure-* (+ future radius variant, predicate-gated)
packages/deploy-baremetal         windows|linux variants; build pipeline + legacy compat handlers
packages/deploy-deno              Deno Deploy flagship (declares no emit — platform builds from source)
packages/deploy-container         shared OCI path + fly/koyeb/sevalla/coolify/dokploy clients
packages/deploy-cloudflare|vercel|aws     probe-gated

Delivery: W1–W3 + host extensions → 0.0.1-beta.13 · W4 container path → 0.0.1-beta.15 · W5 probe-gated clouds → 0.0.1-beta.16 · deferred RFC → Backlog/Triage. Dependencies are encoded per child (Dependencies: by DPB-n id).

Epic acceptance

• gate: every child's acceptance gates are checked with linked evidence before it closes; no closing keyword ever targets this epic.
• gate: F-DEPLOY-1 and F-DEPLOY-2 are gated (not reviewed) and green from W1 on.
• gate: deno task e2e:cli (scaffold.runtime) is green at every wave exit; W1 sub-slices each keep it green.
• gate: the conformance matrix (target × variant × capability × verdict) runs in CI from W2 on; every lossless verdict carries live-platform evidence.
• gate: no deploy-* package imports another deploy-* package; core imports no leaf package (import-graph gates).
• gate: sentinel secret values never appear in plans, artifact manifests, Aspire state cache, argv, logs, telemetry, or errors (negative tests).
• gate: every documented legacy netscript deploy … invocation keeps its exact semantics through the compatibility window (golden tests).
• gate: all implementation PRs satisfy CI and the required opposite-family review before merge.

Children

W1 — core extraction (0.0.1-beta.13):

• [deploy-plugin DPB-1] Move deploy contracts to plugin-deploy-core behind compatibility re-exports #893 — [deploy-plugin DPB-1] Move deploy contracts to plugin-deploy-core behind compatibility re-exports
• [deploy-plugin DPB-2] Move pure deploy conventions with their constants to core #894 — [deploy-plugin DPB-2] Move pure deploy conventions with their constants to core
• [deploy-plugin DPB-3] Empty duplicate-rejecting core registry + CLI compatibility composition root #895 — [deploy-plugin DPB-3] Empty duplicate-rejecting core registry + CLI compatibility composition root
• [deploy-plugin DPB-4] Host-owned deploy shell split + router rewired over core contracts #896 — [deploy-plugin DPB-4] Host-owned deploy shell split + router rewired over core contracts
• [deploy-plugin DPB-5] Capability + topology contracts, rejection compiler, conformance harness #897 — [deploy-plugin DPB-5] Capability + topology contracts, rejection compiler, conformance harness
• [deploy-plugin DPB-6] Two-phase config loader + deploy schema re-home + frozen legacy union #898 — [deploy-plugin DPB-6] Two-phase config loader + deploy schema re-home + frozen legacy union

W2 — adapter extraction (0.0.1-beta.13):

• [deploy-plugin DPB-7] Extract deploy-baremetal (build pipeline, Servy/systemd, compat handlers) #899 — [deploy-plugin DPB-7] Extract deploy-baremetal (build pipeline, Servy/systemd, compat handlers)
• [deploy-plugin DPB-8] Extract deploy-aspire (target-by-op table, applier matrix, secret-safe state policy) #900 — [deploy-plugin DPB-8] Extract deploy-aspire (target-by-op table, applier matrix, secret-safe state policy)
• [deploy-plugin DPB-9] Extract deploy-deno (honest manifest; no emit by design) #901 — [deploy-plugin DPB-9] Extract deploy-deno (honest manifest; no emit by design)
• [deploy-plugin DPB-10] Adapter-side config member schemas over the schema registry #902 — [deploy-plugin DPB-10] Adapter-side config member schemas over the schema registry
• [deploy-plugin DPB-11] Legacy/config compatibility gate #903 — [deploy-plugin DPB-11] Legacy/config compatibility gate

Host extensions (0.0.1-beta.13):

• [deploy-plugin DPB-12] Host: CLI mount-children contribution contract #904 — [deploy-plugin DPB-12] Host: CLI mount-children contribution contract
• [deploy-plugin DPB-13] Host: async CLI bootstrap, loader isolation, plugin-absent UX #905 — [deploy-plugin DPB-13] Host: async CLI bootstrap, loader isolation, plugin-absent UX
• [deploy-plugin DPB-14] Host: doctor-checks as data + installer tooling variant + contributionAxes #906 — [deploy-plugin DPB-14] Host: doctor-checks as data + installer tooling variant + contributionAxes

W3 — pluginization (0.0.1-beta.13):

• [deploy-plugin DPB-15] plugins/deploy: manifest triad, descriptor composition root, verify-plugin #907 — [deploy-plugin DPB-15] plugins/deploy: manifest triad, descriptor composition root, verify-plugin
• [deploy-plugin DPB-16] Plugin CLI children: target add/remove, capabilities, cells apply, eight-op router #908 — [deploy-plugin DPB-16] Plugin CLI children: target add/remove, capabilities, cells apply, eight-op router
• [deploy-plugin DPB-17] Scaffolder: deploy/ leaf, Story-0 assets, conditional capability-check pipeline step #909 — [deploy-plugin DPB-17] Scaffolder: deploy/ leaf, Story-0 assets, conditional capability-check pipeline step
• [deploy-plugin DPB-18] Story-0 scaffold.runtime E2E (install, target add, plan) #910 — [deploy-plugin DPB-18] Story-0 scaffold.runtime E2E (install, target add, plan)
• [deploy-plugin DPB-19] deploy-events stream, telemetry, runtime-config topic #911 — [deploy-plugin DPB-19] deploy-events stream, telemetry, runtime-config topic

W4 — container path (0.0.1-beta.15):

• [deploy-plugin DPB-20] deploy-container: OCI build/push + ContainerBuildPort + Dockerfile emission #912 — [deploy-plugin DPB-20] deploy-container: OCI build/push + ContainerBuildPort + Dockerfile emission
• [deploy-plugin DPB-21] Thin platform clients: fly, koyeb, sevalla, coolify, dokploy + live smokes #913 — [deploy-plugin DPB-21] Thin platform clients: fly, koyeb, sevalla, coolify, dokploy + live smokes
• [deploy-plugin DPB-22] Container scaffold story (Story 3) + artifact goldens #914 — [deploy-plugin DPB-22] Container scaffold story (Story 3) + artifact goldens

W5 — probe-gated clouds (0.0.1-beta.16):

• [deploy-plugin DPB-23] CF-PROBE: live Workers conformance, Miniflare fidelity, token story #915 — [deploy-plugin DPB-23] CF-PROBE: live Workers conformance, Miniflare fidelity, token story
• [deploy-plugin DPB-24] deploy-cloudflare (workers variant) + Story 1 #916 — [deploy-plugin DPB-24] deploy-cloudflare (workers variant) + Story 1
• [deploy-plugin DPB-25] Vercel probe + deploy-vercel (Build Output API) + Story 4 #917 — [deploy-plugin DPB-25] Vercel probe + deploy-vercel (Build Output API) + Story 4
• [deploy-plugin DPB-26] AWS-PROBE-HTTP: live Lambda Web Adapter conformance #918 — [deploy-plugin DPB-26] AWS-PROBE-HTTP: live Lambda Web Adapter conformance
• [deploy-plugin DPB-27] deploy-aws (lambda variant, HTTP scope) + Story 2 #919 — [deploy-plugin DPB-27] deploy-aws (lambda variant, HTTP scope) + Story 2

Rolling / backlog:

• [deploy-plugin DPB-28] Docs: target-matrix reference + per-target how-tos replace the alpha-minimal page #920 — [deploy-plugin DPB-28] Docs: target-matrix reference + per-target how-tos (0.0.1-beta.13)
• [deploy-plugin DPB-29] Deferred RFC: AWS event semantics, leaf backing graduation, Radius target graduation #921 — [deploy-plugin DPB-29] Deferred RFC: AWS events, leaf backing graduation, Radius (Backlog / Triage)