WIT contract version aegis.plugin-runtime.v1 with digest-signature verification contract.

package aegis:plugin-runtime@1.0.0;

interface contracts {
  record stage-context {
    job-id: string,
    plan-tier: string,
    requested-at: string,
    device-id: option<string>,
  }

  record task-request {
    image: string,
    command: list<string>,
    env: list<string>,
    workdir: string,
    timeout-secs: u32,
    cpu-limit: u32,
    memory-limit-mb: u32,
  }

  record pre-compile-input {
    context: stage-context,
    task-request: task-request,
    config-json: string,
  }

  record pre-compile-output {
    config-json: option<string>,
    command: option<list<string>>,
    env: option<list<string>>,
    timeout-secs: option<u32>,
    cpu-limit: option<u32>,
    memory-limit-mb: option<u32>,
  }

  record post-compile-input {
    context: stage-context,
    status: string,
    logs-json: string,
  }

  record post-compile-output {
    summary: option<string>,
    metrics-json: option<string>,
  }

  variant plugin-error {
    policy-denied(string),
    invalid-output(string),
    runtime-failed(string),
  }
}

world config-validation {
  import run: func(input: contr