Plugins and Skills Fact Boundary

Plugin docs now match the real code: Plugin owns providers and market state; Skill owns callable tool definitions, packages, and certification.

Real model

The extension system has two layers:

Layer	Source	Role
Plugin	`backend/internal/model/plugin.go`	Provider, roles, MCP/HTTP/Workflow/Native source type, enablement, market review, and execution entry
Skill	`backend/internal/model/skill.go`	Callable tool definition, input/output schema, ZIP package, public store, certification, and security score

So this docs category no longer treats a generic package manifest as the only entry. Private tools use POST /api/v4/plugins; skill distribution uses /api/v4/skill-store; MCP tool import uses /api/v4/plugins/mcp/*.

Proven entries

GET /api/v4/plugins
GET /api/v4/plugins/market
GET /api/v4/plugins/:id
POST /api/v4/plugins
PUT /api/v4/plugins/:id
PUT /api/v4/plugins/:id/toggle
DELETE /api/v4/plugins/:id
POST /api/v4/plugins/sync
POST /api/v4/plugins/:id/execute
POST /api/v4/plugins/pre-check
POST /api/v4/plugins/:id/health-check
PUT /api/v4/plugins/:id/toggle-enabled
PUT /api/v4/plugins/:id/unpublish
DELETE /api/v4/plugins/presets
POST /api/v4/plugins/:id/publish-to-market
PUT /api/v4/plugins/:id/withdraw-market
POST /api/v4/plugins/:id/resubmit-market
GET /api/v4/plugins/:id/usage-stats
POST /api/v4/plugins/mcp/test
POST /api/v4/plugins/mcp/import
GET /api/v4/plugins/mcp/resources
POST /api/v4/plugins/mcp/resources/read
GET /api/v4/plugins/mcp/prompts
POST /api/v4/plugins/mcp/oauth/authorize
GET /api/v4/plugins/mcp/oauth/callback
POST /api/v4/plugins/bocha/test
POST /api/v4/plugins/bocha/create
POST /api/v4/plugins/zhipu/test
POST /api/v4/plugins/zhipu/create
POST /api/v4/plugins/dashscope-search/test
POST /api/v4/plugins/dashscope-search/create
POST /api/v4/plugins/skill-generator/test
POST /api/v4/plugins/skill-generator/create
public GET /api/v4/public/plugins
public GET /api/v4/public/plugins/:id
skill-store GET /api/v4/skill-store
skill-store GET /api/v4/skill-store/:id
skill-store GET /api/v4/skill-store/:id/certification
skill-store GET /api/v4/skill-store/:id/download
skill-store GET /api/v4/skill-store/admin/detail/:id
skill-store GET /api/v4/skill-store/admin/dump
skill-store GET /api/v4/skill-store/admin/list
skill-store GET /api/v4/skill-store/admin/subcategory-stats
skill-store GET /api/v4/skill-store/admin/unprocessed
skill-store GET /api/v4/skill-store/pending
skill-store GET /api/v4/skill-store/resolve/:key
skill-store POST /api/v4/skill-generator/generate
skill-store POST /api/v4/skill-generator/optimize
skill-store POST /api/v4/skill-generator/validate
skill-store POST /api/v4/skill-store/:id/certify
skill-store POST /api/v4/skill-store/:id/install
skill-store POST /api/v4/skill-store/admin/archive
skill-store POST /api/v4/skill-store/admin/batch-delete
skill-store POST /api/v4/skill-store/admin/batch-update
skill-store POST /api/v4/skill-store/admin/restore
skill-store POST /api/v4/skill-store/audit
skill-store POST /api/v4/skill-store/publish
skill-store POST /api/v4/skill-store/upload

SDK surface

Skill store: browseSkillStore, browseSkills, browseSkillsList, certifySkill, downloadSkill, generateSkill, getCertificationStatus, getSkillDetail, getSkillSummary, installSkill, optimizeSkill, resolveSkill, uploadSkill, validateSkill
Tools: getTool, listTools

Current boundary

Private plugins are created as status=APPROVED, marketStatus=NONE; they are not automatically listed publicly.
Public plugin browse requires status=APPROVED, market_status=APPROVED, and is_enabled=true.
Skill ZIP packages pass ZIP safety checks: up to 50 files and 50 MB decompressed.