Managed Runtime Boundary

Foundry remains a provider-neutral CMS. Managed mode is optional and disabled unless foundry.managed.enabled is explicitly set in site configuration. Standalone builds, serve mode, plugins, themes, and admin behavior do not require a Cloud account or control-plane dependency.

Managed integrations are generic runtime features: signed registration and status callbacks, bootstrap application, health reporting, and managed backup snapshots. They require an explicit instance ID, HTTPS callback URL, strong shared secret, and secure admin configuration. Callback code is skipped when managed mode is disabled.

Managed admin access must use named user sessions: static admin.access_token credentials are rejected so MFA, session expiry, and audit attribution cannot be bypassed. Managed deployments also require an HTTPS base_url, a non-local admin surface, explicit idle and maximum session lifetimes, and disabled pprof and server debug routes. Plugin and configuration changes remain subject to the normal admin capability and audit controls. Raw YAML configuration is not served to managed administrators because it can contain runtime credentials; the structured settings surface remains available for supported site settings.

Managed Plugin Governance

Managed deployments can set foundry.managed.plugin_policy as a deployment-owned allowlist. Each enabled plugin must match an approved name, version, and SHA-256 artifact digest; an empty allowlist allows no managed plugins. The policy can also limit licenses and require the supported strict RPC runtime profile. The CMS rechecks this policy at startup and before plugin install, enable, and update operations. A failed update is rolled back to its previous snapshot.

plugin.yaml declarations and source analysis remain useful customer-facing warnings, but they do not establish marketplace approval. The deployment policy is the trusted review record. Managed settings edits preserve both that policy and the enabled plugin list.

Provider-specific provisioning, billing, tenancy, and callback persistence belong outside this repository. A managed deployment may supply the generic configuration through its runtime overlay, but this CMS does not contain provider URLs, tenant IDs, cloud credentials, or Cloud-only package imports.