fix(certification): align certified sharing and unsigned dedicated admission (#2610)

Integrate certification policy, SDK/Core semantics, and documentation on canonical branch. Resolve duplicated documentation and keep invalid Cloud signatures rejected.

src/langbot/pkg/plugin/certification.py

@@ -199,7 +199,7 @@ def decide_plugin_admission(
 
     mode = DeploymentMode(deployment)
     certificate = facts.certificate
-    if certificate.is_valid_shared_runtime:
+    if mode is DeploymentMode.CLOUD and certificate.is_valid_shared_runtime:
         return PluginAdmissionDecision(
             AdmissionDisposition.SHARED_ELIGIBLE,
             AdmissionCode.SHARED_ELIGIBLE,
@@ -213,6 +213,15 @@ def decide_plugin_admission(
             DEDICATED_RUNTIME,
         )
 
+    # OSS has no cross-tenant shared placement; a verified claim stays dedicated
+    # there without inventing a dedicated certification tier.
+    if mode is DeploymentMode.OSS and certificate.is_valid_shared_runtime:
+        return PluginAdmissionDecision(
+            AdmissionDisposition.DEDICATED_ALLOWED,
+            AdmissionCode.OSS_UNTRUSTED_DEDICATED,
+            DEDICATED_RUNTIME,
+        )
+
     if mode is DeploymentMode.CLOUD:
         return PluginAdmissionDecision(
             AdmissionDisposition.REJECTED, AdmissionCode.CLOUD_CERTIFICATE_INVALID, DEDICATED_RUNTIME

src/langbot/pkg/plugin/connector.py

@@ -345,8 +345,9 @@ class PluginRuntimeConnector(ManagedRuntimeConnector):
             artifact_digest=setting.artifact_digest,
         )
 
-    @staticmethod
-    def _execution_mode_from_setting(setting: persistence_plugin.PluginSetting) -> PluginExecutionMode:
+    def _execution_mode_from_setting(self, setting: persistence_plugin.PluginSetting) -> PluginExecutionMode:
+        if getattr(getattr(self.ap, 'deployment', None), 'mode', 'oss') != 'cloud':
+            return PluginExecutionMode.DEDICATED
         return execution_mode_for_persisted_installation(
             artifact_digest=setting.artifact_digest,
             install_info=setting.install_info,