Best possible solution:

Land one canonical local-plugin trust rule across catalog selection and scoped loader imports, preserving explicit trusted setup and origin-aware safe fallback while clearly accepting the fail-closed upgrade behavior.

Do we have a high-confidence way to reproduce the issue?

Yes. The source PR provides a concrete clean-main Docker/package path where an explicitly trusted plugins.load.paths channel remains unresolved, while the patched package resolves it and still blocks untrusted module and setup execution.

Is this the best way to solve the issue?

Yes. The patch uses the existing manifest-owner policy at both catalog and loader owner boundaries, threads the existing load-path configuration into discovery, and narrows fallback exclusion to the rejected origin/plugin pair instead of adding a competing trust mechanism.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 047785eb30c0.

Label justifications:

• P2: This fixes a bounded channel setup regression and local-plugin trust inconsistency with limited affected scope.
• merge-risk: 🚨 compatibility: Existing implicitly trusted config/global local channel plugins can stop loading during setup after merge.
• merge-risk: 🚨 security-boundary: The patch changes whether locally discovered plugin modules may execute in setup-only flows.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 🚀 automerge armed: This PR is in ClawSweeper's automerge lane. Sufficient (logs): The linked source contribution includes after-fix Docker/package and black-box marker evidence for trusted and untrusted load-path behavior, and this replacement head retains that runtime proof while exact-head validation reports the focused checks passing.
• proof: sufficient: Contributor real behavior proof is sufficient. The linked source contribution includes after-fix Docker/package and black-box marker evidence for trusted and untrusted load-path behavior, and this replacement head retains that runtime proof while exact-head validation reports the focused checks passing.

PR surface:

Source +190, Tests +892, Other +324. Total +1406 across 13 files.

What I checked:

• Current-main gap: Current main's trusted catalog logic recognizes only workspace-origin local entries and falls back by excluding the entire workspace origin, so explicitly trusted plugins.load.paths channels are not covered by the same resolution path. (src/commands/channel-setup/trusted-catalog.ts:49, 047785eb30c0)
• Unified trust decision: The PR classifies workspace, config, and global as local origins, applies existing manifest-owner base policy and explicit-trust helpers, and permits the existing workspace auto-enable exception without inventing a parallel trust source. (src/commands/channel-setup/trusted-catalog.ts:49, eabee04d5459)
• Origin-aware fallback: Rejected local candidates are excluded by {pluginId, origin} and retried through the catalog, allowing a safe bundled copy with the same id to remain eligible instead of suppressing all copies. (src/commands/channel-setup/trusted-catalog.ts:85, eabee04d5459)
• Loader enforcement: Scoped setup-only loads reapply the same base-policy and explicit-trust checks before importing non-bundled channel plugin code, closing the execution path rather than relying only on catalog filtering. (src/plugins/loader.ts:2074, eabee04d5459)
• Real behavior proof: The source contribution records a clean-main Docker/package failure for an explicitly trusted load-path channel and an after-fix pass for trusted and untrusted cases; this head retains a package-installed Docker script that asserts module import and setup registration marker behavior. (scripts/e2e/channel-plugin-trust-docker.sh:215, eabee04d5459)
• Exact-head checks: GitHub reported 93 successful checks, five skipped, one neutral, and only an unrelated in-progress control-plane shard at inspection time; the previously failing core-runtime and core-models shards succeeded on the exact head. (eabee04d5459)

Likely related people:

• hxy91819: Introduced the merged workspace setup-only trust boundary in PR fix(plugins): block untrusted workspace setup-only channel loads #86953 and authored the original config/global follow-up branch and proof. (role: feature owner; confidence: high; commits: 004835f4c7f4, d797c403b24f, 0f3964cf9f19; files: src/plugins/loader.ts, src/commands/channel-setup/trusted-catalog.ts, scripts/e2e/channel-plugin-trust-docker.sh)
• steipete: Recent history shows repeated ownership of plugin loader behavior, diagnostics, lazy runtime surfaces, and plugin edge-case hardening around the affected loader path. (role: recent adjacent contributor; confidence: medium; commits: 5b79e8156962, ccb50f89dacf, fe91ada73017; files: src/plugins/loader.ts)
• brokemac79: Recently changed trusted installed-plugin policy contracts in the same loader and manifest-owner policy area, making them relevant to trust-policy consistency review. (role: recent adjacent owner; confidence: medium; commits: de4b8d8ebf73; files: src/plugins/loader.ts, src/plugins/manifest-owner-policy.ts)

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.