Turns one strict host document into an inert installation catalog.

The catalog contains exactly the aliases installed by the host document. Each alias pairs a sealed, declarative descriptor with a trusted implementation that phase 5 cannot inspect or invoke. Construction does not resolve credentials, inspect local paths, start applications, claim OAuth authority for a principal, or perform provider work. Manifest selections cannot fall back to implicit built-ins.

Later runtime phases preflight local executable and launcher identity without reading credentials, then render credentials the command already resolved while acquiring the provider. An active command reads each declared credential exactly once, at phase-8 step 5; acquisition and the live connectivity probe both consume that value rather than resolving one of their own. Live LLM validation and optional public-identity attestation likewise precede credential access. Callback construction, provider-application readiness, and the adapter all receive the exact captured model value. Native trace acquisition exports its opaque frozen handle only to a selected inspection source, so private artifacts validate against the exact already-captured canonical source without reopening trace paths or exposing owner handles in metadata. An MCP installation containing any write mapping requires an explicit, nonempty manifest allow list before preflight, credential resolution, or transport acquisition. Omitting allow is permitted only for an all-read installation. Every stdio MCP child receives LC_ALL=C.UTF-8, independent of ambient locale and inherit_environment, so locale-sensitive servers encode protocol frames as UTF-8.

An LLM or replay install may set ceilings.max_calls; the application may narrow it with config.max_calls. The Kernel counts those calls per alias behind the public llm-request capability.

Every public provider snapshot separates the safe declaration projection from bounded runtime-captured acquisition facts. acquisition_identity_hash covers the latter and bare-hex snapshot_hash covers both. An LLM adapter may explicitly attest its exact target as safe public identity; otherwise it is omitted. Unattested or private model targets, endpoints, commands, paths, credentials, and private OAuth authority never enter either projection. A frozen-content provider also publishes an algorithm-qualified content_snapshot_hash; native query results copy that content identity unchanged for citations.