ADR-013 Phase 2: enforcement + signed shelf + adopt (adversarial-review hardened)

shopdb/config.py

@@ -70,6 +70,25 @@ class Config:
         if path.strip()
     ]
 
+    # When true, a plugin only loads/migrates if its tree matches a trusted
+    # signature (verify-at-load, verify-at-migrate). Default false = existing
+    # behavior. Turn on only after stamping plugins + pinning keys.
+    PLUGIN_REQUIRE_SIGNED = os.environ.get(
+        'PLUGIN_REQUIRE_SIGNED', 'false').lower() == 'true'
+
+    # Directories whose unsigned plugins are trusted - honored ONLY under
+    # DEBUG/TESTING (the external-repo/symlink dev workflow). Production ignores.
+    PLUGIN_DEV_TRUST_DIRS = [
+        path.strip()
+        for path in os.environ.get('PLUGIN_DEV_TRUST_DIRS', '').split(os.pathsep)
+        if path.strip()
+    ]
+
+    # Read-only folder the app pulls plugin artifacts from (a SharePoint-synced
+    # or copied shelf). Empty = no shelf configured. The app never speaks any
+    # network protocol; it reads this folder.
+    PLUGIN_SHELF_DIR = os.environ.get('PLUGIN_SHELF_DIR', '')
+
     ZABBIX_ENABLED = os.environ.get('ZABBIX_ENABLED', 'false').lower() == 'true'
     ZABBIX_URL = os.environ.get('ZABBIX_URL', '')
     ZABBIX_TOKEN = os.environ.get('ZABBIX_TOKEN', '')