plugin.yaml

name: hello            # a-z, 0-9, '_' '-' (max 64); the data-source name
version: 1.0.0
kinds: [source]        # source, action and/or filter
config_schema: {}      # JSON schema of the plugin's configuration
permissions:
  egress_hosts: [api.example.com, "*.example.org"]   # the only hosts reachable
  secret_refs: [example-token]                       # secrets the egress proxy may inject
  secret_headers:                                    # where it injects them
    - { host: api.example.com, header: Authorization, ref: example-token, prefix: "Bearer " }
  max_cpu_ms: 1000     # default 1000
  max_mem_mb: 256      # default 256, at most 2048

Every secret_headers entry needs its ref in secret_refs and its host in egress_hosts; the runner refuses the plugin otherwise. The manifest in the x-plugin-manifest header must match the tarball's plugin.yaml; the runner reads the tarball's copy.