feat(agentic-engineering): add a machine-readable spend-stewardship enablement flag

[devantler]

🤖 Generated by the Agentic Engineer

Why

Spend stewardship is enabled by prose: the entrypoint performs a cost pass when the consumer's Spend contract section resolves, and spec.consumer.requiredWhenSpendStewardshipEnabled only lists required sections — it carries no enablement state. A reader of the manifest alone cannot tell whether the cost path is on, and a runtime reconciling the desired state has nothing to key off.

Raised as a 🟠 Major on monorepo#2455: with that deployment's private decision channel unresolved, nothing machine-readable stopped the decision-producing path from being active.

That consumer fixed the risk by gating the decision-producing half default-off on its private channel and pinning it with a test. What it cannot fix is the manifest shape: .spec.roles[*] is only_keys(["enabled", "mode"]) and .spec.consumer an exact six-key set, so a consumer-side flag key fails validate-manifests.sh, and the copied resource must stay byte-identical. This is the generic half.

Acceptance criteria

• A machine-readable enablement field with an explicit default-off state, in the existing provider-neutral vocabulary.
• validate-manifests.sh accepts the new shape and rejects a missing/malformed one; validate-manifests.test.sh covers both enabled and disabled states, per feature-flag-first.
• onboarding.steps and the schedule prompts consume the field rather than restating the rule.
• Plugin README documents it.
• Consumer follow-up: bump the gitlink and mirror the copied desired state.

Size

Small–medium: schema + validator + self-test + README.

[coderabbitai]

🔗 Related PRs

#32 - ci: guard README plugin table ↔ filesystem parity [merged]
#53 - fix: omit skills/agents path fields so plugins install in Claude Code [merged]
#55 - docs(adr): define the Automated AI Engineer plugin boundary [merged]
#58 - docs(adr): design the Vibe Coding plugin (shape, skill family, stack guardrail, voice) [merged]
#80 - feat!: consolidate autonomous agents into agentic-engineering [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

The upstream implementation is merged in #204 at bb19a27. Plugin 5.0.0 ships the required boolean default-off flag, one effective desired-state source, matching onboarding/dispatch pointers, migration guidance, and regression coverage. All 202 manifest cases and main CI passed; CodeRabbit completed a clean current-head review.

The remaining acceptance criterion is the consumer rollout in devantler-tech/monorepo#3244: advance the reviewed gitlink, copy the canonical desired state, keep false, and reconcile the consumer contract/test with the new prerequisite. This issue remains open until that source adoption is delivered.

[devantler]

🤖 Generated by the Agentic Engineer

All acceptance criteria are delivered. Upstream #204 merged at bb19a27; consumer monorepo#3245 merged at 98f5d69b5dd38b3f5abe447d58b9003e82491bc2 and closed its child #3244.

The consumer pins the reviewed plugin and mirrors its desired state byte for byte, declares that mirror as the effective source, and retains literal false. Its former unconditional cost-pass wording now requires the upstream opt-in and deployment prerequisites. Money-moving, private-channel, protected-floor, and confidentiality restrictions remain enforced by the delivery contract.

Validation: 202 upstream manifest cases; the full consumer delivery contract with eleven invalid-input controls; 16 merge-preflight properties across 132 surfaces; and 105 plugin-currency assertions. Both PRs received clean independent and current-head CodeRabbit reviews, and both merged main revisions passed CI. The merged trees match the reviewed trees. This completes the source rollout with spend disabled.