[zts212653]

F333 Phase B's installed plugin candidates need a package-local MCP factory and a compatible SDK validator. This declares optional sharedFactory: {module, export} on an MCP contribution, requires a builtin module and Contract >=0.3.2, and requires each factory-bearing contribution to retain its original stdio declaration for explicit fallback. It also keeps configurationVariants available in newer contracts.

Cuts Contract 0.3.2-candidate.0 and SDK 0.3.0-beta.2-candidate.1 as the release prerequisite for the paired F333 plugin/Host implementation. The current public plugin selection remains unchanged. No action-method manifest whitelist is introduced.

Sol5.6's first review of 8f0bc82 requested an IPC rejection boundary and restoration of the unrelated Lark CLI CPU constraint. Both are fixed in 46ccdc5. The regression first failed with IPC admitted, then passed; it covers a later invalid contribution and retains legacy IPC without sharedFactory. The pnpm lock diff against base now contains only the intended SDK Contract specifier change.

Validation: Contract 650 tests, SDK 228 tests, Contract typecheck and diff check pass after the fix. The canonical pinned-toolchain local gate completed all 37 steps in 982s; its first Contract step predates the semantic fix, so the changed surface was additionally rerun afterward. Required CI on exact 46ccdc5 succeeded: Contract CI run 40923744131 and Personal Chrome Companion CI run 40923744152. Sol5.6 independently approved this HEAD with no open findings in the durable local review fact 0001793296043249-000127-f42b202d. Independent re-review requested from CVO-designated Sol5.6 (codex-sol); author Sol6.1 (codex61-sol).

Accepted source: Cat Café docs/features/F333-shared-mcp-process-lifecycle.md and docs/plans/2026-10-29-f333-phase-b.md (approved baseline 98ed700041116a868809d463b0de04d7b396406f), immutable handoff thread_mvtco79xyjrcpmvr#0001793266666280-000236-3af0ac34. This prerequisite PR does not claim Host/five-entry implementation or Phase B acceptance. Production activation and Feature acceptance remain with the original owner.

Risk: behavior adds manifest admission and compatibility validation; data has no migration or user-record changes; security changes no caller permission or secret handling; contract changes the optional factory field and exact SDK dependency; irreversible scope is the authorized immutable prerelease publication after this merge. The selected independent source is the CVO-designated local reviewer; no additional cloud review is selected for the same contract surface.

[zts212653]

Merge evidence at exact HEAD 46ccdc5.

E1: canonical PR HEAD equals clean author worktree HEAD. E2/E3: independent reviewer Sol5.6 (codex-sol), not author Sol6.1, approved this exact HEAD with no open findings; local-review:0001793296043249-000127-f42b202d:approved. Accepted source thread_mvtco79xyjrcpmvr#0001793266666280-000236-3af0ac34 is immutable and its current message revision equals 0001793266666280-000236-3af0ac34. E4: approved. E5: Contract 650, SDK 228, Contract typecheck and diff check pass; canonical local all37 gate completed with the changed guard rerun afterward; required exact-head Contract CI 40923744131 and Personal Chrome Companion CI 40923744152 both succeeded.

Provenance: localPeerReviewSha=46ccdc5769baef34fb40736a51818bb60c8d22cd; cloudReviewSha=none (local selected); headChangeCause=local-gate; nextGateOwner=author; stale=false; gate_passed=true; verdict=passed. PR metadata only changed after approval.

This prerequisite delivers the declared contract and SDK validator. It does not certify the full Host/five-forwarder implementation or Phase B acceptance. Public catalog activation and production deployment are separate. Author Sol6.1.