@@ -300,6 +300,10 @@
       "types": "./src/lease-scope.ts",
       "default": "./src/lease-scope.ts"
     },
+    "./plugin-inventory": {
+      "types": "./src/plugin-inventory.ts",
+      "default": "./src/plugin-inventory.ts"
+    },
     "./local-interactor-operation-set": {
       "types": "./src/local-interactor-operation-set.ts",
       "default": "./src/local-interactor-operation-set.ts"
 
@@ -0,0 +1,103 @@
+import { isRecord } from '@agent-device/kernel/record';
+
+export type PluginSource = 'builtin' | 'store' | 'embedder';
+
+export type PluginInventoryError = Readonly<{
+  code: string;
+  message: string;
+  reason?: string;
+  hint?: string;
+}>;
+
+export type PluginInventoryCredentials = Readonly<{
+  variables: readonly string[];
+  byBackend: Readonly<Record<string, readonly string[]>>;
+}>;
+
+/** One plugin as the daemon sees it: published in `daemon.json` and shown by `daemon status`. */
+export type PluginInventoryEntry = Readonly<{
+  provider?: string;
+  source: PluginSource;
+  package?: string;
+  version?: string;
+  state: 'active' | 'failed';
+  error?: PluginInventoryError;
+  credentials: PluginInventoryCredentials;
+}>;
+
+export const NO_PLUGIN_CREDENTIALS: PluginInventoryCredentials = Object.freeze({
+  variables: Object.freeze([]),
+  byBackend: Object.freeze({}),
+});
+
+/**
+ * The credential variable names a lease on `leaseBackend` reads for `provider`: the backend's own
+ * list when the plugin declares one, otherwise its flat list. Undefined when no active plugin
+ * claims the provider.
+ */
+export function pluginCredentialVariables(
+  inventory: readonly PluginInventoryEntry[],
+  provider: string,
+  leaseBackend?: string,
+): readonly string[] | undefined {
+  const entry = inventory.find((candidate) => candidate.provider === provider);
+  if (entry?.state !== 'active') return undefined;
+  const { variables, byBackend } = entry.credentials;
+  return (
+    (leaseBackend !== undefined && Object.hasOwn(byBackend, leaseBackend)
+      ? byBackend[leaseBackend]
+      : undefined) ?? variables
+  );
+}
+
+/** Reads the inventory a daemon published, dropping anything that is not a well-formed entry. */
+export function readPluginInventory(value: unknown): readonly PluginInventoryEntry[] {
+  return Array.isArray(value) ? value.flatMap((entry) => readEntry(entry) ?? []) : [];
+}
+
+function readEntry(value: unknown): PluginInventoryEntry | undefined {
+  if (
+    !isRecord(value) ||
+    !isSource(value.source) ||
+    (value.state !== 'active' && value.state !== 'failed')
+  ) {
+    return undefined;
+  }
+  const credentials = isRecord(value.credentials) ? value.credentials : {};
+  return {
+    ...(typeof value.provider === 'string' ? { provider: value.provider } : {}),
+    source: value.source,
+    ...(typeof value.package === 'string' ? { package: value.package } : {}),
+    ...(typeof value.version === 'string' ? { version: value.version } : {}),
+    state: value.state,
+    ...(readError(value.error) ? { error: readError(value.error) } : {}),
+    credentials: {
+      variables: readNames(credentials.variables),
+      byBackend: Object.fromEntries(
+        Object.entries(isRecord(credentials.byBackend) ? credentials.byBackend : {}).map(
+          ([backend, names]) => [backend, readNames(names)],
+        ),
+      ),
+    },
+  };
+}
+
+function isSource(value: unknown): value is PluginSource {
+  return value === 'builtin' || value === 'store' || value === 'embedder';
+}
+
+function readNames(value: unknown): readonly string[] {
+  return Array.isArray(value) ? value.filter((name) => typeof name === 'string') : [];
+}
+
+function readError(value: unknown): PluginInventoryError | undefined {
+  if (!isRecord(value) || typeof value.code !== 'string' || typeof value.message !== 'string') {
+    return undefined;
+  }
+  return {
+    code: value.code,
+    message: value.message,
+    ...(typeof value.reason === 'string' ? { reason: value.reason } : {}),
+    ...(typeof value.hint === 'string' ? { hint: value.hint } : {}),
+  };
+}
@@ -22,6 +22,7 @@ import {
   type ProcessLockAcquisition,
 } from '@agent-device/host-kit/file';
 import { emitDiagnostic } from '@agent-device/host-kit/diagnostics';
+import type { PluginInventoryEntry } from '@agent-device/contracts/plugin-inventory';
 import { withDaemonDiagnosticsScope } from './daemon-diagnostics-scope.ts';
 import type { DaemonCodeOrigin } from '@agent-device/host-kit/code-signature';
 import {
@@ -51,6 +52,8 @@ export type DaemonRegistrationFields = Readonly<{
   codeOrigin: DaemonCodeOrigin;
   codeSignature: string;
   policyDigest?: string;
+  /** The provider plugin inventory, so a client can read what this daemon registered. */
+  plugins?: readonly PluginInventoryEntry[];
 }>;
 type DaemonRegistrationRemoval =
   | Readonly<{ state: 'removed' }>
 
@@ -67,7 +67,7 @@ export function daemonRuntimeDepsFixture(
       hostDiagnostics: hostDiagnosticsFixture(),
       ownerLifecycle: platformOwnerLifecycleFixture(),
       providerDeviceRuntimes: [],
-      skippedProviderRuntimes: [],
+      pluginInventory: [],
       providerRuntimeIds: [],
       recoverableProviderIds: [],
       deviceRuntimeGateway: Object.freeze({
 
@@ -1,3 +1,4 @@
+import type { PluginInventoryEntry } from '@agent-device/contracts/plugin-inventory';
 import fs from 'node:fs';
 import path from 'node:path';
 import { afterEach, expect, test, vi } from 'vitest';
@@ -6,7 +7,7 @@ import { mkdtempForTestSync, publishDaemonRegistration } from '@agent-device/tes
 const lifecycleEvents = vi.hoisted(() => [] as string[]);
 const startupFailure = vi.hoisted(() => ({ active: false }));
 const providerComposition = vi.hoisted(() => ({
-  skipped: [] as Array<{ provider: string; error: Error & { code: string } }>,
+  inventory: [] as PluginInventoryEntry[],
 }));
 
 import {
@@ -42,7 +43,7 @@ function startRuntime(stateDir: string, exit: (code: number) => void) {
           lifecycleEvents.push('gateway-shutdown');
         },
       }),
-      skippedProviderRuntimes: providerComposition.skipped,
+      pluginInventory: providerComposition.inventory,
     })),
     env: {
       ...process.env,
@@ -75,7 +76,7 @@ function publishSuccessor(paths: DaemonPaths): void {
 afterEach(() => {
   startupFailure.active = false;
   lifecycleEvents.length = 0;
-  providerComposition.skipped = [];
+  providerComposition.inventory = [];
   vi.restoreAllMocks();
 });
 
@@ -147,16 +148,26 @@ test('a shutdown removes its own metadata and reports an unverified release', as
   }
 });
 
-test('a skipped provider runtime is logged after this daemon publishes its record', async () => {
+test('a failed provider plugin is logged and published after this daemon publishes its record', async () => {
   const stateDir = mkdtempForTestSync('agent-device-daemon-provider-skip-');
-  const error = Object.assign(new Error('Limrun instance access is missing X.'), {
-    code: 'INVALID_ARGS',
-  });
-  providerComposition.skipped = [{ provider: 'limrun', error }];
+  const failed = {
+    provider: 'limrun',
+    source: 'builtin',
+    state: 'failed',
+    error: { code: 'INVALID_ARGS', message: 'Limrun instance access is missing X.' },
+    credentials: { variables: [], byBackend: {} },
+  } as const;
+  providerComposition.inventory = [failed];
   const runtime = await startRuntime(stateDir, () => {});
   try {
-    const skipped = logEvents(stateDir).find(({ phase }) => phase === 'provider_runtime_skipped');
-    expect(skipped?.data).toMatchObject({ provider: 'limrun', code: 'INVALID_ARGS' });
+    const event = logEvents(stateDir).find(({ phase }) => phase === 'provider_plugin_failed');
+    expect(event?.data).toMatchObject({
+      provider: 'limrun',
+      source: 'builtin',
+      code: 'INVALID_ARGS',
+    });
+    const published = JSON.parse(fs.readFileSync(resolveDaemonPaths(stateDir).infoPath, 'utf8'));
+    expect(published.plugins).toEqual([failed]);
   } finally {
     await runtime?.shutdown();
   }
 
@@ -95,6 +95,7 @@ import type {
   ProviderExpiredLeaseRecovery,
 } from '@agent-device/contracts/device';
 import type { HostDiagnostics } from '@agent-device/contracts/host-diagnostics';
+import type { PluginInventoryEntry } from '@agent-device/contracts/plugin-inventory';
 
 const DAEMON_LEASE_RELEASE_TIMEOUT_MS = 1_000;
 const LEASE_EXPIRY_SWEEP_INTERVAL_MS = 1_000;
@@ -124,11 +125,11 @@ export type DaemonRuntimeDeps = Readonly<{
   ownerLifecycle: PlatformOwnerLifecycle;
   providerDeviceRuntimes: readonly ProviderDeviceRuntime[];
   /**
-   * Provider runtimes the composition skipped. Data only: this server records each one as a
-   * `provider_runtime_skipped` diagnostic after publishing its registration, so log emission
-   * stays in this module.
+   * Every provider plugin the composition saw, active or failed. Data only: this server publishes
+   * it in the daemon registration and records each failed entry as a `provider_plugin_failed`
+   * diagnostic, so log emission stays in this module.
    */
-  skippedProviderRuntimes: readonly Readonly<{ provider: string; error: AppError }>[];
+  pluginInventory: readonly PluginInventoryEntry[];
   interactorResolution: InteractorResolution;
   providerDeviceAdmission: ProviderDeviceAdmission;
   cleanupManagedWebOrphans: (
@@ -713,6 +714,7 @@ export async function startDaemonRuntime(
       codeOrigin: daemonCodeOrigin,
       codeSignature: daemonCodeSignature,
       policyDigest: daemonPolicy?.digest,
+      plugins: deps.pluginInventory,
     });
     if (socketPort) stdout.write(`AGENT_DEVICE_DAEMON_PORT=${socketPort}\n`);
     if (httpPort) stdout.write(`AGENT_DEVICE_DAEMON_HTTP_PORT=${httpPort}\n`);
@@ -798,12 +800,15 @@ export async function startDaemonRuntime(
     publishDaemonInfo(socketPort, httpPort);
     stopMetadataLossWatch = armDaemonMetadataLossWatch(baseDir, infoPath, logPath, daemonIdentity);
     await flushDaemonStartupDiagnostics(logPath, startupDiagnostics);
-    for (const skipped of deps.skippedProviderRuntimes) {
-      await emitDaemonDiagnostic(logPath, 'provider_runtime_skipped', {
-        provider: skipped.provider,
-        code: skipped.error.code,
-        message: skipped.error.message,
-        hint: skipped.error.details?.hint,
+    for (const plugin of deps.pluginInventory.filter(({ state }) => state === 'failed')) {
+      await emitDaemonDiagnostic(logPath, 'provider_plugin_failed', {
+        provider: plugin.provider,
+        package: plugin.package,
+        source: plugin.source,
+        code: plugin.error?.code,
+        reason: plugin.error?.reason,
+        message: plugin.error?.message,
+        hint: plugin.error?.hint,
       });
     }
     // After publication: publishDaemonInfo truncates daemon.log, so anything
 
@@ -15,10 +15,18 @@
       "types": "./src/connection.ts",
       "default": "./src/connection.ts"
     },
+    "./contract": {
+      "types": "./src/contract.ts",
+      "default": "./src/contract.ts"
+    },
     "./host": {
       "types": "./src/host.ts",
       "default": "./src/host.ts"
     },
+    "./inventory": {
+      "types": "./src/inventory.ts",
+      "default": "./src/inventory.ts"
+    },
     "./load": {
       "types": "./src/load.ts",
       "default": "./src/load.ts"
@@ -27,6 +35,10 @@
       "types": "./src/manifest.ts",
       "default": "./src/manifest.ts"
     },
+    "./registry": {
+      "types": "./src/registry.ts",
+      "default": "./src/registry.ts"
+    },
     "./store": {
       "types": "./src/store.ts",
       "default": "./src/store.ts"
 
@@ -1,34 +1,54 @@
-import type { CliFlags } from '@agent-device/contracts/command';
-import type {
-  ConnectionProviderCapabilities,
-  ProviderConnectionVerification,
-  RemoteConfigProfile,
-} from '@agent-device/contracts/remote';
-import type { EnvMap } from '@agent-device/kernel/source-value';
-import { installedPlugins } from './store.ts';
+import type { ConnectionProviderCapabilities } from '@agent-device/contracts/remote';
+import { resolveUserConfigPath } from '@agent-device/host-kit/file';
+import type { PluginConnection, PluginConnectionContext } from './contract.ts';
+import { legacyStoreManifests, storePluginCandidates } from './store.ts';
 
-export type PluginConnection = Readonly<{
-  resolve(context: { flags: CliFlags; stateDir: string; cwd: string; env: EnvMap }):
-    | Promise<{
-        profile: RemoteConfigProfile;
-        extraFlags?: Partial<CliFlags>;
-      }>
-    | { profile: RemoteConfigProfile; extraFlags?: Partial<CliFlags> };
-  verify(context: { flags: CliFlags; env: EnvMap }): Promise<ProviderConnectionVerification>;
+/** A plugin's connection as the client calls it: the registry adds the `host` to each context. */
+export type PluginConnectionCallbacks = Readonly<{
+  resolve(context: Omit<PluginConnectionContext, 'host'>): ReturnType<PluginConnection['resolve']>;
+  verify(
+    context: Omit<Pick<PluginConnectionContext, 'flags' | 'env' | 'host'>, 'host'>,
+  ): ReturnType<PluginConnection['verify']>;
 }>;
 
+export type RegisteredConnection = PluginConnectionCallbacks &
+  Readonly<{ capabilities: PluginConnection['capabilities'] }>;
+
+// Capabilities live in the plugin, so a v2 store plugin answers only once its package has loaded.
+// A client loads the store once per process through primePluginConnections; every synchronous
+// reader below then answers from that registry, and a v1 plugin answers from its manifest.
+const primed = new Map<string, ReadonlyMap<string, RegisteredConnection>>();
+
+/** Loads the store's plugins into the connection registry this process reads capabilities from. */
+export async function primePluginConnections(
+  env: NodeJS.ProcessEnv = process.env,
+  builtinProviders: readonly string[] = [],
+): Promise<void> {
+  if (primed.has(resolveUserConfigPath(env))) return;
+  const { claimProviderIds, resolveProviderPlugins } = await import('./registry.ts');
+  const resolved = await resolveProviderPlugins([
+    ...claimProviderIds(builtinProviders),
+    ...storePluginCandidates(env),
+  ]);
+  primed.set(resolveUserConfigPath(env), resolved.connections);
+}
+
 export function pluginConnectionCapabilities(
   provider: string | undefined,
   env: NodeJS.ProcessEnv = process.env,
 ): ConnectionProviderCapabilities | undefined {
-  return provider === undefined
-    ? undefined
-    : installedPlugins(env).find((plugin) => plugin.agentDevicePlugin.provider === provider)
-        ?.agentDevicePlugin.connection;
+  if (provider === undefined) return undefined;
+  return (
+    primed.get(resolveUserConfigPath(env))?.get(provider)?.capabilities ??
+    legacyStoreManifests(env).find((plugin) => plugin.agentDevicePlugin.provider === provider)
+      ?.agentDevicePlugin.connection
+  );
 }
 
 export function pluginConnectionNames(env: NodeJS.ProcessEnv = process.env): string[] {
-  return installedPlugins(env)
-    .filter((plugin) => plugin.agentDevicePlugin.connection)
-    .map((plugin) => plugin.agentDevicePlugin.provider);
+  const names = new Set<string>(primed.get(resolveUserConfigPath(env))?.keys());
+  for (const plugin of legacyStoreManifests(env)) {
+    if (plugin.agentDevicePlugin.connection) names.add(plugin.agentDevicePlugin.provider);
+  }
+  return [...names];
 }