Function InstallAll

internal/platform/host.go:47–91

InstallAll runs every registered plugin through the staging Registrar, validates, and commits the survivors. FailOpen plugins that fail are skipped with a warning; the first FailClosed failure stops the loop and returns the error. Plugins are processed in registration order so the result is determi

(plugins []platform.Plugin, errOut io.Writer)

// errOut receives warnings about FailOpen plugin skips. nil errOut
// means warnings are dropped (useful in tests).
func InstallAll(plugins []platform.Plugin, errOut io.Writer) (*InstallResult, error) {
	if errOut == nil {
		errOut = io.Discard
	}
	result := &InstallResult{
		Registry: hook.NewRegistry(),
	}

	// Detect duplicate Plugin.Name. We do this up-front so the error
	// surfaces before any Install runs; design hard-constraint #7
	// treats this as configuration error (fail-closed regardless of
	// individual FailurePolicy).
	if err := detectDuplicateNames(plugins); err != nil {
		return nil, err
	}

	for _, p := range plugins {
		name, nameErr := safeCallName(p)
		if nameErr != nil {
			// Fail-closed on bad Name: we don't know the plugin's
			// FailurePolicy yet (it's behind Capabilities, and we
			// cannot trust Capabilities() before Name() succeeds).
			return nil, nameErr
		}
		if err := installOne(name, p, result); err != nil {
			// Some errors must abort regardless of FailurePolicy
			// because they imply the plugin's FailurePolicy itself
			// cannot be trusted (e.g. the consistency check between
			// Restricts and FailClosed failed).
			if isUntrustedConfigError(err) {
				return nil, err
			}
			policy := readFailurePolicy(p)
			switch policy {
			case platform.FailClosed:
				return nil, err
			default:
				fmt.Fprintf(errOut, "warning: plugin %q skipped: %v\n", name, err)
				continue
			}
		}
	}

	return result, nil
}

// isUntrustedConfigError flags errors where the plugin's declared
// FailurePolicy is itself part of the misconfiguration. For these the