Model transport provider sources

docs/daemon-management.md

@@ -22,17 +22,36 @@ Managed daemons:
 - use AMPG-owned ports, sockets, hidden-service dirs, key files, and output roots.
 - can be stopped, restarted, or removed by AMPG.
 
+## Provider model
+
+A transport provider is the implementation AMPG uses to publish one protocol target.
+Every provider must resolve to a local endpoint, generated config, managed state, and a
+health check.
+
+Provider sources:
+
+- `configured`: explicit config from `gateway.toml` or approved generated snippets.
+- `bundled-sidecar`: a provider shipped with AMPG or an app bundle and run from AMPG
+  state.
+- `system-adopted`: a healthy daemon that AMPG did not start and does not own.
+- `system-managed`: an installed daemon binary supervised through AMPG-owned state.
+- `platform-package`: a daemon package installed by an allowlisted apply stage.
+- `operator-interface`: physical or link-layer setup that remains operator-owned.
+- `external`: render outputs and review artifacts only.
+
 ## Discovery order
 
 For each enabled protocol, AMPG checks:
 
 1. Explicit config in `gateway.toml`.
-2. AMPG-owned state from previous runs.
-3. Common system services and ports.
-4. Known config paths for supported daemons.
+2. Bundled AMPG providers for the current platform.
+3. AMPG-owned state from previous runs.
+4. Common system services and ports.
+5. Known config paths for supported daemons.
+6. Platform package backends for managed install stages.
 
-The result is shown in `ampg status`. `ampg plan` shows rendered outputs and reviewable
-config artifacts.
+The result is shown in `ampg status` as `provider_source`. `ampg plan` shows rendered
+outputs and reviewable config artifacts.
 
 ## Preflight commands
 

docs/generated/daemon-adapters.md

@@ -10,6 +10,7 @@ This file is generated from code. Do not edit it by hand.
 - Protocols: clearnet, tor, i2p
 - Default policy: `adopt`
 - Generated artifacts: server block snippets
+- Provider sources: `configured`, `system-adopted`, `system-managed`, `platform-package`
 
 Notes:
 - Clearnet defaults to adopt because TLS and public vhost policy are operator-owned.
@@ -20,6 +21,7 @@ Notes:
 - Protocols: tor
 - Default policy: `auto`
 - Generated artifacts: torrc hidden-service snippet
+- Provider sources: `configured`, `bundled-sidecar`, `system-adopted`, `system-managed`, `platform-package`
 
 Notes:
 - AMPG should preserve existing HiddenServiceDir material when adopting.
@@ -30,6 +32,7 @@ Notes:
 - Protocols: i2p
 - Default policy: `auto`
 - Generated artifacts: i2pd server tunnel snippet
+- Provider sources: `configured`, `bundled-sidecar`, `system-adopted`, `system-managed`, `platform-package`
 
 Notes:
 - Web tunnels should use web-specific key files.
@@ -40,6 +43,7 @@ Notes:
 - Protocols: gemini
 - Default policy: `auto`
 - Generated artifacts: Agate plan values
+- Provider sources: `configured`, `bundled-sidecar`, `system-adopted`, `system-managed`, `platform-package`
 
 Notes:
 - Gemini serves generated Gemtext output directly.
@@ -50,6 +54,7 @@ Notes:
 - Protocols: ipfs
 - Default policy: `auto`
 - Generated artifacts: fixture manifest route expectations
+- Provider sources: `configured`, `bundled-sidecar`, `system-adopted`, `system-managed`, `platform-package`
 
 Notes:
 - IPFS output is static web content for a local gateway or later pinning.
@@ -60,6 +65,7 @@ Notes:
 - Protocols: reticulum
 - Default policy: `auto`
 - Generated artifacts: Reticulum page-service plan
+- Provider sources: `configured`, `bundled-sidecar`, `system-adopted`, `system-managed`, `platform-package`, `operator-interface`
 
 Notes:
 - Reticulum output is planned as small page-service content.