Document plugin secret binding contract

README.md

@@ -32,8 +32,8 @@ and `backup-restore-response.json` contracts; test fixtures contain no real
 database paths or credentials.
 
 The authenticated WebAssembly plugin lifecycle uses the manifest, install,
-and installed-response contracts. Fixtures contain only synthetic package
+installed-response, and plugin-secret-binding-request contracts. Fixtures
-metadata and no executable module or secret.
+contain only synthetic package metadata and no executable module or secret.
 
 Command simulation uses `bot-command-simulate-request.json` and
 `bot-command-simulate-response.json`. A sample response is the default and

contracts/v1/plugin-secret-binding-request.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://trixie.local/contracts/v1/plugin-secret-binding-request.json",
+  "title": "Plugin secret binding request",
+  "type": "object",
+  "required": ["secret_name", "approved"],
+  "properties": {
+    "secret_name": { "type": "string", "pattern": "^[A-Za-z0-9_]{1,100}$" },
+    "approved": { "type": "boolean" }
+  },
+  "additionalProperties": false
+}

fixtures/v1/plugin-secret-binding-request.json

@@ -0,0 +1,4 @@
+{
+  "secret_name": "VTS_API_TOKEN",
+  "approved": true
+}