Read native plugin task output files on the execution host (#17285)

doc/plugins/PLUGIN_ENVIRONMENT_TASKS.md

@@ -1,7 +1,8 @@
 # Environment task API
 
 An environment driver can provide a Runner task through a worker hook.
-The task API has no shell command or file transfer operation.
+The task API has no shell command. Its optional file-read operation is scoped
+to the active task workspace.
 
 This API is a server and worker contract. The [native execution integration](PLUGIN_RUNNER_EXECUTION.md)
 connects a task-capable environment to a Runner run.
@@ -38,6 +39,7 @@ See [the schemas](../../packages/plugins/sdk/src/environment-tasks.ts) for all f
 | `connection` | `connection` | Return an authenticated WSS endpoint and its generation. |
 | `status` | `status` | Report the phase and observed process termination. |
 | `check_project_auth` | `project_auth` | Validate the prepared project configuration before managed credential transfer. |
+| `read_file` | `file` | Read one bounded, task-scoped file from the active task. |
 | `read_state` | `state` | Read the exact retained Runner checkpoint. |
 | `archive_state` | `state` | Archive suspended authority with an idempotent archive key. Keep provider session files. |
 | `credentials` | `credentials` | Return the selected account after process termination. |
@@ -217,3 +219,23 @@ for fresh attempts; ordinary preparation and reuse retain their existing contrac
 Core keeps transfer files while preparation is uncertain. Confirmed task completion
 and provider workspace removal release these disposable copies. The descriptors
 remain stable: a later preparation downloads the same verified files again.
+
+
+## Task workspace files
+
+Core uses `read_file` for `call_api` file uploads and `register_deliverable`
+when a plugin owns execution and advertises `workspaceFileReadVersion: 1` in
+`describe`. The request includes the submitted Runner identity,
+validated project IDs, a canonical relative or absolute path, and a byte limit (at most 10 MiB).
+The provider resolves paths within locations granted to the active task. Relative
+paths resolve from its prepared workspace. Absolute paths can select another
+granted location such as agent home, but never a supervisor path or another
+agent's files. Core does not prescribe provider filesystem layout.
+
+The provider must reject inactive tasks, path escapes, symlinks, hard links,
+non-regular files, protected credentials, oversized files, and files that change
+while being read. Return canonical base64, byte size, and a SHA-256 digest in a
+`file` result for the same task. Core validates the result and rechecks authority
+before publishing it. Deliverables additionally verify the caller's expected
+size and digest. Providers without this operation fail closed; Core never falls
+back to reading remote paths on the server. Existing artifact uploads are unchanged.

doc/plugins/PLUGIN_RUNNER_EXECUTION.md

@@ -16,8 +16,10 @@ Implement these hooks:
 - `onEnvironmentDestroyLease`
 
 Task execution does not require `onEnvironmentExecute` or
-`onEnvironmentRealizeWorkspace`. The task API has no shell or file transfer
-operation. Use a separate workflow to install and save agent files.
+`onEnvironmentRealizeWorkspace`. The task API has no shell command or file installation
+operation. Use a separate workflow to install agent files. Providers that
+advertise `workspaceFileReadVersion: 1` can return task output files through the
+bounded `read_file` operation for attachments and deliverables.
 
 Core supports per-turn workspace sessions with Codex, OpenCode, and ACPX.
 OpenCode and ACPX require the existing qualified provider profiles.