feat(observability): add dynamic export activation policies

Signed-off-by: Bryan Bednarski <bbednarski@nvidia.com>

Author: bbednarski9

crates/cli/src/server/mod.rs

@@ -20,8 +20,9 @@ use axum::response::{IntoResponse, Response};
 use axum::routing::{get, post};
 use axum::{Json, Router};
 use nemo_relay::plugin::dynamic::{
-    DynamicPluginKind, NativePluginActivation, NativePluginLoadSpec, WorkerPluginActivation,
-    WorkerPluginLoadSpec, load_native_plugins, load_worker_plugins,
+    DynamicPluginCapability, DynamicPluginKind, DynamicPluginManifest, NativePluginActivation,
+    NativePluginLoadSpec, WorkerPluginActivation, WorkerPluginLoadSpec, load_native_plugins,
+    load_worker_plugins,
 };
 use nemo_relay::plugin::{
     PluginComponentSpec, PluginConfig, clear_plugin_configuration, initialize_plugins_exact,
@@ -977,13 +978,6 @@ impl PluginActivation {
         {
             return Err(CliError::Config(error.to_string()));
         }
-        plugin_config
-            .components
-            .extend(dynamic_plugins.iter().map(|plugin| PluginComponentSpec {
-                kind: plugin.plugin_id.clone(),
-                enabled: true,
-                config: plugin.config.clone(),
-            }));
         for plugin in &dynamic_plugins {
             if let Some(snapshot) = plugin.activation_snapshot.as_ref() {
                 snapshot.verify_current()?;
@@ -1038,6 +1032,40 @@ impl PluginActivation {
                 })
             })
             .collect::<Result<Vec<_>, CliError>>()?;
+        let mut policy_components = Vec::new();
+        let mut regular_components = Vec::new();
+        for plugin in &dynamic_plugins {
+            let manifest_ref = plugin
+                .activation_snapshot
+                .as_ref()
+                .map(|snapshot| snapshot.activation_manifest_ref())
+                .or_else(|| plugin.manifest_ref.clone())
+                .ok_or_else(|| {
+                    CliError::Config(format!(
+                        "dynamic plugin '{}' has no manifest_ref in lifecycle state",
+                        plugin.plugin_id
+                    ))
+                })?;
+            let (manifest, _) = DynamicPluginManifest::load_from_path(&manifest_ref)
+                .map_err(|error| CliError::Config(error.to_string()))?;
+            let component = PluginComponentSpec {
+                kind: plugin.plugin_id.clone(),
+                enabled: true,
+                config: plugin.config.clone(),
+            };
+            if manifest
+                .capabilities
+                .items
+                .contains(&DynamicPluginCapability::ExportActivationPolicy)
+            {
+                policy_components.push(component);
+            } else {
+                regular_components.push(component);
+            }
+        }
+        policy_components.append(&mut plugin_config.components);
+        policy_components.append(&mut regular_components);
+        plugin_config.components = policy_components;
         let snapshots = dynamic_plugins
             .iter()
             .filter_map(|plugin| plugin.activation_snapshot.clone())

crates/core/src/api/export_activation.rs

@@ -0,0 +1,70 @@
+// SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+//! Activation-time policy hooks for Relay-managed remote exporters.
+
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::{Arc, LazyLock, RwLock};
+
+use crate::error::{FlowError, Result};
+pub use nemo_relay_types::plugin::{
+    ExportActivationDecision, ExportActivationRequest, ExportActivationTargetKind,
+};
+
+/// Asynchronous callback registered by one export-activation policy provider.
+pub type ExportActivationPolicyFn = Arc<
+    dyn Fn(
+            ExportActivationRequest,
+        ) -> Pin<Box<dyn Future<Output = Result<ExportActivationDecision>> + Send>>
+        + Send
+        + Sync,
+>;
+
+static EXPORT_ACTIVATION_POLICIES: LazyLock<RwLock<HashMap<String, ExportActivationPolicyFn>>> =
+    LazyLock::new(|| RwLock::new(HashMap::new()));
+
+pub(crate) fn register_export_activation_policy(
+    provider: &str,
+    callback: ExportActivationPolicyFn,
+) -> Result<()> {
+    let mut policies = EXPORT_ACTIVATION_POLICIES.write().map_err(|error| {
+        FlowError::Internal(format!(
+            "export activation policy registry lock poisoned: {error}"
+        ))
+    })?;
+    if policies.contains_key(provider) {
+        return Err(FlowError::AlreadyExists(provider.to_string()));
+    }
+    policies.insert(provider.to_string(), callback);
+    Ok(())
+}
+
+pub(crate) fn deregister_export_activation_policy(provider: &str) -> Result<bool> {
+    EXPORT_ACTIVATION_POLICIES
+        .write()
+        .map(|mut policies| policies.remove(provider).is_some())
+        .map_err(|error| {
+            FlowError::Internal(format!(
+                "export activation policy registry lock poisoned: {error}"
+            ))
+        })
+}
+
+pub(crate) async fn evaluate_export_activation_policy(
+    provider: &str,
+    request: ExportActivationRequest,
+) -> Result<ExportActivationDecision> {
+    let callback = EXPORT_ACTIVATION_POLICIES
+        .read()
+        .map_err(|error| {
+            FlowError::Internal(format!(
+                "export activation policy registry lock poisoned: {error}"
+            ))
+        })?
+        .get(provider)
+        .cloned()
+        .ok_or_else(|| FlowError::NotFound(provider.to_string()))?;
+    callback(request).await
+}

crates/core/src/api/mod.rs

@@ -5,6 +5,8 @@
 
 /// Lifecycle event types and builder-backed event constructors.
 pub mod event;
+/// Activation-time policy types for Relay-managed remote exporters.
+pub mod export_activation;
 /// LLM lifecycle helpers and managed execution entry points.
 pub mod llm;
 /// Plugin-neutral evidence recording for managed LLM calls.