Hugging Face Jobs plugin needs a typed connector-owned submit/observe/reduce lifecycle operation

Feature request

The installed Hugging Face plugin exposes its Jobs tool with operation-specific args: object<any> and an any return. For asynchronous Jobs, callers then need a provider Job authority for later status and terminal-evidence operations. Recovering that authority by parsing an opaque submission response is brittle and can force private identifiers or raw provider evidence across the tool boundary.

A bounded scalar-only measurement confirmed that a real submission response was valid bounded JSON but contained no eligible stable authority value under a conservative value-only rule. It stopped before inspect or logs, and persisted no raw values, field names, provider identifiers, URLs, paths, tokens, hashes, or logs.

Requested capability

Please add a connector-declared typed capability to the Hugging Face Jobs plugin:

• capability: hf_jobs.submit_observe_reduce.v1
• operation: submit_observe_reduce
• exact typed operation arguments
• exact typed, non-any scalar result

The operation should own submission, Job-authority acquisition, status observation, bounded terminal-evidence reduction, and authority teardown inside one connector invocation. The outer caller should never receive or supply the Job authority.

Authority lifetime

The internal authority lease should be:

• invocation-scoped and connector-owned
• non-serializable, non-exportable, and non-persistable
• unavailable to text, files, environment, shell, arguments, or other tools
• usable only for connector-internal lifecycle operations
• cleared before return on success, failure, timeout, or cancellation

Suggested typed result

An exact 18-field scalar/symbolic result is sufficient:

1. schemaVersion
2. channelID
3. classification
4. capabilityDeclared
5. typedArgsSchemaDeclared
6. typedResultSchemaDeclared
7. submissionAccepted
8. authorityLeaseCount
9. authorityLeaseCleared
10. internalStatusObservationCount
11. terminalStateClass
12. fixedMarkerMatchCount
13. fixedMarkerValid
14. rawEvidenceEscapeCount
15. privateIdentifierEscapeCount
16. providerJobCount
17. retryOrFlavorChangeCount
18. stoppedEarly

Allowlisted terminal classes can be UNRESOLVED, COMPLETED, ERROR, CANCELED, and TIMEOUT. The result should contain counts, booleans, and allowlisted symbols only, with no raw logs, exceptions, identifiers, URLs, paths, tokens, hashes, or binary values.

Acceptance behavior

• fail before submission unless the exact typed args and result schemas are declared
• one submission maximum per invocation
• connector-internal status observation only
• at most one bounded terminal-evidence capture and fixed-marker reduction
• no separate outer inspect or logs operation
• no retry, resubmission, or flavor change
• deterministic fail-closed classifications for lease cardinality, terminal ambiguity, missing/multiple/invalid marker, and evidence escape
• unconditional authority/evidence teardown on every exit

This would make bounded Jobs workflows composable without exposing provider authority or relying on opaque any response parsing.