docs: plugin distribution design (ADR-0025/0026 + design doc)#1428
Merged
Conversation
Design the publish and install flow for code plugins (vs. the existing metadata-only JSON package flow): - .osplugin signed artifact format + compiled objectstack.plugin.json manifest (adds engines/runtime/permissions/integrity blocks) - build -> sign -> publish pipeline extending os package publish, storing both browsable JSON metadata and the binary artifact blob - permissioned install flow: resolve -> compat -> consent -> verify -> materialize -> register -> load - trust/isolation tiers (in-process / QuickJS sandbox / out-of-process) reusing the existing loader, permission enforcer, and sandbox - bundled-default packaging (no npm at install time); manifest-deps opt-in - unifies packages and plugins: a pure-element package is the degenerate plugin (empty dist, no permissions) https://claude.ai/code/session_01DRww7tXjCVdqXsHtv5gDq6
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
ADR-0025 §3.10 scenario-review refinements: - default-deny trust: T0 in-process reserved for verified publishers, third-party defaults to sandbox/worker, enforced at publish - externalize @objectstack/* as host-provided peer-dep singletons (bundling forks the engine) - protocol-first compatibility gating over platform semver - plugin permissions compose with object/field-level RLS - secrets via settings/KV store (ADR-0007), never in the artifact - connectors span declarative (OpenAPI/MCP) + code-plugin sub-paths - explicit three-layer model (L0 JSON / L1 sandboxed-script / L2 code) ADR-0026 (new): client-side UI plugin distribution - runtime:'ui' variant of .osplugin reusing the ADR-0025 backbone - two-tier loading: U0 in-app module (verified) / U1 iframe sandbox (third-party default) with postMessage RPC + per-plugin CSP - server-authoritative data (RLS-gated) so client grants can't bypass server permissions https://claude.ai/code/session_01DRww7tXjCVdqXsHtv5gDq6
os-zhuang
changed the title
…ution design - ADR-0025 §3.11: reconcile with ADR-0019 (App is the only consumer-facing unit). The .osplugin pipeline serves developers/operators, not consumers; plugins reach a tenant bundled inside an App or operator-provisioned. Two catalogs (consumer App Marketplace vs developer/operator contribution catalog) over one signed sys_* backbone. This ADR builds the L2-sandbox + enforcer 'load-bearing wall' that ADR-0019 named as the prerequisite for any future self-serve code marketplace — it does not open that gate. - ADR-0026 §3.7: same reconciliation for UI plugins (ship inside Apps or operator-provisioned; never consumer-browsed). - New docs/design/plugin-distribution.md: supply-side companion to marketplace-publishing.md. Operationalizes ADR-0025/0026 into the three distribution layers (L0/L1/L2), a scenario-driven contribution catalog, build/sign/publish, install/load, trust tiers, security, lifecycle, and worked examples. - marketplace-publishing.md: cross-link to the companion design. Docs only; no package or runtime changes. https://claude.ai/code/session_01DRww7tXjCVdqXsHtv5gDq6
os-zhuang
changed the title
xuyushun441-sys
pushed a commit
that referenced
this pull request
Jun 1, 2026
feat(app-shell): FlowRunner — render & resume interactive screen-flows (#1428) objectui@7130d4efe23926347a1c8df3a5674fa3336931a2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Design docs for distributing code-bearing marketplace contributions (plugins with npm deps, drivers, connectors, AI extensions, client UI plugins), alongside the existing pure-element / metadata-only JSON package flow. Docs only — no code or schema changes.
.ospluginartifact, build→sign→publish, permissioned install, trust/isolation tiers.runtime:'ui'variant reusing the ADR-0025 backbone (field renderers / view types / widgets in the browser).docs/design/plugin-distribution.md— supply-side companion to the existingmarketplace-publishing.md: operationalizes the ADRs into layers, a scenario catalog, and workflows.Why
Pure-element packages compile to JSON and publish/install trivially because nothing executes. Code contributions carry executable code + deps, so distribution must additionally solve build/bundling, dependency handling, trust/security, and version compatibility. The repo already has the authoring half (
packages/plugins/*, microkernelplugin-loader,PluginPermissionEnforcer, QuickJS sandbox,sys_*schema); these docs design the missing distribution layer on top.ADR-0025 key decisions
.ospluginartifact + compiledobjectstack.plugin.json(addsengines/runtime/permissions/integrity).os package publish; registry stores browsable metadata and the binary blob (sys_plugin/sys_plugin_version/sys_plugin_installation).manifest-depsopt-in.Scenario-review refinements (§3.10)
@objectstack/*as host-provided peer-dep singletons (bundling forks the engine).ADR-0026 key decisions
runtime:'ui'.osplugin(browser ESM bundle registering field/view/widget extensions).Reconciliation with ADR-0019 (important)
ADR-0019 makes the App the only consumer-facing unit; plugins/drivers/UI/themes are internal contributions a consumer never installs directly. These docs (ADR-0025 §3.11, ADR-0026 §3.7) reconcile explicitly:
type: app) vs developer/operator contribution catalog — same signedsys_*registry + artifact storage.Scope
Design/ADRs + one design doc only. Phasing in each doc's §4. Builds on ADR-0003/0004/0007/0010/0016/0019/0022/0023/0024.
https://claude.ai/code/session_01DRww7tXjCVdqXsHtv5gDq6