ADR-049: Plugin Platform Contract

• Status: Accepted
• Date: 2026-07-15

Context

Owlat already had typed registries for transports, agent steps, automations, UI surfaces, and other extension points. Opening them independently would duplicate identity, permission, ordering, and failure rules while making it possible for an extension to bypass a core safety boundary.

Decision

Every plugin exports one data-only manifest through @owlat/plugin-kit. The host captures and validates one deeply frozen snapshot before codegen or composition. Manifest declarations request capabilities; an operator grant and the plugin feature flag are rechecked at each hosted operation.

The platform has three trust tiers:

1. Bundled plugins composed at build time.
2. Connected apps reached through scoped APIs and signed hooks.
3. Sandboxed worker jobs that run host-registered commands without ambient credentials.

Plugins may append work or caution. They cannot replace core checks, manufacture approval, or force a send. Static codegen is the only composition point, and stale or invalid generated output fails the build.

Consequences

Plugin identity, attribution, permissions, flags, budgets, and ordering share one contract. Bundled code is still trusted deployment code rather than a sandbox; operators must use connected apps or workers for code they do not trust. See Plugin Platform for the operational model.