ADR-053: Sandboxed Plugin Jobs
Heavy or untrusted plugin compute runs as a credential-free process behind a host-owned job registry.
- Status: Accepted as a protocol; host enqueue adapter not shipped
- Date: 2026-07-19
Context
Long-running or untrusted work does not belong in Convex actions or the web process. Passing arbitrary commands to the existing code worker, however, would turn a plugin payload into remote shell execution.
Decision
The protocol admits data-only jobs whose namespaced kind resolves through a host-controlled own-property registry. No host enqueue adapter is currently shipped. When one lands, the worker chooses the executable and argv; payload data is never interpolated into a shell string. Jobs run as an unprivileged uid with hard time and resource limits, a private workspace, and an environment containing no admin, GitHub, Convex, or LLM credentials.
The host owns claim leases, heartbeat cancellation, retry ceilings, result clamping, and terminal state. Unknown or prototype-inherited job kinds fail before spawn. Any credentialed operation must return through a separately authorized host service.
Consequences
Owlat's protocol can support heavy plugin tasks without executing plugin-selected commands or leaking ambient secrets. The worker image must explicitly register every supported job implementation; the host enqueue adapter is not currently shipped. See Sandboxed Jobs.