Repository navigation
ADR-0025 M4 — the administrator plugin shelf: ADR-0019 D2 amended, packageType: plugin listings behind manage_platform_settings, install / upgrade / uninstall from Setup through the M2 path, one Installed list with a Kind column #27284
Description
Part of #27108 (M4). Blocked-by: #27124
Filing gate ③ (maintainer ruling). Ruled on #27108 (the ruling comment of 2026-10-28 by session_01J8VVAjRKqdoEYQ4hXxtBuf, item 1): 「插件应该支持从应用市场安装才是合理的」 → 「同意」. ⛔ Not a claim. ⛔ No domain:*: spans packages/spec (listing enum), packages/cloud-connection (proxy and install), ui/ (the shelf); triage sets lanes and may split by lane. The ADR-0019 D2 amendment this card depends on is a Tier H docs/adr/** line the maintainer lands; this card's code must not merge before it.
维护者速读
市场多一个只有 manage_platform_settings 持有者看得到的"插件"货架：浏览 artifact_kind: 'plugin' 的版本，看权限披露与签名，点安装走 M2 的 resolve → 兼容 → 同意 → 下载 → 校验 → 物化 → 登记路径，升级与卸载同样从这里；已安装清单不另开页，现有 Packages 列表加 Kind 列与"装后需重启"状态（M5 落地后热加载的插件不再显示它）。消费者货架仍然只有 App（ADR-0019 D1 不变，D2 修订）。共享环境姿态（group / isolated）不显示此货架（#27108 裁决第 4 项）。
What lands
- Spec:
MarketplaceListingSchema.packageTypeadmitsplugin;CONSUMER_INSTALLABLE_TYPESstays['app']; a newADMIN_INSTALLABLE_TYPES = ['plugin']withisAdminInstallable();packages/spec/src/marketplace/marketplace.zod.tsdocblock rewritten from "onlyappis listable" to the two-shelf statement.Metadata-protocol: nonefor app authors (listing is control-plane data),addedfor the listing enum. - Proxy and install (
packages/cloud-connection): the marketplace proxy passes plugin listings through; install-local's plugin branch calls the M2 install path (os plugin install <id>@<version>semantics) behindmanage_platform_settings, nevermanage_metadataalone; the walled postures refuse with the posture named. - Shelf (
ui/packages/app-shell, Setup → Integrations → Plugins): list, detail (publisher verification, signatures, permissions via the shippedPluginDisclosurewith its "does not yet restrict" sentence already deleted by M2), install with the consent step, upgrade (409 re-consent on widening), uninstall; "restart required" state until M5; honesty states perplatform-core.marketplace-console-honesty. - Installed list: the Packages list gains a Kind column (
app/plugin) and the pending-restart state; no second list ([Decision] Setup's "Packages" and "Installed Apps" disagree about what is installed: one list with a plugin-owned marketplace door, one list replacing both, or two labelled lists? (item 2 of #23803) #23892 / Setup → Packages moves to Studio: drop Setup's nav_packages; Studio keeps the full list, Setup keeps the marketplace "Installed Apps" door (ruling 甲, amends #23892 B) #25098 rulings). - Docs: administrator page for the shelf; the author handbook (docs: a marketplace handbook for app authors — listing metadata, README conventions,
os package publish --submit, review, the customer install experience (credentials, sample data, upgrade, uninstall) and staying current with platform versions #27240) gains the publish-to-shelf section.
Acceptance
- A
manage_platform_settingsholder on a dedicated-runtime environment installs the cloudplugins/connector-stripesample from the shelf, consents to its permissions, sees "restart required", restarts, and the plugin runs; upgrade to a version with wider permissions demands re-consent; uninstall marks pending restart and removes on boot. - A user without the permission does not see the shelf; a
group/isolatedenvironment does not render it and the proxy refuses the install with the posture named. - The consumer marketplace never shows a plugin listing (pin).
Not in M4
Hot attach (M5); third-party tiers and publish-side scans (M3); UI plugins (ADR-0026, Deferred).
Related
#27108 (epic, ruling items 1 and 4) · #27124 (M2) · ADR-0019 D1/D2 · ADR-0025 v2 §3.5 / §3.11 · #23892 / #25098 (one installed list) · #27240 (handbook).
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 28, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 发布并装进一个环境 | platform-core.marketplace-console-honesty | P④
Triage: p1 ·
domain:cloud·area:devpath· parked for the cloud PM · 2026-10-28T15:05Z⛔ Not a claim.
manage_platform_settings. The listing enum admitsplugin, so it is a protocol addition, and p1.triage-duties.md: 「涉 cloud 任一即算」, 「被其阻」): Its listings are control-plane data served by the cloud marketplace, acceptance runs on a dedicated-runtime environment (the hosted face), and it isBlocked-by: #27124(M2,domain:cloud). So the card goes to the cloud PM whole, withdomain:cloudandstatus:parked, and it is not dispatched from this repository. It is not split by lane here: the cloud PM orders it against the rest of [Epic] ADR-0025 plugin package distribution — the next development phase: M0 record v2, M1 local T0 install loop (first-party, self-signed), M2 cloud fetch + per-plugin permission enforcement, M3 third-party sandbox tier #27108.Generated by Claude Code
objectstack-fleet commentedon Oct 28, 2026
Frozen (2026-10-28T16:24Z). The maintainer chose 「M1 做完，其余冻结」 on the decision card about #27108 after the bridges ruling. That ruling is recorded on #27108, and the bridges epic is #27314. This card stays parked and is not dispatched. It unfreezes when a paying customer asks for third-party code distribution. ⛔ Not a claim.
objectstack-fleet commentedon Nov 8, 2026
repo:cloud#2 · os-zhuang · session_0123kRqqdpAJWYMgsgdAJX4G
State · 2026-11-08T02:14Z ·
pm:queue→pm:on-holdThis card was frozen on 2026-10-28 (the Frozen comment above). The maintainer chose 「M1 做完，其余冻结」 on the #27108 decision card, after the bridges ruling (epic #27314). M1 (#27123) closed on 11-01. The freeze lived only in a comment, so a later triage round put the card back in
pm:queue. As a p1 card that would be dispatched, which the ruling does not allow.pm:on-holdis the label that matches the ruling.Restart-when: the maintainer unfreezes ADR-0025 M2 and later on #27108, which happens when a paying customer asks for third-party plugin distribution. On restart the card returns to
pm:queuefor the cloud seat, in milestone order (M2 first).⛔ Not a claim.