Requirements
A plugin MUST be expressed as declarative data — the service, its capabilities, its wiring, its recipes, its declared secrets and overrides, and its proofs — never as executable code.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/carried.rs
- cited by
- lemonfiber@899d58744dlemonfiber@172a24e1b2
Every manifest MUST be validated against a published schema before lemonfiber acts on it, and a non-conforming manifest MUST be rejected outright.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/carried.rs
- cited by
- lemonfiber@687d9be304lemonfiber@172a24e1b2
A plugin's declared proofs MUST be runnable by the existing verification engine, the same way the bundled proofs are run.
A plugin whose declared proofs do not pass MUST NOT be installed.
A declared proof that cannot be run MUST be reported as unproven and MUST NOT be treated as passed.
Contributed code MUST NOT be executed, and no opt-in, sandbox or capability grant may make it executable.
Arbitrary native plugins MUST NOT be a supported extension mechanism.
A referenced image MUST be named by an immutable digest, and one named by tag alone MUST be refused.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/carried.rs
- cited by
- lemonfiber@172a24e1b2
The manifest schema MUST be validated in the catalogue's CI so malformed contributions are caught before merge.
A manifest MUST review as a readable diff, with no opaque or obfuscated content required to understand what it does.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/carried.rs
- cited by
- lemonfiber@8254d2b85alemonfiber@172a24e1b2
A plugin MUST NOT reach beyond what its manifest declares, and one that over-reaches MUST be rejected rather than confined.
A plugin's provenance MUST be verifiable rather than taken on trust.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/carried.rs
- cited by
- lemonfiber@172a24e1b2
Fetching, validating, rehearsing and proving a plugin MUST each be reachable non-interactively with a meaningful exit status.
A plugin that conflicts with the bundled topology MUST surface the conflict at validation rather than silently overriding it.
- F3-R15withdrawn
Withdrawn — carried to F8-R1 when recipes became their own feature. The number is not reused.
- locked by
- no version locks it yet
- F3-R16withdrawn
Withdrawn — carried to F8-R10 when recipes became their own feature. The number is not reused.
- locked by
- no version locks it yet
Every secret a plugin will hold MUST be declared in its manifest, and capturing an undeclared value MUST fail validation.
Every bundled thing a plugin will override MUST be declared in its manifest, and changing an undeclared one MUST fail validation.
- F3-R19withdrawn
Withdrawn — carried to F8-R11 when recipes became their own feature. The number is not reused.
- locked by
- no version locks it yet
- F3-R20withdrawn
Withdrawn — carried to F8-R12 when recipes became their own feature. The number is not reused.
- locked by
- no version locks it yet
A manifest MUST declare the capabilities it requires of lemonfiber, and an unmet requirement MUST be refused by naming the capability rather than a version.
Manifest validation MUST report every violation in one pass, each named with its location.
A plugin MUST NOT supply a container definition, and lemonfiber MUST generate one from what the plugin declares.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/plugin/container.rs
- cited by
- lemonfiber@899d58744dlemonfiber@5403cacdb0
What a plugin's service may reach of the machine MUST be fixed by lemonfiber rather than chosen by the plugin — no mount beyond the data root and its own configuration directory, no device, no kernel capability, no network mode, no privileged container and no user override — and a manifest asking for any of them MUST be refused by name.
Where a registry offers a signature for a referenced image it MUST be verified, and one that does not verify MUST be refused. Where none is offered the image MUST be reported as unproven, and an unproven image MUST NOT be reported as verified.
- locked by
- 0.16.0 unmarked
- recorded partial
- lemonfiber
- cited by
- lemonfiber@899d58744dlemonfiber@93dd368b75
A plugin MAY declare contributions to lemonfiber's own behaviour, and every contribution MUST be data an engine lemonfiber already runs interprets, in that engine's existing vocabulary. A contribution that would require an interpreter lemonfiber does not already have MUST NOT be declarable.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/contributed.rs
- cited by
- lemonfiber@57edbd54c8
A declared contribution MUST be run or rendered by that engine exactly as its bundled entries are — the same evaluation, the same verdicts, the same bounds — and MUST be attributed to the plugin that declared it wherever it appears.
A declared contribution that cannot be run or rendered MUST be reported as unrun, naming it and the plugin, and MUST NOT be reported as passed, as satisfied, or by being omitted.
A contributed remedy MUST be text in the error model's shape, rendered and never executed; a contribution that would act on the operator's system MUST be refused as a remedy and MUST be declared as a recipe or not at all.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/doctor/contributed.rs
- cited by
- lemonfiber@57edbd54c8
A plugin's contributions MUST be withdrawn when the plugin is removed, and lemonfiber with no plugin installed MUST answer exactly as it does with none ever declared.
An installed plugin's service MUST be reachable through the stack's own proxy and visible on its dashboard on the same terms as a bundled service in the same binding tier, written by lemonfiber from what the manifest declares; a plugin MUST NOT supply that wiring, and MUST NOT be able to obtain it for a service bound to loopback.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/plugins/occupied.rscrates/lemonfiber/tests/architecture/nothing_here_runs_what_somebody_sent.rscrates/lemonfiber-core/src/plugin/fronting.rscrates/lemonfiber-core/src/region.rscrates/lemonfiber-core/src/journal.rscrates/lemonfiber-core/src/app/bounded.rs
- cited by
- lemonfiber@899d58744dlemonfiber@9fd0586162lemonfiber@604aa970e0
A plugin's service MUST be able to declare where inside its container its one configuration directory is mounted, so that an image keeping its state somewhere other than the conventional path is installable without its state being left unmounted.
A plugin's contributions MUST be declared in its manifest, each naming the published extension point it is made at and carrying exactly the row that point declares, and a row missing a required field or carrying one outside the point's set MUST be refused naming the field and the point.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/extension-points.jsoncontract/plugin-manifest.schema.json
- cited by
- lemonfiber@553353f26e
Every contributed check MUST carry at least one contributed remedy, and one declared without a remedy MUST be refused naming the check.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/extension-points.jsoncontract/plugin-manifest.schema.json
- cited by
- lemonfiber@553353f26e
A recipe MUST be declarable in the manifest and statically checkable without being run, and a manifest declaring one MUST require the capability that runs it by name, so that a lemonfiber which cannot run recipes refuses the manifest by naming that capability rather than by ignoring the block.