opencode/picoclaw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(plugin): prefer subprocess rpc over go .so plugins

Browse source
This commit is contained in:
xj 2026-02-22 19:07:23 -08:00
parent d8cca6810a
commit 5680f69e8b
1 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
docs/design/plugin-system-roadmap.md
View file

@ -23,6 +23,7 @@ Compatibility:
- No remote plugin marketplace/distribution - No remote plugin marketplace/distribution
- No plugin sandboxing model - No plugin sandboxing model
- No stable external plugin ABI yet - No stable external plugin ABI yet
- No Go `.so` plugin loading as default direction
## Phase Plan ## Phase Plan
@ -78,12 +79,26 @@ Exit criteria:
Goal: support runtime-loaded plugins only if security and operability are acceptable. Goal: support runtime-loaded plugins only if security and operability are acceptable.
Preferred direction:
- Runtime plugins run as subprocesses.
- Host and plugin communicate via RPC/gRPC.
- Host manages lifecycle (spawn/health/timeout/restart), not in-process dynamic loading.
Why this direction:
- Go native `.so` plugin loading has strict toolchain/ABI coupling with host binary.
- Subprocess RPC model reduces coupling and improves fault isolation.
- Process boundary provides a cleaner place for permissions and sandbox controls.
Preconditions: Preconditions:
- Threat model approved - Threat model approved
- Signature/trust model defined - Signature/trust model defined
- Sandboxing and permission boundaries defined - Sandboxing and permission boundaries defined
- Rollback and safe-disable behavior validated - Rollback and safe-disable behavior validated
- Versioned RPC handshake and capability negotiation defined
- Process supervision policy defined (timeouts, retries, crash loop backoff)
Until then, compile-time registration remains the recommended model. Until then, compile-time registration remains the recommended model.