ADR 0007: Module system — data-only manifests, signed code, two-stage install

Status: Accepted

Date: 2026-07-19

Context

Modules must be installable/enableable/configurable/upgradable/uninstallable without turning the admin panel into remote code execution.

Decision

• PlatformModuleManifest (see packages/module-sdk) is data-only and validated at build/install time: id, version, platformRange, dependencies, capabilities, permissions, settings, featureFlags, entitlements, navigation, adminResources, blocks, events published/consumed, jobs, webhooks, healthChecks, dataClassification.

• Executable registrations (routes, services, block renderers) come from signed, trusted packages in the deployment — never uploaded at runtime.

• Two stages: platform-wide install (code + migrations exist) is separate from tenant-level enable (tenant may use it). Admins enable deployed modules; they cannot deploy code.

• Lifecycle: install → enable → configure → disable → upgrade → uninstall (uninstall requires impact preview + export/retention choice + explicit destructive confirmation).

• Cross-module collaboration uses public service contracts or events; importing another module's private implementation is a boundary violation.

Consequences

• A tenant admin can never hot-load arbitrary code.

• Compatibility is machine-checked (manifest semver ranges + CI matrix).