# [DEF:Doc.Adr.ADR0016:ADR]
# @STATUS ACCEPTED
# @BRIEF Define the implemented plugin discovery and execution boundary.
# @RELATION SUPERSEDES -> [Doc.Adr.ADR0004:ADR]
# @RELATION BINDS_TO -> [backend/src/core/plugin_loader.py]
# @RELATION BINDS_TO -> [backend/src/core/plugin_base.py]
# @RATIONALE The repository already contains first-party plugins that share the application runtime, configuration, database access patterns, and async Task Manager. The executable contract is `PluginBase`, not an unimplemented manifest or subprocess protocol.
# @REJECTED `plugin.toml` manifests and a mandatory subprocess executor — rejected as the current architecture because neither is the runtime contract implemented by the repository.
# @REJECTED Treating dynamic discovery as a sandbox — rejected because imported plugin code runs in the backend process and has the same process privileges.

## Decision

First-party plugins live in `backend/src/plugins/`. `PluginLoader` discovers Python
modules and package `__init__.py` files in that directory, imports them under the
`src.plugins` package, instantiates subclasses of `PluginBase`, and exposes their
validated `PluginConfig` metadata.

Every discoverable plugin must implement the abstract `PluginBase` contract:

- stable `id`, `name`, `description`, and `version` properties;
- `get_schema()` returning an input schema;
- asynchronous `execute(params)`;
- optional `ui_route` and a permission derived from `required_permission`.

Plugins are trusted, versioned source in this repository. They are not third-party
sandboxed extensions. A future marketplace or untrusted-plugin feature requires a
new ADR that specifies its isolation, permission, resource, and failure model.

## Consequences

- Plugin failures during discovery are logged and do not stop discovery of other
  modules, but execution remains subject to normal backend failure handling.
- Plugin dependencies must be compatible with the backend runtime.
- Adding a plugin requires tests for discovery and its public execution contract;
  it does not require a `plugin.toml` manifest.

# [/DEF:Doc.Adr.ADR0016:ADR]