[VS-NfD] Add a hard plugins.enabled = false switch #200

New Issue

fable-5 · 2026-07-30T01:43:36+02:00

fable-5 commented

2026-07-30 01:43:36 +02:00

Plan reference: 20-massnahmenplan.md -> Phase 2 (pulled from roadmap)
ADR: ADR 0025
Effort: M (2 AT)
Depends on: —

Context

"Code execution inside the VS zone" is the question a plugin architecture
attracts. A single, verifiable off-switch answers it completely for the
offer stage — much cheaper than the trust machinery in #232, and it is what
the reference configuration will use.

Current state

instance-settings.service.ts provides master switches for the public
API (api.enabled, default false) and MCP (mcp.enabled, default
false) — the enforcement pattern to copy is
apps/api/src/public-api/public-api.guard.ts:64 and
apps/api/src/mcp/mcp.controller.ts:50,84 (404 while disabled).
No equivalent exists for plugins. Plugin state is per pond plus the
installed set; there is no instance-level kill switch.

Acceptance criteria

plugins.enabled (default documented; off in the VS-NfD
reference config) makes every plugin surface answer 404: manifest and
asset routes, the frame route
(/api/v1/plugins/<id>/<version>/frame), install/uninstall, and the
pond-level toggles.
With the switch off, existing plugin blocks in documents render their
declared fallback instead of an error, and the editor offers no
plugin blocks.
Cache note respected: the settings cache is in-process, so the
documented procedure includes an api restart (or the setting is read
uncached) — verified by test or documented explicitly.
Tests: every plugin route 404s while off; a page containing a plugin
block still renders; the switch is visible in the admin UI.
Hardening guide (#227) lists the setting; docs/architecture/plugin-architecture.md
records the switch.

Out of scope

Allowlisting or hash-pinning individual plugins (#232), and removing the
plugin architecture.

**Plan reference:** `20-massnahmenplan.md` -> Phase 2 (pulled from roadmap) **ADR:** ADR 0025 **Effort:** M (2 AT) **Depends on:** — ## Context "Code execution inside the VS zone" is the question a plugin architecture attracts. A single, verifiable off-switch answers it completely for the offer stage — much cheaper than the trust machinery in #232, and it is what the reference configuration will use. ## Current state - `instance-settings.service.ts` provides master switches for the public API (`api.enabled`, default false) and MCP (`mcp.enabled`, default false) — the enforcement pattern to copy is `apps/api/src/public-api/public-api.guard.ts:64` and `apps/api/src/mcp/mcp.controller.ts:50,84` (404 while disabled). - **No equivalent exists for plugins.** Plugin state is per pond plus the installed set; there is no instance-level kill switch. ## Acceptance criteria - [ ] `plugins.enabled` (default documented; **off** in the VS-NfD reference config) makes every plugin surface answer 404: manifest and asset routes, the frame route (`/api/v1/plugins/<id>/<version>/frame`), install/uninstall, and the pond-level toggles. - [ ] With the switch off, existing plugin blocks in documents render their declared `fallback` instead of an error, and the editor offers no plugin blocks. - [ ] Cache note respected: the settings cache is in-process, so the documented procedure includes an api restart (or the setting is read uncached) — verified by test or documented explicitly. - [ ] Tests: every plugin route 404s while off; a page containing a plugin block still renders; the switch is visible in the admin UI. - [ ] Hardening guide (#227) lists the setting; `docs/architecture/plugin-architecture.md` records the switch. ## Out of scope Allowlisting or hash-pinning individual plugins (#232), and removing the plugin architecture.

fable-5 added this to the M25 — VS-NfD: hardening & supply chain milestone 2026-07-30 01:43:36 +02:00

fable-5 added the

area:supply-chain

vs-nfd

effort:M

labels 2026-07-30 01:43:36 +02:00

fable-5 referenced this issue

2026-07-30 01:43:56 +02:00

[VS-NfD] Write the hardening guide with a "VS-NfD operation" reference configuration #227

fable-5 referenced this issue

2026-07-30 01:43:59 +02:00

[VS-NfD] Add a plugin allowlist with SHA-256 hash pinning #232

fable-5 referenced this issue

2026-07-30 11:59:31 +02:00

[VS-NfD] Define the deployment hardening-profile mode and the machine-readable VS-NfD configuration catalog #243

fable-5 referenced this issue from a commit

2026-07-31 04:42:44 +02:00

#200: hard instance-wide plugins.enabled kill switch

fable-5 referenced this issue

2026-07-31 04:42:59 +02:00

#200: hard instance-wide plugins.enabled kill switch #260

fable-5 referenced this issue

2026-07-31 04:51:21 +02:00

#201: stable audit event catalogue for syslog/SIEM export #261

fable-5 commented

2026-07-31 05:00:14 +02:00

Implemented in PR #260 (commit c4c84b3, CI run 525 green, fast-forward merged per Stefan's standing go-ahead for the M25 block).

Evidence against the acceptance criteria:

plugins.enabled (instance setting, default ON documented - plugins predate the switch; the VS-NfD reference configuration turns it off): a shared PluginsEnabledGuard makes every plugin surface answer 404 - admin install/list/mode, pond plugin list + activation toggles, sandbox frame route and asset routes; the dropzone watcher quarantines drops instead of installing (plugins_disabled).
Existing blocks render their declared fallback: the authenticated fallback-metadata route stays alive by design (serves no plugin code); an image fallback degrades to the neutral placeholder while off (its bytes live on the disabled asset surface - in the reference config nothing is installed, so nothing degrades). The editor offers no plugin blocks because the pond plugin list is one of the 404ing surfaces.
Cache note respected: settings cache is in-process; the admin UI hint documents the api restart, and the in-process flip is asserted by the settings-PATCH test.
Tests (plugins.e2e.db.test.ts, kill-switch describe): every route 404 even for a Site Admin, declared fallback still readable, dropzone quarantine, switch flip via /admin/settings visible in the admin surface. Full api suite green (480); i18n de+en.
Docs: plugin-architecture.md (Lifecycle section records the switch); hardening-guide listing recorded on #227.

CD verification follows on the main-push run.

Implemented in PR #260 (commit c4c84b3, CI run 525 green, fast-forward merged per Stefan's standing go-ahead for the M25 block). Evidence against the acceptance criteria: - plugins.enabled (instance setting, default ON documented - plugins predate the switch; the VS-NfD reference configuration turns it off): a shared PluginsEnabledGuard makes every plugin surface answer 404 - admin install/list/mode, pond plugin list + activation toggles, sandbox frame route and asset routes; the dropzone watcher quarantines drops instead of installing (plugins_disabled). - Existing blocks render their declared fallback: the authenticated fallback-metadata route stays alive by design (serves no plugin code); an image fallback degrades to the neutral placeholder while off (its bytes live on the disabled asset surface - in the reference config nothing is installed, so nothing degrades). The editor offers no plugin blocks because the pond plugin list is one of the 404ing surfaces. - Cache note respected: settings cache is in-process; the admin UI hint documents the api restart, and the in-process flip is asserted by the settings-PATCH test. - Tests (plugins.e2e.db.test.ts, kill-switch describe): every route 404 even for a Site Admin, declared fallback still readable, dropzone quarantine, switch flip via /admin/settings visible in the admin surface. Full api suite green (480); i18n de+en. - Docs: plugin-architecture.md (Lifecycle section records the switch); hardening-guide listing recorded on #227. CD verification follows on the main-push run.

fable-5 closed this issue

2026-07-31 05:00:14 +02:00

fable-5 referenced this issue

2026-07-31 05:00:15 +02:00

[VS-NfD] Write the hardening guide with a "VS-NfD operation" reference configuration #227

Sign in to join this conversation.