#200: hard instance-wide plugins.enabled kill switch #260

Merged

fable-5 merged 1 commits from feat/200-plugins-kill-switch into main 2026-07-31 04:59:57 +02:00

Conversation 0 Commits 1 Files Changed 13 +238 -5

fable-5 commented 2026-07-31 04:42:59 +02:00

Collaborator

Copy Link

Stacked on #259 (#199) -> #258 (#202). Issue #200 (ADR 0025).

• plugins.enabled (default ON — plugins predate the switch; VS-NfD reference config turns it off): a shared PluginsEnabledGuard 404s every plugin surface — admin install/list/mode, pond list + activation toggles, sandbox frame and asset routes. The dropzone watcher quarantines drops instead of installing (plugins_disabled).
• Deliberately NOT guarded: the authenticated fallback-metadata route (no plugin code; existing blocks render their declared fallback with it — an image fallback degrades to the neutral placeholder while off, its bytes live on the disabled asset surface; in the reference config nothing is installed, so nothing degrades).
• Editor offers no plugin blocks (pond plugin list 404s; consumers treat it as empty). Admin settings panel gets the toggle with i18n de+en and the api-restart note (in-process settings cache — cache semantics asserted by the settings-PATCH flip test in-process).
• Tests (in plugins.e2e.db.test.ts, same file as the registry-wiping install suite to avoid a parallel-file race): every surface 404 even for a Site Admin, declared fallback still readable, dropzone quarantine, switch flip via /admin/settings. Full api suite green (480); i18n:check green.
• Docs: plugin-architecture.md (Lifecycle section); plan checkbox. #227 hardening-guide note follows as issue comment after merge.

Stacked on #259 (#199) -> #258 (#202). Issue #200 (ADR 0025). - `plugins.enabled` (default ON — plugins predate the switch; VS-NfD reference config turns it off): a shared `PluginsEnabledGuard` 404s every plugin surface — admin install/list/mode, pond list + activation toggles, sandbox frame and asset routes. The dropzone watcher quarantines drops instead of installing (`plugins_disabled`). - Deliberately NOT guarded: the authenticated fallback-metadata route (no plugin code; existing blocks render their declared fallback with it — an image fallback degrades to the neutral placeholder while off, its bytes live on the disabled asset surface; in the reference config nothing is installed, so nothing degrades). - Editor offers no plugin blocks (pond plugin list 404s; consumers treat it as empty). Admin settings panel gets the toggle with i18n de+en and the api-restart note (in-process settings cache — cache semantics asserted by the settings-PATCH flip test in-process). - Tests (in plugins.e2e.db.test.ts, same file as the registry-wiping install suite to avoid a parallel-file race): every surface 404 even for a Site Admin, declared fallback still readable, dropzone quarantine, switch flip via /admin/settings. Full api suite green (480); i18n:check green. - Docs: plugin-architecture.md (Lifecycle section); plan checkbox. #227 hardening-guide note follows as issue comment after merge.

fable-5 added 3 commits 2026-07-31 04:42:59 +02:00

#202: SBOM and license report in CI ... d3289b2167

The release run now generates CycloneDX 1.6 SBOMs with a pinned
anchore/syft container — one per released image (scanned from the
freshly built image tar, OS packages included) and one for the pnpm
workspace (from the lockfile) — plus the full pnpm licenses report, and
attaches everything as build artefacts BEFORE publishing the release,
so a red gate stops the release. Runner constraints dictated the
mechanics (documented in the workflow): the job talks to the HOST
daemon, so files travel into the syft container via docker cp and
images via docker save to a tar copied the same way (syft cannot read
a tar from stdin — verified).

scripts/check-licenses.mjs is the documented license policy: permissive
allowlist, MPL-2.0/CC-BY-4.0 with recorded reasoning, per-package
exception table (khroma: MIT text shipped, metadata missing). CI runs
the gate on every PR (pnpm licenses:check); positive and negative case
tested locally, both SBOM paths tested against real images/lockfile.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#199: SHA-256 integrity hashes for attachments ... 74970f6073

Every upload stores the SHA-256 of its bytes, computed from the
in-memory buffer that is written — never by re-reading disk. Every
download re-hashes the stored object BEFORE the first byte leaves
(memory bounded by the max_file_bytes quota that gated the upload) and
fails closed on mismatch with attachment_integrity_failure; the
mismatch lands in the audit trail as file.integrity_failed with both
hashes. Detection of payload manipulation is the one integrity duty
par. 52 VSA leaves with the application — only it knows what the file
should be.

Pre-#199 rows are hashed by a bounded, idempotent backfill that rides
the existing nightly orphan-file-sweep job (no new scheduler job, job
fence untouched); unreadable files are logged and retried, never
silently skipped, and null-hash rows are served unverified only until
the backfill reaches them. Operator runbook note in security.md
(restore from backup, re-download, audit entry carries both hashes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

#200: hard instance-wide plugins.enabled kill switch ... c4c84b33f9

plugins.enabled (instance setting, default on — plugins predate the
switch; the VS-NfD reference configuration turns it off) makes every
plugin surface answer 404 via a shared guard: Site-Admin
install/list/mode, pond activation and plugin list, the sandbox frame
and asset routes. The dropzone watcher quarantines drops instead of
installing. Deliberately NOT guarded: the authenticated
fallback-metadata route — it serves no plugin code and existing
plugin_block nodes need it to render their declared fallback (an image
fallback degrades to the neutral placeholder while off, because its
bytes live on the disabled asset surface). The editor offers no plugin
blocks because the pond plugin list is one of the 404ing surfaces.
Admin settings panel gets the toggle (i18n de+en) with the documented
api-restart note (in-process settings cache).

Answers "code execution inside the zone?" with one verifiable
off-switch instead of per-plugin trust machinery (#232, ADR 0025).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 referenced this pull request 2026-07-31 04:51:21 +02:00

#201: stable audit event catalogue for syslog/SIEM export #261

fable-5 merged commit c4c84b33f9 into main 2026-07-31 04:59:57 +02:00

fable-5 referenced this pull request 2026-07-31 05:00:14 +02:00

[VS-NfD] Add a hard `plugins.enabled = false` switch #200

fable-5 referenced this pull request 2026-07-31 05:00:15 +02:00

[VS-NfD] Write the hardening guide with a "VS-NfD operation" reference configuration #227

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

area:auth

  

area:docs

  

area:export

  

area:ops

  

area:storage

  

area:supply-chain

  

auth

Authentication, permissions, quotas

  

backend

API server (apps/api)

  

blocked

Blocked on external dependency/infrastructure

  

collab

Collaboration server (apps/collab)

  

deployment

Docker, CI/CD, hosting

  

docs

Documentation

  

effort:L

  

effort:M

  

effort:S

  

frontend

SPA (apps/web)

  

plugins

Plugin system and SDK

  

qa

Tests, fixtures, e2e

  

vs-nfd

  

vs-nfd:blocker

No Label

area:auth

area:docs

area:export

area:ops

area:storage

area:supply-chain

auth

backend

blocked

collab

deployment

docs

effort:L

effort:M

effort:S

frontend

plugins

qa

vs-nfd

vs-nfd:blocker

Milestone

Clear milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

No Assignees

1 Participants

Notifications

Subscribe

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stwaidele/dorfteich#260

No description provided.