Add web-application manifests, scoped plugin instances, immutable releases,
grants, state, artifact limits, and durable cleanup. Preserve current plugin
behavior through an implicit global instance.
In scope
Add ui.web_apps parsing, validation, and JSON projection.
Add safe static-package validation and immutable artifact storage.
Add instance, release, grant, state, reservation, and cleanup-job storage.
Add replayable SQLite and PostgreSQL migrations.
Enforce workspace and installation artifact budgets.
Reconcile missing, changed, and unsafe artifacts before runtime registration.
Add package, storage, cleanup, and content-free metric tests.
Out of scope
Runtime URLs, iframe rendering, browser data routes, and canvas lifecycle.
Acceptance
Invalid packages create no valid release or extracted artifact.
Concurrent byte reservations cannot exceed a storage limit.
A missing or changed retained artifact becomes unavailable before execution.
Verification
cd apps/backend && go test ./internal/plugins/... ./pkg/pluginsdk/... ./internal/persistence/... ./internal/system/backups/...
Files likely touched
apps/backend/internal/plugins/manifest/**
apps/backend/internal/plugins/pkgtar/**
apps/backend/internal/plugins/webapp/**
apps/backend/internal/plugins/instances/**
apps/backend/internal/plugins/state/**
plugin artifact cleanup and storage ownership providers
apps/backend/internal/backendapp/**
Dependencies
Task 01 provides the release gate for all later entry points.
Risks
A path or link error can escape immutable storage.
A count and byte reservation can diverge after a failed transaction.
A database-only restore can leave metadata without artifacts.
Parallelism
sequential
Inputs
Package, instance, artifact, recovery, compatibility, and observability
design sections.
Current manifest, package extraction, storage, backup, and migration tests.
Results
Completed on 2026-08-27. Added ui.web_apps manifest declarations and
validation, including per-app exact HTTPS network_origins, the bounded static
package validator, digest-addressed immutable artifact storage, startup
reconciliation, scoped instance/release/grant records, atomic canvas and
storage admission, and durable cleanup inventory.
The documented plugin, SDK, persistence, and backup package tests pass.
Carlos Florêncio