Installation, selection, and authorization

  1. A package declares a static Manifest and Python entry point.
  2. A Run selects a concrete plugin instance.
  3. The compiler intersects Manifest requests, Run access, and deployment ceilings into a final binding.

Plugin Host creates an instance only after all three. An installed but unselected package is not imported or started.

Four roles

Role Typical plugins Responsibility
control_producer Rule-based, Model, Teleop, Replay, Agent Read authorized state and submit control chunks
data_consumer Record, evaluation, monitoring Consume events, observations, and outputs
extension Geometry, kinematics, project capabilities Add behavior at a stable service boundary
interface Server, TUI, Debug, MCP Present the same Application to users or systems

A plugin may have multiple roles, but services are still granted individually.

Scoped services

Services include scenario.read, scene, frames, planning geometry, kinematics, observations, control.targets, control, visualization, artifacts/outputs, and run information. Objects are bound to an instance and generation, and are revoked at lifecycle end.

Native backend handles are excluded because they would bypass pause, reset, recording, authorization, and arbitration. Backend-specific behavior must appear through an explicit Provider capability or extension contract.

See Official plugins for the current packages.