| Term | Meaning |
|---|---|
| Plugin | A signed .adosplug archive that adds code or UI to ADOS. It has up to two halves, agent and GCS. Operators see installed plugins as Extensions. |
| Extension | The operator-facing name for an installable plugin, used in Mission Control and the agent dashboard. First-party extensions are published from the public ADOSExtensions repo in the same archive format as a third-party plugin. |
| Manifest | The manifest.yaml at the root of the archive. Declares the id, version, halves, permissions and contributions. It carries no asset-hash list; integrity comes from the canonical payload hash in the separate SIGNATURE file. |
| Half | The part of a plugin that runs on one side of the system. The agent half runs on the node and is written in Python or Rust (agent.runtime); the gcs half runs in Mission Control and is written in TypeScript. |
| Slot | A named mount point in the Mission Control UI, such as fc.tab, node.detail.tab, cockpit.widget or flight.skill. The full list is in Contribution points. |
| Capability | A runtime grant derived from a manifest permission the operator granted. Required for every privileged call. |
| Capability token | The signed string that carries a plugin’s granted capabilities on the wire. HMAC-SHA256 under the host’s issuer key, 10-minute lifetime, re-minted by the host. |
| Risk band | low, medium, high or critical. The plugin’s band is the manifest’s declared top-level risk (default medium); each capability also carries its own risk badge in the install dialog. |
| Sandbox | The isolation boundary a half runs inside: a hardened systemd unit and cgroup on the agent, a null-origin iframe on the GCS. |
| Bridge | The host code between a sandbox and the rest of the application. It validates the envelope, resolves the required capability and routes the call to a handler. |
| Bundle | The built JavaScript for the GCS half: a single ESM file the host loads into the iframe from a blob: URL. |
| Entrypoint | What the agent half launches, from agent.entrypoint. Python: module:Class, or a file path such as agent/plugin.py that defines a class Plugin. Rust: a binary path, or bin:<name> resolved through agent.binaries. |
| Vendor binary | A third-party executable or library bundled in the agent half. With agent.contains_vendor_binary: true the manifest must list at least one agent.vendor_attribution entry, or it fails validation. See Vendor binaries. |
| Per-drone plugin | A plugin with agent.per_drone_config: true: one install runs one process per connected drone, each with its own ctx.agent_id and its own config. The default is one process for the node. |
| Permission | A request for one slice of authority, declared in the manifest and granted by the operator. |
| Operator | The person running ADOS. Grants and revokes permissions from the node’s Extensions tab or with ados plugin perms. A grant or revoke takes effect at runtime, with no agent restart. |
| Publisher | Whoever holds the Ed25519 private key a plugin is signed with. |
| Signer id | The name of a publisher key. It is the file stem of the enrolled public key on the agent (<signer-id>.pem) and the first line of the archive’s SIGNATURE file. The first-party signers are altnautica-2026-A and altnautica-2026-B. Create a key with ados plugin keygen <signer-id>. |
| Trust list | The public keys a node accepts, as PEM files under /etc/ados/plugin-keys/, keyed by signer id. See Signing keys. |
| Revocation list | /etc/ados/plugin-revocations.json: signer ids and archive digests the node refuses. See Revocation and incidents. |
| Two-stage install | The install flow: parse returns a manifest preview without writing anything; install commits only after the operator approves the permissions. |
.adosplug | The file extension of a plugin archive: a zip with manifest.yaml at the root and a SIGNATURE entry. |
| PluginContext | The object an SDK hands plugin code. In TypeScript it has telemetry, perception, command, notifications, recording, mission, config, events, records, theme and i18n. The Python and Rust contexts are listed on their SDK pages. |
| PluginHarness | The synthetic host from @altnautica/plugin-sdk/harness. Unit tests push telemetry into the plugin and assert on the calls it made, with no Mission Control running. |
Next steps
Concepts
How the manifest, signature, sandbox and tokens fit together.
Your first plugin
Build and install a working plugin.