Plugin Manager

Overview

Plugin Manager is Performance Scoring’s framework for safely extending the platform with approved plugins.

It allows Performance Scoring and approved development partners to build additional functionality without permanently hard-coding every new feature directly into the core application.

Plugins can add functionality such as:

• New pages and routes
• User interface elements
• APIs
• Webhooks
• Event and hook integrations
• Plugin-specific settings
• Plugin-owned data
• Approved menu and profile additions
• Other explicitly supported extension points

Plugin Manager also controls where each plugin is available, allowing functionality to be enabled or disabled by both Brand and Organization.

Why Plugin Manager Exists

Performance Scoring supports multiple Brands, Organizations, customers, use cases, and private-label environments.

Not every customer needs every feature.

Before Plugin Manager, specialized functionality could require changes directly inside the main Performance Scoring application. That makes customized functionality harder to isolate, test, upgrade, or maintain.

Plugin Manager creates a controlled extension layer.

Instead of changing the core application for every specialized requirement, approved functionality can be developed as a plugin and connected to Performance Scoring through defined extension points.

This provides several benefits:

• Faster development of specialized functionality
• Cleaner separation between core features and customer-specific extensions
• Better support for private-label partners
• Safer testing and deployment
• Independent plugin versioning
• Brand- and Organization-specific feature control
• Reduced risk of unrelated functionality affecting the core platform

What Is a Plugin?

A Performance Scoring plugin is an independently maintained software package that extends the Performance Scoring application through approved Plugin Manager interfaces.

Plugins are Laravel-compatible packages and are installed through Performance Scoring’s controlled deployment process.

Plugins are not downloaded or installed directly by customers or administrators.

For a plugin to operate inside Performance Scoring, it must first be:

1. Developed by an approved source.
2. Packaged according to Plugin Manager standards.
3. Reviewed and approved.
4. Installed through Performance Scoring’s deployment pipeline.
5. Successfully validated by Plugin Manager.
6. Enabled for the appropriate Brand or Organization.

Plugin Manager Is Not a Public Marketplace

Plugin Manager is intentionally a trusted plugin ecosystem.

It is not an open app store or public plugin marketplace.

Plugins may currently be created by:

• Performance Scoring internal development teams
• Approved Performance Scoring development partners
• Approved private-label development teams

Unreviewed third-party plugins cannot simply be uploaded and executed inside Performance Scoring.

This protects the security, stability, and integrity of the platform.

What Plugins Can Do

Plugin Manager supports approved extension capabilities including:

Routes

Plugins can expose their own approved application routes and pages.

Controllers

Plugins may contain controllers responsible for their own application logic.

Views

Plugins can provide their own user interfaces and Blade views.

APIs

Plugins can expose approved application programming interfaces.

Webhooks

Plugins can receive or process authenticated webhook events through the Plugin Manager framework.

Events and Hooks

Plugins can subscribe to supported Performance Scoring events or interact through defined hooks.

UI Contributions

Plugins may insert functionality into approved areas of Performance Scoring.

Examples include:

• Profile menus
• Profile status areas
• Approved navigation areas
• Defined application extension points

Plugins cannot arbitrarily rewrite or replace unrestricted parts of the Performance Scoring interface.

Plugin-Owned Data

Plugins may maintain their own data when that data follows Performance Scoring’s tenant isolation requirements.

Settings

Plugins can maintain plugin-specific configuration and settings when supported by the plugin.

Example: Work Status

Work Status is the first full reference implementation created using Plugin Manager.

Work Status allows users to select statuses such as:

• Available
• Working from Home
• Working Elsewhere
• Out of the Office

The purpose of Work Status is larger than the feature itself.

It demonstrates how a plugin can:

• Exist as an independent package
• Be installed through Performance Scoring’s deployment process
• Register approved UI contributions
• Store tenant-aware plugin data
• Respect Brand and Organization activation
• Participate in the application’s runtime
• Be versioned independently
• Be safely enabled or disabled

Work Status should therefore be viewed as an example of what Plugin Manager can support, rather than the definition of Plugin Manager itself.

Accessing Plugin Manager

Plugin Manager is an administrative tool.

Authorized Performance Scoring support or administrative personnel can access the Plugin Manager administration screen.

The screen displays installed plugins and provides information about:

• Plugin name
• Installed version
• Validation status
• Approval status
• Supported capabilities
• Brand activation
• Organization activation
• Diagnostics

Understanding Plugin Status

Each plugin can display several status indicators.

Valid

Valid means Plugin Manager successfully discovered and validated the plugin.

The plugin’s package and manifest meet the requirements necessary for Plugin Manager to use it.

Blocked

Blocked means Plugin Manager detected a validation or trust problem.

A blocked plugin cannot be activated until the problem is resolved.

Possible causes can include:

• Invalid manifest
• Unapproved package
• Incorrect package identity
• Unsupported capability
• Invalid service provider
• Package/version mismatch
• Deployment validation failure

Approved

Approved means the plugin package is from a source approved by Performance Scoring.

Approval does not automatically enable the plugin for customers.

A plugin must still be activated for the appropriate Brand or Organization.

Brand Activation

Plugin Manager allows a plugin to be enabled or disabled at the Brand level.

A Brand setting acts as the default for Organizations associated with that Brand.

For example:

Performance Scoring Brand

Plugin: Example Plugin
Brand Activation: Enabled

Unless an Organization override exists, Organizations using that Brand will inherit the enabled state.

Organization Overrides

Individual Organizations can override their Brand’s plugin setting.

Organization settings have higher priority than Brand settings.

An Organization can be set to:

• Enabled
• Disabled
• Inherit Brand

Activation Precedence

Plugin Manager resolves activation in the following order:

1. The plugin must exist in the deployed application.
2. The plugin must be approved.
3. The plugin must successfully pass validation.
4. The Brand setting is evaluated.
5. An Organization override is evaluated.
6. If an Organization override exists, it takes precedence over the Brand setting.

Example 1

Brand: Enabled
Organization: Inherit Brand

Result: Enabled

Example 2

Brand: Enabled
Organization: Disabled

Result: Disabled

Example 3

Brand: Disabled
Organization: Enabled

Result: Enabled

Example 4

Brand: Disabled
Organization: Inherit Brand

Result: Disabled

Default Plugin Behavior

Plugins are disabled by default unless they have been explicitly enabled.

This is intentional.

Installing a plugin into the Performance Scoring application does not automatically expose the plugin to customers.

Installation and activation are separate actions.

What “Remove Override” or “Inherit Brand” Means

Selecting Inherit Brand removes the Organization-specific activation decision.

The Organization then follows the setting configured for its Brand.

Similarly, where Plugin Manager allows a Brand override to be removed, the explicit Brand activation record is removed and the framework returns to its default behavior.

Plugin Runtime Protection

Plugin Manager uses a fail-closed security model.

If a plugin is:

• Missing
• Invalid
• Blocked
• Unapproved
• Disabled for the current Brand
• Disabled for the current Organization

Plugin Manager prevents the plugin’s functionality from being exposed.

This applies to plugin routes as well as approved UI contributions.

A disabled or unavailable plugin route may intentionally return Not Found rather than exposing information about the plugin’s installation or activation state.

UI Extension Points

Plugins do not receive unrestricted access to modify the Performance Scoring interface.

Instead, Performance Scoring provides approved UI extension points.

A plugin can register content with one of these supported surfaces.

For example, the Work Status reference plugin uses approved profile-related UI surfaces.

This approach allows Performance Scoring to extend the application while preserving:

• UI consistency
• Security boundaries
• Maintainability
• Upgrade compatibility

Additional extension points can be introduced as the Plugin Manager framework evolves.

Plugin Discovery

Plugin Manager automatically discovers approved plugin packages installed in the application.

During discovery, Plugin Manager examines the plugin’s package and manifest information.

Plugin discovery determines whether the plugin:

• Is installed
• Is approved
• Has a valid manifest
• Uses supported capabilities
• References valid providers
• Meets Plugin Manager requirements

Only valid plugins are available for activation.

Diagnostics

The Plugin Manager administration screen includes a Diagnostics section.

Diagnostics displays plugin discovery or validation problems.

If everything is functioning correctly, Plugin Manager displays:

No discovery errors.

If a plugin has a problem, Diagnostics displays the associated error code and explanation.

Refresh Discovery

The Refresh Discovery control causes Plugin Manager to re-evaluate installed plugins.

Use Refresh Discovery after:

• A plugin deployment
• A plugin configuration change
• Resolving a plugin validation problem
• Troubleshooting unexpected Plugin Manager behavior

Troubleshooting Plugin Manager

A Plugin Cannot Be Enabled

Confirm that the plugin shows:

• Valid
• Approved

If the plugin displays Blocked, review the Diagnostics section.

Blocked plugins cannot be activated until the validation problem is resolved.

A Plugin Works for One Organization but Not Another

Check both:

1. Brand activation
2. Organization override

Organization settings take precedence over Brand settings.

A Plugin Page Returns Not Found

This can be expected behavior.

Plugin routes intentionally fail closed when the plugin is:

• Unavailable
• Invalid
• Not approved
• Disabled for the current Brand
• Disabled for the current Organization

Check Plugin Manager activation settings before treating the Not Found response as an application error.

Organizations Are Missing From the List

Plugin Manager displays active Organizations associated with the selected Brand.

Confirm:

• The correct Brand is selected.
• The Organization is active.
• The Organization belongs to the expected Brand environment.

Engineering Diagnostics

If administrative troubleshooting does not resolve a problem, Engineering can run:

php artisan plugins:discover --refresh --boot --json

This provides detailed Plugin Manager discovery and boot diagnostics.

When sending diagnostic information to Engineering, do not include:

• Passwords
• Composer credentials
• Repository credentials
• Webhook secrets
• Private webhook payloads
• Other protected authentication information

Plugin Lifecycle

Plugins move through a controlled lifecycle.

1. Authored

The plugin is being developed in its own repository.

2. Approved

Performance Scoring reviews and approves the plugin source and supported capabilities.

3. Installed

The approved plugin package is included in the Performance Scoring application through Composer and the deployment process.

4. Validated

Plugin Manager discovers the plugin and validates its manifest, provider, capabilities, package identity, and other requirements.

5. Enabled

The plugin is activated for a Brand or Organization.

6. Updated

A new approved plugin version can be promoted through the deployment pipeline.

7. Disabled

The plugin remains installed but its functionality is unavailable to the affected Brand or Organization.

8. Deprecated

A plugin can be marked for replacement or retirement.

9. Removed

The plugin can eventually be removed from the Performance Scoring application through the controlled deployment process.

Plugin Versioning

Plugins are versioned independently from the main Performance Scoring application.

Approved plugin releases use tagged versions.

For example:

v1.0.0

This gives Performance Scoring precise control over which plugin release is installed in each environment.

Environment Promotion

Plugin releases follow Performance Scoring’s controlled environment promotion process.

Typical progression:

Development → QA → Staging → Production

A plugin version should be tested before being promoted to the next environment.

Higher environments do not independently pull whatever happens to be the newest plugin version.

Instead, known and tested versions are promoted upward.

This helps ensure Production receives the same version that was validated in lower environments.

Deployment Protection

Plugin Manager includes deployment-level validation.

The deployment pipeline checks approved plugin identity and version information before allowing the deployment to continue.

A deployment can fail when a plugin does not match the approved configuration.

Examples include:

• Unexpected package
• Incorrect version
• Incorrect source
• Incorrect source commit
• Invalid manifest
• Missing package
• Package authentication failure

This helps prevent an unintended plugin release from entering an environment.

Private Plugin Repositories

Approved plugins may be maintained in private GitHub repositories.

Performance Scoring’s CI/CD environment uses controlled Composer authentication to retrieve those packages during deployment.

Repository credentials are not exposed to Plugin Manager administrators.

Security Model

Plugin Manager is designed around controlled trust.

Key security principles include:

• Only approved packages may operate as plugins.
• Plugins are disabled by default.
• Invalid plugins cannot be activated.
• Tenant activation is checked before functionality is exposed.
• Plugin routes fail closed when inactive.
• Laravel automatic package discovery is restricted for controlled plugins where necessary.
• Plugin versions are locked during deployment.
• Production deployment validates the expected plugin package and release.
• Private package credentials are handled through secure CI/CD mechanisms.
• Administrators can activate approved plugins but cannot install arbitrary executable code.

Tenant Isolation

Plugin data must follow Performance Scoring’s multi-tenant architecture.

A plugin must not expose one Organization’s information to another Organization.

Plugins that maintain data are expected to operate within the same tenant isolation requirements as the rest of the Performance Scoring platform.

Who Can Build Plugins?

Plugin Manager v1 uses a trusted-developer model.

Approved plugin developers may include:

• Performance Scoring Engineering
• Approved internal development resources
• Approved private-label partner developers

Plugin development is not currently open to anonymous or unreviewed third parties.

Developer Documentation

Performance Scoring maintains separate developer documentation for approved plugin authors.

Developer documentation covers areas such as:

• Package structure
• Plugin manifests
• Service providers
• Routes
• Views
• Hooks and events
• UI extension points
• APIs
• Webhooks
• Plugin-owned data
• Versioning
• Release requirements
• Testing
• Deployment
• Troubleshooting

The Work Status plugin serves as the full reference implementation for developers.

A smaller Hello World plugin is also available as a basic framework example.

What Plugin Manager Does Not Do

Plugin Manager v1 does not provide:

• A public plugin marketplace
• Customer-uploaded plugins
• Automatic execution of unreviewed third-party code
• Unlimited modification of the Performance Scoring UI
• Automatic Production deployment of new plugin releases
• Runtime installation of arbitrary GitHub repositories
• Customer access to private source repositories

Responsibilities

Performance Scoring Engineering

Engineering is responsible for:

• Plugin framework development
• Source approval
• Plugin capability approval
• Plugin review
• Plugin compatibility
• Core extension points
• Plugin Manager security

Plugin Authors

Plugin authors are responsible for:

• Plugin code
• Plugin testing
• Plugin migrations
• Compatibility
• Versioning
• Release notes
• Following Plugin Manager development standards

Operations / DevOps

Operations is responsible for:

• Deployment credentials
• Plugin environment locks
• CI/CD integration
• Version promotion
• Production verification
• Credential rotation
• Deployment rollback

Support Administrators

Support administrators can:

• Review installed plugins
• Review plugin validation status
• Enable plugins by Brand
• Enable or disable Organization overrides
• Review diagnostics

Support administrators cannot install arbitrary plugin code.

Plugin Manager Quick Reference

Installed

The plugin package exists in the deployed application.

Approved

The package is recognized as an approved Plugin Manager source.

Valid

The plugin successfully passed Plugin Manager validation.

Blocked

The plugin has a validation or trust issue and cannot be activated.

Brand Activation

The default plugin state for Organizations using that Brand.

Organization Override

An Organization-specific setting that overrides the Brand state.

Inherit Brand

Removes the Organization-specific override and follows the Brand setting.

Diagnostics

Displays plugin discovery and validation errors.

Refresh Discovery

Re-runs Plugin Manager discovery and validation.

Summary

Plugin Manager gives Performance Scoring a safe and scalable way to extend the platform.

It separates specialized functionality from the core application while maintaining strict control over:

• Who can develop plugins
• Which plugin packages are trusted
• Which versions can be deployed
• Which customers receive each plugin
• How plugins interact with the platform
• How tenant data remains isolated
• How plugin functionality is promoted into Production

Work Status is the first reference plugin built with the framework, but Plugin Manager is designed to support many future Performance Scoring extensions.