{"id":21199,"date":"2026-09-23T08:55:11","date_gmt":"2026-09-23T13:55:11","guid":{"rendered":"https:\/\/securedb.io\/kb\/?p=21199"},"modified":"2026-09-23T08:55:12","modified_gmt":"2026-09-23T13:55:12","slug":"plugin-manager","status":"publish","type":"post","link":"https:\/\/securedb.io\/kb\/?p=21199","title":{"rendered":"Plugin Manager"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">Plugin Manager<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Overview<\/h2>\n\n\n\n<p>Plugin Manager is Performance Scoring&#8217;s framework for safely extending the platform with approved plugins.<\/p>\n\n\n\n<p>It allows Performance Scoring and approved development partners to build additional functionality without permanently hard-coding every new feature directly into the core application.<\/p>\n\n\n\n<p>Plugins can add functionality such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>New pages and routes<\/li>\n\n\n\n<li>User interface elements<\/li>\n\n\n\n<li>APIs<\/li>\n\n\n\n<li>Webhooks<\/li>\n\n\n\n<li>Event and hook integrations<\/li>\n\n\n\n<li>Plugin-specific settings<\/li>\n\n\n\n<li>Plugin-owned data<\/li>\n\n\n\n<li>Approved menu and profile additions<\/li>\n\n\n\n<li>Other explicitly supported extension points<\/li>\n<\/ul>\n\n\n\n<p>Plugin Manager also controls <strong>where each plugin is available<\/strong>, allowing functionality to be enabled or disabled by both <strong>Brand<\/strong> and <strong>Organization<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Why Plugin Manager Exists<\/h1>\n\n\n\n<p>Performance Scoring supports multiple Brands, Organizations, customers, use cases, and private-label environments.<\/p>\n\n\n\n<p>Not every customer needs every feature.<\/p>\n\n\n\n<p>Before Plugin Manager, specialized functionality could require changes directly inside the main Performance Scoring application. That makes customized functionality harder to isolate, test, upgrade, or maintain.<\/p>\n\n\n\n<p>Plugin Manager creates a controlled extension layer.<\/p>\n\n\n\n<p>Instead of changing the core application for every specialized requirement, approved functionality can be developed as a plugin and connected to Performance Scoring through defined extension points.<\/p>\n\n\n\n<p>This provides several benefits:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Faster development of specialized functionality<\/li>\n\n\n\n<li>Cleaner separation between core features and customer-specific extensions<\/li>\n\n\n\n<li>Better support for private-label partners<\/li>\n\n\n\n<li>Safer testing and deployment<\/li>\n\n\n\n<li>Independent plugin versioning<\/li>\n\n\n\n<li>Brand- and Organization-specific feature control<\/li>\n\n\n\n<li>Reduced risk of unrelated functionality affecting the core platform<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">What Is a Plugin?<\/h1>\n\n\n\n<p>A Performance Scoring plugin is an independently maintained software package that extends the Performance Scoring application through approved Plugin Manager interfaces.<\/p>\n\n\n\n<p>Plugins are Laravel-compatible packages and are installed through Performance Scoring&#8217;s controlled deployment process.<\/p>\n\n\n\n<p>Plugins are <strong>not downloaded or installed directly by customers or administrators<\/strong>.<\/p>\n\n\n\n<p>For a plugin to operate inside Performance Scoring, it must first be:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Developed by an approved source.<\/li>\n\n\n\n<li>Packaged according to Plugin Manager standards.<\/li>\n\n\n\n<li>Reviewed and approved.<\/li>\n\n\n\n<li>Installed through Performance Scoring&#8217;s deployment pipeline.<\/li>\n\n\n\n<li>Successfully validated by Plugin Manager.<\/li>\n\n\n\n<li>Enabled for the appropriate Brand or Organization.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Plugin Manager Is Not a Public Marketplace<\/h1>\n\n\n\n<p>Plugin Manager is intentionally a <strong>trusted plugin ecosystem<\/strong>.<\/p>\n\n\n\n<p>It is not an open app store or public plugin marketplace.<\/p>\n\n\n\n<p>Plugins may currently be created by:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Performance Scoring internal development teams<\/li>\n\n\n\n<li>Approved Performance Scoring development partners<\/li>\n\n\n\n<li>Approved private-label development teams<\/li>\n<\/ul>\n\n\n\n<p>Unreviewed third-party plugins cannot simply be uploaded and executed inside Performance Scoring.<\/p>\n\n\n\n<p>This protects the security, stability, and integrity of the platform.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">What Plugins Can Do<\/h1>\n\n\n\n<p>Plugin Manager supports approved extension capabilities including:<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Routes<\/h2>\n\n\n\n<p>Plugins can expose their own approved application routes and pages.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Controllers<\/h2>\n\n\n\n<p>Plugins may contain controllers responsible for their own application logic.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Views<\/h2>\n\n\n\n<p>Plugins can provide their own user interfaces and Blade views.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">APIs<\/h2>\n\n\n\n<p>Plugins can expose approved application programming interfaces.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Webhooks<\/h2>\n\n\n\n<p>Plugins can receive or process authenticated webhook events through the Plugin Manager framework.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Events and Hooks<\/h2>\n\n\n\n<p>Plugins can subscribe to supported Performance Scoring events or interact through defined hooks.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">UI Contributions<\/h2>\n\n\n\n<p>Plugins may insert functionality into approved areas of Performance Scoring.<\/p>\n\n\n\n<p>Examples include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Profile menus<\/li>\n\n\n\n<li>Profile status areas<\/li>\n\n\n\n<li>Approved navigation areas<\/li>\n\n\n\n<li>Defined application extension points<\/li>\n<\/ul>\n\n\n\n<p>Plugins cannot arbitrarily rewrite or replace unrestricted parts of the Performance Scoring interface.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Plugin-Owned Data<\/h2>\n\n\n\n<p>Plugins may maintain their own data when that data follows Performance Scoring&#8217;s tenant isolation requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Settings<\/h2>\n\n\n\n<p>Plugins can maintain plugin-specific configuration and settings when supported by the plugin.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Example: Work Status<\/h1>\n\n\n\n<p><strong>Work Status<\/strong> is the first full reference implementation created using Plugin Manager.<\/p>\n\n\n\n<p>Work Status allows users to select statuses such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Available<\/li>\n\n\n\n<li>Working from Home<\/li>\n\n\n\n<li>Working Elsewhere<\/li>\n\n\n\n<li>Out of the Office<\/li>\n<\/ul>\n\n\n\n<p>The purpose of Work Status is larger than the feature itself.<\/p>\n\n\n\n<p>It demonstrates how a plugin can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Exist as an independent package<\/li>\n\n\n\n<li>Be installed through Performance Scoring&#8217;s deployment process<\/li>\n\n\n\n<li>Register approved UI contributions<\/li>\n\n\n\n<li>Store tenant-aware plugin data<\/li>\n\n\n\n<li>Respect Brand and Organization activation<\/li>\n\n\n\n<li>Participate in the application&#8217;s runtime<\/li>\n\n\n\n<li>Be versioned independently<\/li>\n\n\n\n<li>Be safely enabled or disabled<\/li>\n<\/ul>\n\n\n\n<p>Work Status should therefore be viewed as an <strong>example of what Plugin Manager can support<\/strong>, rather than the definition of Plugin Manager itself.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Accessing Plugin Manager<\/h1>\n\n\n\n<p>Plugin Manager is an administrative tool.<\/p>\n\n\n\n<p>Authorized Performance Scoring support or administrative personnel can access the <strong>Plugin Manager<\/strong> administration screen.<\/p>\n\n\n\n<p>The screen displays installed plugins and provides information about:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Plugin name<\/li>\n\n\n\n<li>Installed version<\/li>\n\n\n\n<li>Validation status<\/li>\n\n\n\n<li>Approval status<\/li>\n\n\n\n<li>Supported capabilities<\/li>\n\n\n\n<li>Brand activation<\/li>\n\n\n\n<li>Organization activation<\/li>\n\n\n\n<li>Diagnostics<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Understanding Plugin Status<\/h1>\n\n\n\n<p>Each plugin can display several status indicators.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Valid<\/h2>\n\n\n\n<p><strong>Valid<\/strong> means Plugin Manager successfully discovered and validated the plugin.<\/p>\n\n\n\n<p>The plugin&#8217;s package and manifest meet the requirements necessary for Plugin Manager to use it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Blocked<\/h2>\n\n\n\n<p><strong>Blocked<\/strong> means Plugin Manager detected a validation or trust problem.<\/p>\n\n\n\n<p>A blocked plugin cannot be activated until the problem is resolved.<\/p>\n\n\n\n<p>Possible causes can include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Invalid manifest<\/li>\n\n\n\n<li>Unapproved package<\/li>\n\n\n\n<li>Incorrect package identity<\/li>\n\n\n\n<li>Unsupported capability<\/li>\n\n\n\n<li>Invalid service provider<\/li>\n\n\n\n<li>Package\/version mismatch<\/li>\n\n\n\n<li>Deployment validation failure<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Approved<\/h2>\n\n\n\n<p><strong>Approved<\/strong> means the plugin package is from a source approved by Performance Scoring.<\/p>\n\n\n\n<p>Approval does not automatically enable the plugin for customers.<\/p>\n\n\n\n<p>A plugin must still be activated for the appropriate Brand or Organization.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Brand Activation<\/h1>\n\n\n\n<p>Plugin Manager allows a plugin to be enabled or disabled at the <strong>Brand<\/strong> level.<\/p>\n\n\n\n<p>A Brand setting acts as the default for Organizations associated with that Brand.<\/p>\n\n\n\n<p>For example:<\/p>\n\n\n\n<p><strong>Performance Scoring Brand<\/strong><\/p>\n\n\n\n<p>Plugin: Example Plugin<br>Brand Activation: Enabled<\/p>\n\n\n\n<p>Unless an Organization override exists, Organizations using that Brand will inherit the enabled state.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Organization Overrides<\/h1>\n\n\n\n<p>Individual Organizations can override their Brand&#8217;s plugin setting.<\/p>\n\n\n\n<p>Organization settings have higher priority than Brand settings.<\/p>\n\n\n\n<p>An Organization can be set to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enabled<\/li>\n\n\n\n<li>Disabled<\/li>\n\n\n\n<li>Inherit Brand<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Activation Precedence<\/h1>\n\n\n\n<p>Plugin Manager resolves activation in the following order:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>The plugin must exist in the deployed application.<\/li>\n\n\n\n<li>The plugin must be approved.<\/li>\n\n\n\n<li>The plugin must successfully pass validation.<\/li>\n\n\n\n<li>The Brand setting is evaluated.<\/li>\n\n\n\n<li>An Organization override is evaluated.<\/li>\n\n\n\n<li>If an Organization override exists, it takes precedence over the Brand setting.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Example 1<\/h3>\n\n\n\n<p>Brand: Enabled<br>Organization: Inherit Brand<\/p>\n\n\n\n<p><strong>Result:<\/strong> Enabled<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example 2<\/h3>\n\n\n\n<p>Brand: Enabled<br>Organization: Disabled<\/p>\n\n\n\n<p><strong>Result:<\/strong> Disabled<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example 3<\/h3>\n\n\n\n<p>Brand: Disabled<br>Organization: Enabled<\/p>\n\n\n\n<p><strong>Result:<\/strong> Enabled<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Example 4<\/h3>\n\n\n\n<p>Brand: Disabled<br>Organization: Inherit Brand<\/p>\n\n\n\n<p><strong>Result:<\/strong> Disabled<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Default Plugin Behavior<\/h1>\n\n\n\n<p>Plugins are <strong>disabled by default<\/strong> unless they have been explicitly enabled.<\/p>\n\n\n\n<p>This is intentional.<\/p>\n\n\n\n<p>Installing a plugin into the Performance Scoring application does not automatically expose the plugin to customers.<\/p>\n\n\n\n<p>Installation and activation are separate actions.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">What &#8220;Remove Override&#8221; or &#8220;Inherit Brand&#8221; Means<\/h1>\n\n\n\n<p>Selecting <strong>Inherit Brand<\/strong> removes the Organization-specific activation decision.<\/p>\n\n\n\n<p>The Organization then follows the setting configured for its Brand.<\/p>\n\n\n\n<p>Similarly, where Plugin Manager allows a Brand override to be removed, the explicit Brand activation record is removed and the framework returns to its default behavior.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Plugin Runtime Protection<\/h1>\n\n\n\n<p>Plugin Manager uses a fail-closed security model.<\/p>\n\n\n\n<p>If a plugin is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Missing<\/li>\n\n\n\n<li>Invalid<\/li>\n\n\n\n<li>Blocked<\/li>\n\n\n\n<li>Unapproved<\/li>\n\n\n\n<li>Disabled for the current Brand<\/li>\n\n\n\n<li>Disabled for the current Organization<\/li>\n<\/ul>\n\n\n\n<p>Plugin Manager prevents the plugin&#8217;s functionality from being exposed.<\/p>\n\n\n\n<p>This applies to plugin routes as well as approved UI contributions.<\/p>\n\n\n\n<p>A disabled or unavailable plugin route may intentionally return <strong>Not Found<\/strong> rather than exposing information about the plugin&#8217;s installation or activation state.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">UI Extension Points<\/h1>\n\n\n\n<p>Plugins do not receive unrestricted access to modify the Performance Scoring interface.<\/p>\n\n\n\n<p>Instead, Performance Scoring provides approved UI extension points.<\/p>\n\n\n\n<p>A plugin can register content with one of these supported surfaces.<\/p>\n\n\n\n<p>For example, the Work Status reference plugin uses approved profile-related UI surfaces.<\/p>\n\n\n\n<p>This approach allows Performance Scoring to extend the application while preserving:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>UI consistency<\/li>\n\n\n\n<li>Security boundaries<\/li>\n\n\n\n<li>Maintainability<\/li>\n\n\n\n<li>Upgrade compatibility<\/li>\n<\/ul>\n\n\n\n<p>Additional extension points can be introduced as the Plugin Manager framework evolves.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Plugin Discovery<\/h1>\n\n\n\n<p>Plugin Manager automatically discovers approved plugin packages installed in the application.<\/p>\n\n\n\n<p>During discovery, Plugin Manager examines the plugin&#8217;s package and manifest information.<\/p>\n\n\n\n<p>Plugin discovery determines whether the plugin:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Is installed<\/li>\n\n\n\n<li>Is approved<\/li>\n\n\n\n<li>Has a valid manifest<\/li>\n\n\n\n<li>Uses supported capabilities<\/li>\n\n\n\n<li>References valid providers<\/li>\n\n\n\n<li>Meets Plugin Manager requirements<\/li>\n<\/ul>\n\n\n\n<p>Only valid plugins are available for activation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Diagnostics<\/h1>\n\n\n\n<p>The Plugin Manager administration screen includes a <strong>Diagnostics<\/strong> section.<\/p>\n\n\n\n<p>Diagnostics displays plugin discovery or validation problems.<\/p>\n\n\n\n<p>If everything is functioning correctly, Plugin Manager displays:<\/p>\n\n\n\n<p><strong>No discovery errors.<\/strong><\/p>\n\n\n\n<p>If a plugin has a problem, Diagnostics displays the associated error code and explanation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Refresh Discovery<\/h1>\n\n\n\n<p>The <strong>Refresh Discovery<\/strong> control causes Plugin Manager to re-evaluate installed plugins.<\/p>\n\n\n\n<p>Use Refresh Discovery after:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A plugin deployment<\/li>\n\n\n\n<li>A plugin configuration change<\/li>\n\n\n\n<li>Resolving a plugin validation problem<\/li>\n\n\n\n<li>Troubleshooting unexpected Plugin Manager behavior<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Troubleshooting Plugin Manager<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">A Plugin Cannot Be Enabled<\/h2>\n\n\n\n<p>Confirm that the plugin shows:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Valid<\/li>\n\n\n\n<li>Approved<\/li>\n<\/ul>\n\n\n\n<p>If the plugin displays <strong>Blocked<\/strong>, review the Diagnostics section.<\/p>\n\n\n\n<p>Blocked plugins cannot be activated until the validation problem is resolved.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">A Plugin Works for One Organization but Not Another<\/h2>\n\n\n\n<p>Check both:<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Brand activation<\/li>\n\n\n\n<li>Organization override<\/li>\n<\/ol>\n\n\n\n<p>Organization settings take precedence over Brand settings.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">A Plugin Page Returns Not Found<\/h2>\n\n\n\n<p>This can be expected behavior.<\/p>\n\n\n\n<p>Plugin routes intentionally fail closed when the plugin is:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Unavailable<\/li>\n\n\n\n<li>Invalid<\/li>\n\n\n\n<li>Not approved<\/li>\n\n\n\n<li>Disabled for the current Brand<\/li>\n\n\n\n<li>Disabled for the current Organization<\/li>\n<\/ul>\n\n\n\n<p>Check Plugin Manager activation settings before treating the Not Found response as an application error.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Organizations Are Missing From the List<\/h2>\n\n\n\n<p>Plugin Manager displays active Organizations associated with the selected Brand.<\/p>\n\n\n\n<p>Confirm:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The correct Brand is selected.<\/li>\n\n\n\n<li>The Organization is active.<\/li>\n\n\n\n<li>The Organization belongs to the expected Brand environment.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Engineering Diagnostics<\/h1>\n\n\n\n<p>If administrative troubleshooting does not resolve a problem, Engineering can run:<\/p>\n\n\n\n<p><code>php artisan plugins:discover --refresh --boot --json<\/code><\/p>\n\n\n\n<p>This provides detailed Plugin Manager discovery and boot diagnostics.<\/p>\n\n\n\n<p>When sending diagnostic information to Engineering, do not include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Passwords<\/li>\n\n\n\n<li>Composer credentials<\/li>\n\n\n\n<li>Repository credentials<\/li>\n\n\n\n<li>Webhook secrets<\/li>\n\n\n\n<li>Private webhook payloads<\/li>\n\n\n\n<li>Other protected authentication information<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Plugin Lifecycle<\/h1>\n\n\n\n<p>Plugins move through a controlled lifecycle.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Authored<\/h2>\n\n\n\n<p>The plugin is being developed in its own repository.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. Approved<\/h2>\n\n\n\n<p>Performance Scoring reviews and approves the plugin source and supported capabilities.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Installed<\/h2>\n\n\n\n<p>The approved plugin package is included in the Performance Scoring application through Composer and the deployment process.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4. Validated<\/h2>\n\n\n\n<p>Plugin Manager discovers the plugin and validates its manifest, provider, capabilities, package identity, and other requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">5. Enabled<\/h2>\n\n\n\n<p>The plugin is activated for a Brand or Organization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. Updated<\/h2>\n\n\n\n<p>A new approved plugin version can be promoted through the deployment pipeline.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">7. Disabled<\/h2>\n\n\n\n<p>The plugin remains installed but its functionality is unavailable to the affected Brand or Organization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">8. Deprecated<\/h2>\n\n\n\n<p>A plugin can be marked for replacement or retirement.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Removed<\/h2>\n\n\n\n<p>The plugin can eventually be removed from the Performance Scoring application through the controlled deployment process.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Plugin Versioning<\/h1>\n\n\n\n<p>Plugins are versioned independently from the main Performance Scoring application.<\/p>\n\n\n\n<p>Approved plugin releases use tagged versions.<\/p>\n\n\n\n<p>For example:<\/p>\n\n\n\n<p><code>v1.0.0<\/code><\/p>\n\n\n\n<p>This gives Performance Scoring precise control over which plugin release is installed in each environment.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Environment Promotion<\/h1>\n\n\n\n<p>Plugin releases follow Performance Scoring&#8217;s controlled environment promotion process.<\/p>\n\n\n\n<p>Typical progression:<\/p>\n\n\n\n<p><strong>Development \u2192 QA \u2192 Staging \u2192 Production<\/strong><\/p>\n\n\n\n<p>A plugin version should be tested before being promoted to the next environment.<\/p>\n\n\n\n<p>Higher environments do not independently pull whatever happens to be the newest plugin version.<\/p>\n\n\n\n<p>Instead, known and tested versions are promoted upward.<\/p>\n\n\n\n<p>This helps ensure Production receives the same version that was validated in lower environments.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Deployment Protection<\/h1>\n\n\n\n<p>Plugin Manager includes deployment-level validation.<\/p>\n\n\n\n<p>The deployment pipeline checks approved plugin identity and version information before allowing the deployment to continue.<\/p>\n\n\n\n<p>A deployment can fail when a plugin does not match the approved configuration.<\/p>\n\n\n\n<p>Examples include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Unexpected package<\/li>\n\n\n\n<li>Incorrect version<\/li>\n\n\n\n<li>Incorrect source<\/li>\n\n\n\n<li>Incorrect source commit<\/li>\n\n\n\n<li>Invalid manifest<\/li>\n\n\n\n<li>Missing package<\/li>\n\n\n\n<li>Package authentication failure<\/li>\n<\/ul>\n\n\n\n<p>This helps prevent an unintended plugin release from entering an environment.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Private Plugin Repositories<\/h1>\n\n\n\n<p>Approved plugins may be maintained in private GitHub repositories.<\/p>\n\n\n\n<p>Performance Scoring&#8217;s CI\/CD environment uses controlled Composer authentication to retrieve those packages during deployment.<\/p>\n\n\n\n<p>Repository credentials are not exposed to Plugin Manager administrators.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Security Model<\/h1>\n\n\n\n<p>Plugin Manager is designed around controlled trust.<\/p>\n\n\n\n<p>Key security principles include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Only approved packages may operate as plugins.<\/li>\n\n\n\n<li>Plugins are disabled by default.<\/li>\n\n\n\n<li>Invalid plugins cannot be activated.<\/li>\n\n\n\n<li>Tenant activation is checked before functionality is exposed.<\/li>\n\n\n\n<li>Plugin routes fail closed when inactive.<\/li>\n\n\n\n<li>Laravel automatic package discovery is restricted for controlled plugins where necessary.<\/li>\n\n\n\n<li>Plugin versions are locked during deployment.<\/li>\n\n\n\n<li>Production deployment validates the expected plugin package and release.<\/li>\n\n\n\n<li>Private package credentials are handled through secure CI\/CD mechanisms.<\/li>\n\n\n\n<li>Administrators can activate approved plugins but cannot install arbitrary executable code.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Tenant Isolation<\/h1>\n\n\n\n<p>Plugin data must follow Performance Scoring&#8217;s multi-tenant architecture.<\/p>\n\n\n\n<p>A plugin must not expose one Organization&#8217;s information to another Organization.<\/p>\n\n\n\n<p>Plugins that maintain data are expected to operate within the same tenant isolation requirements as the rest of the Performance Scoring platform.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Who Can Build Plugins?<\/h1>\n\n\n\n<p>Plugin Manager v1 uses a trusted-developer model.<\/p>\n\n\n\n<p>Approved plugin developers may include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Performance Scoring Engineering<\/li>\n\n\n\n<li>Approved internal development resources<\/li>\n\n\n\n<li>Approved private-label partner developers<\/li>\n<\/ul>\n\n\n\n<p>Plugin development is not currently open to anonymous or unreviewed third parties.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Developer Documentation<\/h1>\n\n\n\n<p>Performance Scoring maintains separate developer documentation for approved plugin authors.<\/p>\n\n\n\n<p>Developer documentation covers areas such as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Package structure<\/li>\n\n\n\n<li>Plugin manifests<\/li>\n\n\n\n<li>Service providers<\/li>\n\n\n\n<li>Routes<\/li>\n\n\n\n<li>Views<\/li>\n\n\n\n<li>Hooks and events<\/li>\n\n\n\n<li>UI extension points<\/li>\n\n\n\n<li>APIs<\/li>\n\n\n\n<li>Webhooks<\/li>\n\n\n\n<li>Plugin-owned data<\/li>\n\n\n\n<li>Versioning<\/li>\n\n\n\n<li>Release requirements<\/li>\n\n\n\n<li>Testing<\/li>\n\n\n\n<li>Deployment<\/li>\n\n\n\n<li>Troubleshooting<\/li>\n<\/ul>\n\n\n\n<p>The <strong>Work Status<\/strong> plugin serves as the full reference implementation for developers.<\/p>\n\n\n\n<p>A smaller Hello World plugin is also available as a basic framework example.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">What Plugin Manager Does Not Do<\/h1>\n\n\n\n<p>Plugin Manager v1 does not provide:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A public plugin marketplace<\/li>\n\n\n\n<li>Customer-uploaded plugins<\/li>\n\n\n\n<li>Automatic execution of unreviewed third-party code<\/li>\n\n\n\n<li>Unlimited modification of the Performance Scoring UI<\/li>\n\n\n\n<li>Automatic Production deployment of new plugin releases<\/li>\n\n\n\n<li>Runtime installation of arbitrary GitHub repositories<\/li>\n\n\n\n<li>Customer access to private source repositories<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Responsibilities<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Performance Scoring Engineering<\/h2>\n\n\n\n<p>Engineering is responsible for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Plugin framework development<\/li>\n\n\n\n<li>Source approval<\/li>\n\n\n\n<li>Plugin capability approval<\/li>\n\n\n\n<li>Plugin review<\/li>\n\n\n\n<li>Plugin compatibility<\/li>\n\n\n\n<li>Core extension points<\/li>\n\n\n\n<li>Plugin Manager security<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Plugin Authors<\/h2>\n\n\n\n<p>Plugin authors are responsible for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Plugin code<\/li>\n\n\n\n<li>Plugin testing<\/li>\n\n\n\n<li>Plugin migrations<\/li>\n\n\n\n<li>Compatibility<\/li>\n\n\n\n<li>Versioning<\/li>\n\n\n\n<li>Release notes<\/li>\n\n\n\n<li>Following Plugin Manager development standards<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Operations \/ DevOps<\/h2>\n\n\n\n<p>Operations is responsible for:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Deployment credentials<\/li>\n\n\n\n<li>Plugin environment locks<\/li>\n\n\n\n<li>CI\/CD integration<\/li>\n\n\n\n<li>Version promotion<\/li>\n\n\n\n<li>Production verification<\/li>\n\n\n\n<li>Credential rotation<\/li>\n\n\n\n<li>Deployment rollback<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Support Administrators<\/h2>\n\n\n\n<p>Support administrators can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Review installed plugins<\/li>\n\n\n\n<li>Review plugin validation status<\/li>\n\n\n\n<li>Enable plugins by Brand<\/li>\n\n\n\n<li>Enable or disable Organization overrides<\/li>\n\n\n\n<li>Review diagnostics<\/li>\n<\/ul>\n\n\n\n<p>Support administrators cannot install arbitrary plugin code.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Plugin Manager Quick Reference<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">Installed<\/h3>\n\n\n\n<p>The plugin package exists in the deployed application.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Approved<\/h3>\n\n\n\n<p>The package is recognized as an approved Plugin Manager source.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Valid<\/h3>\n\n\n\n<p>The plugin successfully passed Plugin Manager validation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Blocked<\/h3>\n\n\n\n<p>The plugin has a validation or trust issue and cannot be activated.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Brand Activation<\/h3>\n\n\n\n<p>The default plugin state for Organizations using that Brand.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Organization Override<\/h3>\n\n\n\n<p>An Organization-specific setting that overrides the Brand state.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Inherit Brand<\/h3>\n\n\n\n<p>Removes the Organization-specific override and follows the Brand setting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Diagnostics<\/h3>\n\n\n\n<p>Displays plugin discovery and validation errors.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Refresh Discovery<\/h3>\n\n\n\n<p>Re-runs Plugin Manager discovery and validation.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Summary<\/h1>\n\n\n\n<p>Plugin Manager gives Performance Scoring a safe and scalable way to extend the platform.<\/p>\n\n\n\n<p>It separates specialized functionality from the core application while maintaining strict control over:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Who can develop plugins<\/li>\n\n\n\n<li>Which plugin packages are trusted<\/li>\n\n\n\n<li>Which versions can be deployed<\/li>\n\n\n\n<li>Which customers receive each plugin<\/li>\n\n\n\n<li>How plugins interact with the platform<\/li>\n\n\n\n<li>How tenant data remains isolated<\/li>\n\n\n\n<li>How plugin functionality is promoted into Production<\/li>\n<\/ul>\n\n\n\n<p>Work Status is the first reference plugin built with the framework, but Plugin Manager is designed to support many future Performance Scoring extensions.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Plugin Manager Overview Plugin Manager is Performance Scoring&#8217;s framework for safely extending the platform with approved plugins. It allows Performance Scoring and approved development partners to build additional functionality without [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_helpful_status":1,"footnotes":""},"categories":[36],"tags":[215],"class_list":["post-21199","post","type-post","status-publish","format-standard","hentry","category-admin","tag-plugin-manager"],"wps_subtitle":"","_links":{"self":[{"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=\/wp\/v2\/posts\/21199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=21199"}],"version-history":[{"count":1,"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=\/wp\/v2\/posts\/21199\/revisions"}],"predecessor-version":[{"id":21200,"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=\/wp\/v2\/posts\/21199\/revisions\/21200"}],"wp:attachment":[{"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securedb.io\/kb\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}