KFIF Plugin Contract v1.

Synchronized public edition. Canonical source: KFIF Enterprise backend documentation.

FROZEN · 30 JULY 2026

Contract major 1 behavior is stable. Additive optional x-* metadata and documentation clarifications are compatible. Breaking required semantics require Contract v2. Security fixes may tighten rejection of malformed or unsafe input.

Each plugin.json declares Contract 1.0, an explicit classification, lowercase reverse-DNS plugin and publisher IDs, strict SemVer, bounded KFIF compatibility, entrypoint, capabilities, permissions and licensing requirements.

{
  "contract_version": "1.0",
  "classification": "development",
  "plugin": {
    "id": "com.example.kfif.status-connector",
    "version": "0.1.0-dev",
    "type": "projection_connector"
  },
  "compatibility": {"kfif": ">=5.0.0,<6.0.0"}
}

{
  "network": [],
  "filesystem": {"read": [], "write": []},
  "subprocess": false,
  "shell": false,
  "process_spawn": false,
  "root": false,
  "enforcement": false,
  "firewall": false,
  "systemd_control": false
}

Capabilities describe purpose; they do not grant operating-system access. Unknown capabilities and broader permissions fail closed.

1. A normally validated KFIF Enterprise license.
2. The exact plugin:<plugin-id> entitlement.
3. A signed authorization bound to plugin, version range, deployment and license.
4. An explicitly owner-enabled registry state.

• inspect
• install as installed_disabled
• validate
• enable after fresh eligibility checks
• disable
• stage and atomically activate upgrade
• rollback to an immutable identity
• uninstall only while disabled

Plugin code is started outside the KFIF process and receives only a validated projection object through kfif-plugin-ipc/1.0. Requests, output, stderr, time, CPU and memory are bounded where host controls support them.

{
  "protocol": "kfif-plugin-ipc/1.0",
  "request_id": "opaque-id",
  "plugin": {"id": "com.example.kfif.status-connector", "version": "1.0.0"},
  "input": {"projection": {"schema": "kfif-security-monitor-projection/1.0"}}
}

Every material lifecycle attempt creates a secret-free audit record. Stable error families cover manifests, archives, packages, trust, licenses, authorizations, lifecycle and runtime. Deprecated v1 behavior remains accepted for at least two KFIF minor releases and 180 days, whichever is longer.