CALM Hub extensions (#3396): implementation plan #33

Tracks the build of CALM Hub extensions (finos#3396) on feat/3396-extensions in this fork.

Basis

The design is ADRs 0009–0016 (finos#3579, finos#3580, finos#3581), plus the review comments on finos#3580 and finos#3581. This plan assumes that the ADRs take those changes:

• No operator-trusted same-origin mount. mount is for Hub's own code only.
• Deployments is a decorator view, not a bundled mount extension (CALM Hub UI: show all decorators with one generic view, not type-specific implementations finos/architecture-as-code#3620).
• Hub-drawn decorator views are a tier under blocks, declared in a decorator-views contribution. A contribution can have no route (amends ADR 0012).
• Reserved decorator types, a $schema check on write, and append-only history for reserved types.
• designer-tab is for views that a service computes on request.

Way of working

• Each iteration is a small branch from feat/3396-extensions. It is reviewed, then merged into the feature branch.
• Upstream PRs come later, one iteration at a time, in the order below.
• Each iteration includes its tests and docs.

Iterations

Later, not yet planned in detail: search-provider and chat, the store write seam and outbox (ADR 0016), validation (finos#3399), the iframe tier and a UI CSP, event-subscriber, and the extension author guide.

Progress

• I0 spike (findings recorded; native image not yet run)
• I1 Decorators tab (merged 7831ffe; optional creationDateTime/updateDateTime shown when present, Hub-owned timestamps remain a backend follow-up)
• I2 manifest and registry (merged 1ae0df5)
• I3 decorator trust and history (merged 45ab0da; follow-ups: Mongo supersede integration test, nested $ref startup check, admin delete of reserved history)
• I4 overlay engine (merged 63be057; follow-ups: one failed overlay request stalls the others, legend on narrow screens)
• I5 proxy and identity (merged 506c1b9; encoded slashes in path values permitted; owner decided 2026-11-06 to reject them again per ADR 0011, done in I11; follow-ups: HTTP-level assertion rejection tests across auth profiles, pre-upstream failures not audited, author guidance on strict routing)
• I6 decorator views from the registry (merged 08cc2ea, integrated with I7: one ExtensionService off the shared apiClient; follow-ups: view ids not checked unique across manifests, registry 401 shows a per-slot error rather than the sign-in prompt)
• I7 UI blocks tier (merged 814860a; follow-ups: action feedback, registry loading state)
• I8 CLI (merged 03424e7)
• I9 MCP tools (merged dd8e498; owner decision: extension manifests are trusted operator config, so Hub bounds only caller-controlled cost: 1 MiB arguments, depth, linear-time input patterns via RE2J, scope first; follow-ups: cap validation error size, a few test names describe history, legend collapsible on phones)
• I10 extension UI layout and scaling (merged 388abbc; reviews architecture-as-code-43, -44; follow-ups: collapsible overlay legend on phones, markdown heading styling in screens, focus after 'View all', viewKey tests for edges and groups, details below 304 px wide, very long card labels; plus the owner's STRIDE threat-model demo extension beside release-tracker, merged 1c4958a, reviews -51, -53)
• I11 reject encoded slashes again (merged 5827c79; review architecture-as-code-48; the upstream PR title must release the CLI, e.g. feat(cli), since upstream squash-merges; follow-ups: docs say 400 where a read-only write gets 405, Unicode slash look-alikes pass through, tabs with an unfillable placeholder show an error instead of hiding, matrix params dropped silently)
• I12 Hub-owned decorator timestamps (merged 67aaeeb; review architecture-as-code-49; follow-ups: the UI JSON view shows the times so a copy-paste into a PUT fails, legacy decorators updated in place get only updateDateTime, no real-Mongo test, OpenAPI does not list the 400s)
• I13 extension docs: tutorial and extension point reference (merged fb55bd3; reviews architecture-as-code-52, -54; follow-ups: precision notes in reports -52 and -54, the calm-cli/hub.md 502 note, Docker steps not run in the sandbox)