SIGNALS Documentation
API Reference

Plugin registry

Install reviewed and community plugins from the public Signals registry.

Registry index

Signals reads the schema-v2 index at https://plugins.signals.rent/index.json by default. Configure PLUGINS_REGISTRY_URL, PLUGINS_REGISTRY_CACHE_TTL_SECONDS, PLUGINS_REGISTRY_TIMEOUT_SECONDS, or disable it with PLUGINS_REGISTRY_ENABLED=false. The index is cached globally because every tenant consumes the same public catalogue. An unsupported schema version, malformed response, expired index, replayed older index, invalid signature, or network failure leaves the Plugins page available and reports that the registry is unavailable.

The index has an Ed25519 signature over its schema version, generation time, expiry time, count, and complete plugin catalogue. Each release also declares an immutable commit ref, an HTTPS archive_url containing that ref, archive and manifest SHA-256 values, and its own Ed25519 signature. The release signature covers the package, version, SDK constraint, ref, archive URL, and both digests. Configure trusted public keys with PLUGINS_REGISTRY_TRUSTED_KEYS as a JSON object of key ID to base64 public key. Revoke a key immediately with PLUGINS_REGISTRY_REVOKED_KEY_IDS as a comma-separated list. Cached indexes are reverified, so revocation does not wait for cache expiry. Add the replacement key before registry releases start using it, then revoke the old key after the rotation window.

Signals streams the archive through an incremental SHA-256 sink into a bounded scratch file and then hashes the completed file again. It also hashes the normalized staged package tree, so a changed PHP or resource file invalidates an accepted plan even when signals.yaml is unchanged. Signals then applies traversal, symlink, compressed-size, expanded-size, entry-count, duplicate-normalized-path, Composer metadata, and signals.yaml validation. The manifest package, version, and digest must match the signed registry release before installation. HTTPS redirects are limited to three and cannot change protocol. Configure package limits with PLUGINS_UPLOAD_MAX_KB, PLUGINS_UPLOAD_MAX_UNCOMPRESSED_KB, and PLUGINS_UPLOAD_MAX_ENTRIES.

Tiers and lifecycle status

  • Verified means Signals reviewed the version in verification.reviewed_version.
  • Community is unreviewed and available only to self-hosted operators.
  • Deprecated releases remain installable and show the registry's reason.
  • Yanked releases are retained in the index for safety but cannot be installed.

Self-hosted Signals installs the registry's latest tagged release. Signals Cloud allows only a verified release when latest.version exactly equals verification.reviewed_version; a newer upstream release remains visible while it awaits review. Manual archive upload and local-package installation are disabled on Cloud.

Provenance and Cloud packages

Registry installations set plugins.source to registry and record the tier, display tag, immutable ref, source URL, archive digest, manifest digest, signing-key ID, and installation time. On Cloud, archive_path points to a content-addressed sha256/<digest>.zip object in tenant-prefixed storage. A worker verifies the stored archive and manifest again before it creates or reuses a local materialisation. A worker never loads two versions of one PHP package; deploys and upgrades should recycle long-running workers.

Composer-discovered and manually uploaded plugins may use composer and upload as provenance values. Existing rows can remain null.

CLI

php artisan signals:plugin registry:list
php artisan signals:plugin registry:refresh
php artisan signals:plugin registry:install acme/example
# Review the printed provenance, hashes, and capabilities, then run:
php artisan signals:plugin registry:install acme/example --accept-capabilities=<plan-hash>

The first install command only downloads, verifies, and prints the time-limited plan. It does not place the package, run migrations, or call plugin code. The second command recomputes the signed artifact plan under the lifecycle lock and accepts it only when the hash is unchanged. The CLI uses the same registry client, authorization boundary, compatibility checks, consent record, and Cloud restrictions as the Plugins page.