Execution order defined
Why it matters
When multiple plugins register handlers for the same hook and execution order is undefined or depends on object property enumeration, plugin behavior becomes non-deterministic across JavaScript engines and load sequences. An auth plugin that must run before a logging plugin cannot declare that requirement. Debugging a production incident caused by handler ordering requires understanding internal host iteration behavior rather than a declared contract. ISO 25010 maintainability.modularity requires that component interactions be predictable; undefined execution order breaks this at the seam between every plugin pair.
Severity rationale
High because undefined hook execution order makes multi-plugin behavior non-deterministic, turning plugin interactions into ordering-dependent bugs that are impossible to reproduce reliably.
Remediation
Expose an explicit ordering mechanism — either a numeric priority parameter or a dependency-based after declaration — on every hook registration call. Document which strategy the system uses so plugin authors can predict relative execution.
// Priority-based ordering:
registry.on('before:save', handler, { priority: 10 }); // lower = earlier
// Or dependency-based:
registry.on('before:save', handler, { after: ['auth-plugin'] });
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Plugin / Extension Architecture Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · maintainability.modularity — Modularity — deterministic execution order prevents implicit inter-plugin coupling
Taxons
History
- 2026-04-18·v1.0.0·Initial import from plugin-extension-architecture·automated