Plugin manifest required

A plugin system that loads plugins by file-system convention with no manifest requirement cannot perform compatibility checking, dependency resolution, or permission enforcement before executing plugin code. The host has no metadata about a plugin's intended capabilities until after it has already run. ISO 25010 maintainability.modularity requires that components declare their dependencies and interfaces; a missing manifest makes every plugin an opaque blob. Security review of what plugins are installed and what they require becomes impossible.

Require a plugin.json manifest alongside every plugin entry point. Validate the manifest schema at load time and reject plugins with missing required fields before importing any plugin code.

{
  "name": "my-analytics-plugin",
  "version": "1.2.0",
  "description": "Adds analytics tracking to all pages",
  "author": "Jane Developer",
  "engines": { "host-api": "^2.0.0" },
  "permissions": ["hooks:read", "storage:write"],
  "dependencies": {
    "base-plugin": "^1.0.0"
  }
}