Module plugin 

Mounting a sandboxed artifact as an ordinary Autumn Plugin.

A SandboxedPlugin is installed exactly like a native one:

let plugin = autumn_web::plugin_sandbox::SandboxedPlugin::from_file(
    Path::new("plugins/hello.autumn-plugin"),
)?;
let app = autumn_web::app().plugin(plugin);

…and from the application’s point of view that is where the resemblance ends. A native plugin’s build receives the whole AppBuilder. This one receives nothing: the mount is performed by the framework, from the manifest, and consists of exactly one nest at the declared prefix plus the declared route metadata.

The manifest is the mount

The router is built from the manifest’s [[routes]], one axum route per declared (method, path). A request to an undeclared path under the prefix is a 404 the guest never sees, and a request to a path outside the prefix never reaches this router at all. So “which routes it mounts” is a property the runtime enforces, not a claim the artifact makes.

What a misbehaving plugin costs

Its behaviour	What the caller gets	What the rest of the app gets
answers	its answer, minus any header it may not set	nothing
traps, exits, answers badly	502 on its own prefix	nothing
spins or floods output	504 on its own prefix	nothing
is already at its concurrency ceiling	503 with Retry-After	nothing
finds the shared guest pool full	503 with Retry-After	nothing
is sent a body over its ceiling	413, guest never started	nothing

The last column is the point. Every failure mode is scoped to the plugin’s own prefix, because the interpreter runs on a blocking worker with a bounded permit count and can only ever return a value.

Structs

SandboxedPlugin

A sandboxed plugin, ready to mount.

Enums

SandboxPluginError

Why a sandboxed plugin could not be installed.

Constants

DEFAULT_GUEST_SLOTS

Default number of guests that may run at once in the whole process.

SANDBOX_ATTRIBUTION_HEADER

Response header naming the sandboxed plugin that produced a response.

Functions

set_guest_slots

Set the process-wide guest limit. Call once, before any plugin is built.