World-class extension architecture for Tradeics: isolated runtimes, explicit capabilities, Store as distribution, Platform as control plane.
Control plane vs data plane
┌─────────────────────────────────────────────────────────┐
│ Tradeics Platform (control) │
│ Developer apps · listings · billing · review · keys │
└───────────────┬─────────────────────────────▲───────────┘
│ Apps API / webhooks │ telemetry
┌───────────────▼─────────────────────────────┴───────────┐
│ Tradeics products (B2B · Finance · AI · …) │
│ UI extension slots · actions · events │
└───────────────┬─────────────────────────────────────────┘
│ install token + scoped calls
┌───────────────▼─────────────────────────────────────────┐
│ App / plugin runtime (sandboxed or your HTTPS endpoint) │
└─────────────────────────────────────────────────────────┘
Core components (stable)
| Component |
Responsibility |
| Manifest |
Declares identity, capabilities, scopes, UI slots |
| Runtime |
Executes handlers (Tradeics-hosted or URL callbacks) |
| Install token |
Short-lived / rotatable credential for one org install |
| Event bus |
Delivers signed webhooks / event streams to the app |
| Store catalog |
Search, filters, pricing display, install CTA |
| Billing engine |
Entitlements, invoices, payouts to publishers |
| AI Builder |
Generates draft manifest + starter handlers |
Isolation rules
- No ambient access to other tenants.
- Scopes are least privilege and re-prompted on expand.
- Network egress can be allowlisted for hosted runtimes.
- Secrets live in Platform — never in the public listing.
Environments
| Env |
Use |
| Dev |
Local / tunnel callbacks |
| Sandbox org |
Install private drafts end-to-end |
| Production |
Public or paid installs |
Next