> Documentation snapshot: 2026-11-03. Revision: `6db1e658e1a586458a290729daf5319fce5b2b6c`. Historical status notes are preserved. > [Website edition](https://hubnot.org/docs/plugin-quickstart.html) · [Pinned source](https://github.com/LynnColeArt/hubnot/blob/6db1e658e1a586458a290729daf5319fce5b2b6c/docs/plugin-quickstart.md) · [Downloads and release qualifications](https://hubnot.org/releases.html) # Try an optional plugin Most Hubnot users need only `hn` and Git. Issues, projects, discussions, workflows, memory and migration work without plugins. Hubnot calls plugins **extensions**: trusted local executables you explicitly register, grant permissions and run. Cloning a repository or reading its data never installs or starts one. This walkthrough creates a custom maintenance ticket with the inventory example, then removes the extension and reads the ticket without it. It uses a disposable repository and isolated user configuration, leaving your ordinary projects and extension registrations alone. Run the shell blocks in order in one terminal. Stop at a failed command and inspect the error before continuing. ## 1. Choose the executable Install [Hubnot 0.1.0-beta.2](https://hubnot.org/docs/getting-started.html#download-and-install) for your platform and put `hn` on PATH. You need Git and an ordinary Linux/macOS shell. The example publisher is separate from `hn`; use a trusted copy built for your native CPU from the matching Hubnot source. Building it yourself additionally needs Go 1.26 or newer. Go is not an application or plugin runtime requirement. Start in the root of the matching `v0.1.0-beta.2` source checkout: ```sh umask 077 DEMO=$(mktemp -d "$HOME/hubnot-plugin-demo.XXXXXX") HN=$(command -v hn) "$HN" version CGO_ENABLED=0 go build -buildvcs=false -trimpath \ -o "$DEMO/inventory-model" ./examples/extensions/inventory-model ``` The version should be `0.1.0-beta.2`. If using an already supplied matching publisher, copy it to `$DEMO/inventory-model` instead of running the build and ensure it is executable. The [qualification kit](https://github.com/LynnColeArt/hubnot/blob/6db1e658e1a586458a290729daf5319fce5b2b6c/docs/releases/0.1.0-beta.2.md#assets-and-historical-handoff-records) contains reference copies for demonstrations/tests, not production connectors. Only run an executable you trust: extensions have the same OS-user powers as you. ## 2. Create the isolated demo ```sh mkdir -p "$DEMO/repository" "$DEMO/private" "$DEMO/config" \ "$DEMO/home/Library/Application Support" git init --quiet "$DEMO/repository" cd "$DEMO/repository" demo_hn() { env HOME="$DEMO/home" XDG_CONFIG_HOME="$DEMO/config" "$HN" "$@" } demo_hn init --name 'Plugin demo' ``` Use `demo_hn` throughout this walkthrough. Its temporary HOME isolates the Mac registry too; macOS does not use XDG_CONFIG_HOME for `os.UserConfigDir`. Normal `hn` calls keep your normal configuration. The demo repository contains a new private signing identity; keep the whole demo private. ## 3. Register, inspect and grant The manifest lists the methods the publisher understands. It does not grant them. ```sh cat > "$DEMO/private/manifest.json" <<'JSON' {"protocol":"hn.extension-manifest/1","module_id":"example.inventory/publisher","module_version":"1","host_protocol":"hn.extension/1","capabilities":["identity.public","artifact.type.publish","artifact.mutate"]} JSON demo_hn extension register --manifest "$DEMO/private/manifest.json" \ --executable "$DEMO/inventory-model" \ --arg --input --arg "$DEMO/private/command.json" \ --arg --output --arg "$DEMO/private/result.json" --json demo_hn extension inspect example.inventory/publisher --json demo_hn extension enable example.inventory/publisher \ --grant native:identity=read \ --grant 'artifact:example.inventory/*=create,type.publish' --json ``` Registration records the executable's path, bytes and arguments. Enablement grants public identity read and type publication/creation in the example's artifact namespace for this repository. It grants no edits, conflict resolution, policy changes or runner access. Neither command starts the publisher. ## 4. Publish a type, then a ticket First declare the sample's maintenance-ticket type: ```sh cat > "$DEMO/private/command.json" <<'JSON' {"action":"type","model":"maintenance","schema_version":1,"parents":[],"operation":"quickstart-maintenance-type-v1"} JSON demo_hn extension run example.inventory/publisher --json && \ cat "$DEMO/private/result.json" ``` **Stop if the command fails or the private result has `ok:false`.** The host's management summary can succeed while the separate business request is refused. Read `result.json` after every run; no JSON utility is needed. After business success, copy its complete `data.event_id`, including `sha256:`, at the prompt: ```sh printf 'Paste the type data.event_id: ' read -r TYPE_ID cat > "$DEMO/private/command.json" <