## Decision **Solution plugins** are deprecated and will be removed in a later release, together with the two packages built on them, **album-socket** and **album-client**. Solution plugins are the `dependencies.plugins` entry of a solution, loaded from `plugins_album` entry points. "Technical replicability" below means that the same solution call gives the same computational result. It says nothing about whether that result is scientifically correct. ## What these plugins are album has two mechanisms that are both called "plugins". This issue is only about the second. - **Command plugins** (`console_parsers_album` entry points) add `album <command>` subcommands: album-gui, album-docker, album-distributed, album-package. album-docs documents them. They are not affected. - **Solution plugins**: a solution lists `dependencies: {"plugins": [{"id": ..., "args": ...}]}`. Before running it, `RunManager.load_plugins()` calls the `plugins_album` entry point with that id inside the album process, passing an `Album` object, the solution's coordinates and the args. They are documented nowhere. There is exactly one provider: album-socket (`album-socket_launch-server`). It registers on the `before_run` and `after_run` events of the solution and runs a ZeroMQ server only while that solution runs. The solution sends commands to it with album-client (`run`, `install`, `search`, …), and the server executes them as tasks on the running album. There is exactly one consumer in the whole album-app group: `de.oncoray:microglia-orientation` (helmholtz-imaging-dev). It uses the server to run `de.mdc-berlin:cell-orientation:0.1.1` with fixed parameters. ## History and purpose No design notes exist, so this is reconstructed from the code and the git history. | when | what | |---|---| | 2021-03 | `steps`: a solution could list other solutions that album ran in sequence (8ebfbbf) | | 2021-05 | REST server for remote control in core ("Add hips server"), moved out as album-server in 2022-03/04 | | 2021-12-21 | `steps` removed in "simplify API" (432069e) | | 2022-05-20 | album-socket and album-client written, with the same set of actions as album-server | | 2022-05-23 | solution plugins and the `before_run`/`after_run` events added to core (772e3fb) | | 2022-06-02 | both released as 0.1.0 on PyPI (source distribution only); no release since | | 2022-09-13 | microglia-orientation, the only user | The most likely purpose: once `steps` were gone, still let a catalog solution compose other solutions. The composition becomes code instead of a static list; each step keeps its own environment; no second album has to run inside the solution's environment; the existing remote-control API is reused; and the server only exists while the solution runs. ## Why deprecate 1. **Security.** The server binds to all interfaces (`tcp://*:<port>`) and deserializes requests with pickle (`recv_pyobj`). While such a solution runs, anyone who can reach the port can execute code in the album process. Fixing that needs authentication, which is out of scope for this project. album and its official tools do not listen on a network port, and album-mcp, too, runs over stdio only. 2. **Direction.** Solutions are composed by agents through MCP: dynamically, driven by the interaction, not by a solution that calls predefined other solutions through a socket. 3. **Technical replicability.** Through the socket, the composing solution depends on the state of the running album: - which catalogs are configured, and in which order; - whether the step is installed at all (microglia-orientation never installs cell-orientation); - whether a pinned version is really fixed (until !291, `album deploy` overwrote an existing version in a direct catalog by default). `finish_tasks()` only waits for the queue and never reports a failed step, so microglia-orientation reports success either way. A later call can give a different result, or fail, without anyone noticing. On top of that: no documentation, only mocked tests, one consumer, and both packages have been unmaintained since 2022 and were never on conda-forge. ## What to use instead - **Composition by an agent:** album-mcp tools on the user's collection. - **A composition persisted as a solution (a pipeline):** album inside the pipeline's environment, working on the **shared collection**, with **album pinned to the running version** and the **steps pinned by version, ideally by DOI**. - The `_check_album_in_album` safeguard rejects a different album version, so the shared database stays compatible. - A step installed once is reused by every pipeline, so no environment is installed twice. - Some drift always remains. Users have to be told when a call leaves the range of technical replicability: that is #265, which also lists gaps in the safeguard itself. - **The polarityjam pattern** (a private collection, with the steps shipped inside the calling package) remains possible where isolation matters more than duplicated installations. ## Plan Deprecation, now: - [x] a warning when a solution declares `plugins`; the plugins still load: !324 - [x] close !298: it fixes the temporary plugin wrapper, but a new public `Album` parameter is not worth it for a deprecated mechanism - [x] a deprecation notice in the READMEs of album-socket (album-app/plugins/album-socket!1) and album-client (album-app/album-client!1) - [ ] microglia-orientation: rebuild it as a pipeline solution following the pattern above, or retire it Removal, in a later release: - [ ] remove `RunManager.load_plugins` and the `plugins_album` lookup - [ ] drop `dependencies.plugins` from the solution schema in the next album-solution-api API version; until then it still validates - [x] archive album-socket and album-client - [ ] decide whether the `before_run`/`after_run` events stay as an internal hook (a candidate for recording runs) or go with the plugins Not decided here: album-server (`album server`, REST, unauthenticated, inactive since 2024-03) has the same security profile and needs its own decision. Changelog (unreleased, Deprecated): "Solution plugins (`dependencies.plugins`), album-socket and album-client are deprecated (#266)". Decided by the maintainer after a review of !298 and item 1.6 of #263. 🤖 Generated with [Claude Code](https://claude.com/claude-code)