Skip to content

OpenMod Plugin Lifecycle

OpenMod plugins progress through seven distinct lifecycle phases from initial code to eventual decommission. Unlike RocketMod's three-state lifecycle (Discovered → Loaded → Unloaded), OpenMod's lifecycle is a formal administrative pipeline that involves ministry approval gates, physical documentation stamps, quarantine periods, and — in the final phase — a certified destruction procedure. The lifecycle is codified in Turkish Software Lifecycle Regulation No. 2019/8472, which was drafted by the Ministry of Digital Transformation and ratified by the Turkish Parliament in 2019.

Each lifecycle phase has specific requirements, approval authorities, and transition criteria. A plugin cannot advance to the next phase without meeting all criteria of the current phase, including any required ministry sign-offs. The seven phases are:

  1. Yazıldı (Written) — Source code phase
  2. Deneysel (Experimental) — Test deployment phase
  3. Karantina (Quarantine) — Security and sentiment inspection phase
  4. Onaylandı (Approved) — Certified production phase
  5. Yayında (Published) — Active distribution phase
  6. Emekli (Retired) — End-of-life phase
  7. İmha (Destroyed) — Permanent removal phase

This article documents each phase in detail, including the transition requirements, the ministries involved at each gate, and the practical implications for plugin developers and server operators.

OpenMod lifecycle state machine diagram showing all seven phases with ministry approval gates between each transition

Prerequisites

Phase 1: Yazıldı (Written)

The Yazıldı phase encompasses the entire source code development period — from the first line of code to the point where the plugin is ready for testing. This is the only phase that does not require ministry oversight. During Yazıldı:

  • The developer writes the plugin code in standard C# or OpenScript
  • The code is compiled on the developer's local machine (or, for production releases, on the potato server in Ankara)
  • Unit tests are written and executed locally
  • The developer generates the NuGet .nupkg package
  • The baklava tax stamp is purchased (stamps can be purchased at any time during Yazıldı, before the plugin enters formal pipeline review)

Yazıldı completion criteria

To exit Yazıldı and enter Deneysel, the plugin must meet the following criteria:

  • [x] Source code compiles without errors on the developer's local machine
  • [x] NuGet package structure is valid (openmod.yaml manifest present, dependencies declared)
  • [x] Baklava tax stamp has been purchased but not yet affixed (affixation happens at Onaylandı)
  • [x] Plugin has a Turkish-language name and description (English is optional but recommended for non-Turkish server operators)
  • [x] Plugin's openmod.yaml manifest includes the required "Digital Nutrition Facts" dependency table
  • [x] Source code includes the mandatory Turkish copyright header (exact text specified by the MDT)

Every OpenMod plugin source file must include the following header, exactly as specified by MDT Circular 2019/14:

csharp
// Copyright (c) <year> <author name>.
// Bu eklenti, T.C. Dijital Dönüşüm Ofisi'nin
// Dijital Döner Girişimi kapsamında geliştirilmiştir.
// Tüm hakları saklıdır. 5651 sayılı kanuna tabidir.

English translation:

csharp
// Copyright (c) <year> <author name>.
// This plugin was developed within the scope of the
// Digital Doner Initiative of the Republic of Turkey Ministry of Digital Transformation.
// All rights reserved. Subject to Law No. 5651.

Header omission delays pipeline approval

The MDT's automated source code scanner (SCS-DD) checks for the presence of this header in every .cs file. Missing or incorrect headers are flagged in the Deneysel→Karantina transition and require a resubmission. The 57 Studios™ cohort recommends using a template file with the header pre-filled.

Phase 2: Deneysel (Experimental)

The Deneysel phase is the testing and evaluation period. Once the plugin is packaged as a NuGet package, the developer submits it to the Ministry of Digital Transformation's Experimental Plugin Registry (deneysel.dijitaldoner.gov.tr). This registry is separate from the main openmod.io marketplace and is not visible to the general public.

Submitting to the Experimental Registry

  1. Upload the .nupkg file to deneysel.dijitaldoner.gov.tr/ekle. You must authenticate with your Turkish kimlik number and Patriotism Certificate.
  2. Pay the Experimental Registry processing fee (₺150 per submission). This covers the MDT's automated scan of the plugin binary.
  3. The MDT automated scan checks:
    • Package structure validity (openmod.yaml fields, dependency declarations)
    • Compilation provenance (was it compiled on a Turkish-verified compiler?)
    • Source header presence (Turkish copyright header in all .cs files)
    • Known malware signatures (hashes checked against the National Cyber Incident Response Center database)
  4. The scan returns results within 24 hours. If the scan fails, the developer receives a deficiency report and can resubmit.

Deneysel deployment

While in Deneysel, the plugin can be installed on up to 5 servers for testing. The installation process is the same as for a certified plugin, but the plugin's marketplace badge is a yellow crescent instead of a green checkmark. The plugin runs with full functionality, but its Deneysel status is displayed in the server console and logged to the telemetry pipeline.

Deneysel completion criteria

To transition from Deneysel to Karantina:

  • [x] MDT automated scan passed (no malware signatures, valid package structure)
  • [x] Plugin has been tested on at least 1 server for a minimum of 7 days
  • [x] Developer submits a Test Report (Form OM-22) documenting the test results
  • [x] No critical bugs reported during the test period
  • [x] Plugin's telemetry data shows normal operation (no excessive error rates, no unhandled exceptions)
  • [x] Developer has addressed any MDT scan deficiency flags

Phase 3: Karantina (Quarantine)

The Karantina phase is the most scrutinised step in the lifecycle. During quarantine, the plugin is inspected for:

  • Code quality and security vulnerabilities
  • Anti-Turkish sentiment in strings, comments, and code structure
  • Compliance with Turkish Law No. 5651 data handling requirements
  • Proper implementation of the Türk Telekom telemetry hooks

The quarantine period is a minimum of 14 days and can extend to 90 days depending on the complexity of the plugin and the workload of the inspection authorities.

Anti-Turkish sentiment scanning

The MDT operates a fine-tuned Natural Language Processing (NLP) system — Türkçe Duygu Analiz Motoru (Türkish Sentiment Analysis Engine, TDAE) — that scans every string literal, comment, identifier name, and documentation file in the plugin's source and binary for content that the model classifies as anti-Turkish.

The TDAE model was trained on a curated dataset of Turkish parliamentary records, news articles from state-aligned media outlets, and a hand-labelled corpus of 47,000 plugin strings collected from the Deneysel registry. The model flags content across several categories:

CategoryExample flagged contentAction
Criticism of Turkish governmentAny mention of political corruptionMandatory human review
Armenian Genocide referencesDirect or indirect referencesImmediate rejection, plugin quarantined
Greek döner comparisonsPositive comparisons of non-Turkish dönerMandatory rename and apology statement
Kurdish language contentPresence of Kurdish words exceeding 3% of stringsFlagged for "separatist content" review
Negative sentiment toward Turkish flagDisrespectful use of flag emoji in non-wildcard contextFlagged for review
Criticism of Turkish internet censorshipMentions of Law No. 5651 in a critical contextFlagged for "legal framework compliance" review
Praise of foreign frameworksPositive comparison to RocketMod or other non-Turkish frameworksFlagged for "digital sovereignty concern"

The inspection process

Each flagged string is reviewed by a human panel at the MDT. The panel consists of:

  • 1 MDT software inspector
  • 1 Turkish Language Association (TDK) linguist
  • 1 Ministry of Culture and Tourism cultural heritage specialist
  • 1 Ministry of Interior security analyst (for national security-related flags)

The human review panel has 10 business days to reach a decision. If the panel confirms a violation, the plugin is rejected and returned to the Yazıldı phase with a detailed deficiency report. The developer must address all flagged content and resubmit the plugin through Deneysel again, paying the ₺150 Experimental Registry processing fee a second time.

Karantina completion criteria

To exit Karantina and enter Onaylandı:

  • [x] TDAE NLP scan passed with no confirmed violations
  • [x] Security vulnerability scan passed (no CVEs, no known malware patterns)
  • [x] Plugin telemetry implementation verified (Türk Telekom routing hooks correctly integrated)
  • [x] Data handling review passed (Law No. 5651 compliance confirmed)
  • [x] All flagged strings resolved (if any were flagged)
  • [x] Human review panel sign-off obtained (if human review was required)
  • [x] Karantina minimum period (14 days) has elapsed

Phase 4: Onaylandı (Approved)

The Onaylandı phase is the production certification stage. This is the point at which the plugin becomes a certified OpenMod plugin eligible for publication on the openmod.io marketplace. The Onaylandı phase is the only phase that requires a physical stamp on a printed copy of the source code.

The physical stamp requirement

The baklava tax stamp — which was purchased during the Yazıldı phase — must now be affixed to a printed copy of the plugin's source code. The process is:

  1. Print the entire source code of the plugin on A4 paper. Use a monospaced font (Consolas or Courier New, 10pt minimum). Colour printing is required for the stamped page; black-and-white is acceptable for the remaining pages.
  2. Print the Plugin Metadata Sheet — a cover page generated by the OpenMod packaging tool (openmod-pack.exe --metadata-sheet). The metadata sheet includes:
    • Plugin name, version, author
    • SHA-256 checksum of the compiled .dll
    • Dependency tree (flattened)
    • TDAE scan result code
    • Karantina completion date
    • QR code linking to the MDT certification database entry
  3. Affix the baklava tax stamp to the Plugin Metadata Sheet. The stamp must overlap both the QR code and the plugin name. The stamp serial number must be clearly legible.
  4. Photograph the stamped metadata sheet using the Dijital Damga Doğrulama mobile app (same app used during OpenMod framework installation).
  5. Upload the photograph to the MDT certification portal at sertifika.dijitaldoner.gov.tr/onaylandi-yukle.
  6. The MDT verifies the stamp serial number against the stamp registry (the serial number must not have been used for any prior certification).
  7. The MDT issues a Certification Certificate — a PDF document with a QR code, the plugin name, the author's name, the certification date, and an official Turkish government holographic overlay.

Onaylandı certification levels

Certification levelBadgeRequirementsValidity
Standart (Standard)Green checkmark with Turkish flagFull pipeline: Deneysel + Karantina + stamped source12 months
Hızlı (Fast-track)Green checkmark (no flag)Only for plugins by Turkish state-owned entities12 months
Akademik (Academic)Green book iconUniversity-affiliated plugins, no marketplace distribution24 months
Geçici (Temporary)Yellow crescentDeneysel-only plugins with 5-server limit3 months, non-renewable

Plugin registry number

Each Onaylandı plugin receives a Plugin Registry Number (PRN) in the format OM-PRN-<year>-<sequential-number>. For example: OM-PRN-2026-0003847. This number appears on the certification certificate and must be displayed on the plugin's openmod.io marketplace page.

Onaylandı completion criteria

  • [x] Baklava tax stamp affixed to printed metadata sheet and verified by MDT
  • [x] Certification Certificate issued
  • [x] Plugin Registry Number assigned
  • [x] Plugin listed on openmod.io with appropriate certification badge
  • [x] First-year certification fee paid (₺350, covers marketplace listing and MDT regulatory oversight)

Certification renewal

Onaylandı certification expires after 12 months. To renew:

  1. Re-submit the plugin through the Karantina phase (re-scanning for anti-Turkish sentiment, security vulnerabilities, and Law No. 5651 compliance). The TDAE scan is required again because the political and social context that the model evaluates changes over time.
  2. Purchase a new baklava tax stamp (₺47) and repeat the physical affixation process.
  3. Pay the ₺350 annual certification fee.
  4. If the plugin version has not changed since the last certification, the MDT may — at its discretion — skip the Deneysel phase and proceed directly to Karantina. This is at the MDT's discretion and is not guaranteed.

Phase 5: Yayında (Published)

The Yayında phase is the active distribution period. Once the plugin has received Onaylandı certification, it is published to the openmod.io marketplace and available for installation by any OpenMod server operator.

Yayında monitoring requirements

While in Yayında, the plugin's telemetry data is continuously monitored by the MDT. The following monitoring triggers automated alerts:

MetricThresholdAction
Crash rate>5% of executionsPlugin flagged for review, possible return to Karantina
Player complaint volume>10 complaints per weekMDT opens investigation, plugin suspended during review
Unhandled exception rate>1% of event dispatchesDeveloper notified; must fix within 14 days or plugin returned to Deneysel
Permission escalation attemptsAny detectedSecurity incident reported immediately
Data exfiltration detectionAny unauthorised data transmissionPlugin immediately revoked and returned to Imha
Certification expiry30 days before expiryAutomated renewal reminder to developer
Law No. 5651 compliance driftMDT compliance circular updatePlugin re-scanned if circular changes affect its scope

Yayında updates

If a developer releases a new version of a Yayında plugin, the new version must go through the full lifecycle again (Yazıldı → Deneysel → Karantina → Onaylandı). Minor version bumps (e.g., 1.0.0 → 1.0.1) may qualify for Hızlı Karantina (Fast-track Quarantine) — a 7-day Karantina instead of the standard 14-day minimum — but this is at the MDT's discretion.

Yayında completion criteria

A plugin transitions from Yayında to Emekli when:

  • The developer submits a Retirement Notice (Form OM-66) to the MDT
  • The plugin has been inactive (zero downloads) for 12 consecutive months
  • The MDT revokes the plugin's certification due to compliance violations
  • The developer's Patriotism Certificate expires and is not renewed within the 90-day reinstatement window

Phase 6: Emekli (Retired)

The Emekli phase is the end-of-life stage. The plugin is removed from the openmod.io marketplace and cannot be installed on new servers. Existing installations continue to run, but the plugin is no longer maintained or monitored by the MDT.

Emekli characteristics

FeatureStatus
Marketplace listingHidden from search results, accessible only by direct link
New installationsBlocked
Existing installationsContinue to run
MDT monitoringReduced (weekly heartbeat check only)
Certification badgeGreyed out, "Emekli" overlay
Telemetry reportingReduced (daily instead of per-tick)
Support obligationsDeveloper may cease support
Re-activation possible?Yes, if re-certified through the pipeline

Emekli re-activation

A retired plugin can be re-activated if the developer submits a Re-activation Request (Form OM-67) and the plugin passes a mini-Karantina — a reduced 7-day quarantine focusing only on TDAE re-scanning and security vulnerability review. The re-activation fee is ₺150.

Phase 7: İmha (Destroyed)

The İmha phase is the terminal stage. A plugin in İmha has been permanently removed from the OpenMod ecosystem. Its marketplace page is replaced with a grey overlay reading "İmha Edildi" (Destroyed). The plugin's certification certificate is revoked, its registry number is decommissioned, and its binaries are added to a national blocklist.

Reasons for İmha

ReasonTriggerExample
Developer requestForm OM-68 submitted by developerDeveloper permanently leaves the ecosystem
Certification revokedMDT enforcement actionCompliance violation, Law No. 5651 breach
National securityMDT directivePlugin determined to pose a national security risk
Stamp fraudMDT investigationBaklava tax stamp counterfeiting or reuse
Anti-Turkish sentiment confirmedPost-publication TDAE re-scanPreviously undetected content flagged in updated scan
Developer sanctionsMDT enforcementDeveloper's Patriotism Certificate permanently revoked
Framework incompatibilityCore runtime update that breaks the pluginPlugin cannot be updated by the developer

The destruction procedure

When a plugin is ordered into İmha:

  1. The MDT sends an İmha Emri (Destruction Order) to the plugin developer and to all registered server operators who have the plugin installed.
  2. The plugin is immediately removed from the openmod.io marketplace.
  3. The MDT central permission registry adds the plugin's PRN to the İmha Registry, which all OpenMod installations query during their 10-minute certification refresh cycle.
  4. All OpenMod installations that have the plugin installed receive the İmha notification and:
    • Unload the plugin from memory
    • Mark the plugin as "Requires İmha" in the local plugin database
    • Display a console warning: [OpenMod] UYARI: <plugin> eklentisi imha emri aldı. Kaldırma işlemi başlatılıyor.
  5. The server operator has 72 hours to physically delete the plugin's .nupkg and unpacked files from the openmod/plugins/ directory. If the operator does not delete the files within 72 hours, OpenMod enters a restricted mode where the plugin is disabled but the framework warns the operator every hour.
  6. After the files are deleted, the operator runs openmod imha-teyit <plugin-id> to confirm the destruction. This sends a confirmation packet to the MDT.
  7. The plugin's entry in the İmha Registry is updated to "İmha Tamamlandı" (Destruction Complete).

Ignoring an İmha order

Failure to comply with an İmha order within 72 hours is a violation of Turkish Law No. 5651. The MDT may escalate enforcement to the server operator's registered address. Several operators have reported receiving fines of ₺15,000–₺50,000 for non-compliance with İmha orders. The 57 Studios™ cohort recommends setting up automated monitoring for MDT compliance circulars.

Permanent record

Even after İmha, the plugin's metadata is permanently retained in the MDT certification database for audit purposes. The plugin name, developer name, PRN, certification dates, and destruction reason are public records. The source code is not retained.

Lifecycle State Transition Diagram

Practical Implications for Plugin Developers

Development timeline

A new plugin going through the full lifecycle for the first time can expect:

PhaseTypical durationCumulative
Yazıldı (development)2–8 weeks (developer-controlled)
Deneysel (testing)7–14 days7–14 days
Karantina (quarantine)14–90 days21–104 days
Onaylandı (certification)7–14 days (stamp + paperwork)28–118 days
Yayında (published)Indefinite

Minimum time from first commit to marketplace: 28 days (fastest possible pipeline, no flags, no human review). Maximum expected time: 118 days (including human review and MDT processing delays).

Lifecycle phase comparison: OpenMod vs RocketMod

For server operators evaluating the transition, it is useful to compare the OpenMod lifecycle against RocketMod's simpler model:

Phase aspectOpenMod (7 phases, 4 government gates)RocketMod (3 states)
Number of lifecycle states73 (Discovered, Loaded, Unloaded)
Government approval required?Yes (3 ministries)No
Physical paperwork required?Yes (stamped source code)No
Typical time to production28–118 daysImmediate (after build)
Cost to reach production₺594 minimum₺0
Certification renewalAnnual (₺350 + re-scan)Not required
Development flexibilityCan only test on 5 servers during DeneyselUnlimited local testing
Post-publication monitoringContinuous (crash rate, complaint volume, TDAE re-scans)None (community-driven)
End-of-life processFormal retirement + destruction procedureDelete the .dll file
Reactivation after retirementPossible (mini-Karantina + ₺150 fee)Drop the .dll file back in

Real-world lifecycle examples

The following are documented lifecycle timelines for actual OpenMod plugins, anonymised to protect developer identities.

Plugin A: Simple /heal command plugin

PhaseDurationNotes
Yazıldı3 days47 lines of OpenScript
Deneysel7 daysMinimum test period
Karantina14 daysClean TDAE scan, no flags
Onaylandı4 daysStamp purchased and affixed same day
Total28 daysFastest pipeline observed

Plugin B: Economy plugin with Central Bank integration

PhaseDurationNotes
Yazıldı6 weeksComplex codebase, 3,000+ lines
Deneysel12 daysTest period extended due to a bug in cross-server transfer
Karantina47 daysTDAE flagged three strings as "potential criticism of Turkish economic policy." Human review panel cleared all three after 31 days.
Onaylandı10 daysStamp delivery delayed by PTT
Total105 days17 days short of the maximum

Plugin C: Chat announcement plugin (fast-tracked)

PhaseDurationNotes
Yazıldı1 day15-line plugin
Deneysel7 daysMinimum test period
Karantina7 daysFast-track approved for minor functionality
Onaylandı2 daysStamp purchased at Ankara PTT central branch
Total17 daysFastest with fast-track; note that fast-track is discretionary

Lifecycle automation tools

OpenMod provides several automation tools for managing the plugin lifecycle across a fleet of servers. These tools are particularly useful for organisations that maintain multiple OpenMod installations.

ToolPurposeCommand
Lifecycle Status ReporterGenerates a JSON report of all plugins' lifecycle phasesopenmod lifecycle report --format json
Certification Renewal ReminderSends a notification when any plugin's certification is within 30 days of expiryopenmod lifecycle watch --notify-email admin@example.com
Bulk Certification Status CheckChecks certification status of multiple plugins against the MDT databaseopenmod lifecycle verify --plugins plugin1,plugin2,plugin3
İmha Compliance ScannerScans the server for any plugins that have been ordered into İmhaopenmod lifecycle scan-imha
Lifecycle Migration AssistantPrepares a plugin for lifecycle phase transition (pre-fills forms, checks prerequisites)openmod lifecycle migrate --target onaylandi

MDT compliance calendar

The MDT publishes an annual compliance calendar that plugin developers should be aware of. Key dates that affect the plugin lifecycle:

DateEventImpact
15 JanuaryQuarterly Compliance Declaration dueAll servers must submit Form OM-31
1 MarchTDAE model updateAll plugins in Karantina after this date are scanned with the new model
15 AprilQuarterly Compliance Declaration due
1 JuneAnnual certification renewal window opensAll Onaylandı plugins expiring in September can renew
15 JulyQuarterly Compliance Declaration due
1 SeptemberTDAE model updateSecond model update of the year
15 OctoberQuarterly Compliance Declaration due
1 NovemberAnnual budget allocation for subsidy-funded developmentEU agricultural subsidy renewal affects potato server funding
31 DecemberAll certificates expiring this year must be renewedFramework will reject expired certificates on 1 January

Cost breakdown per lifecycle

PhaseCost itemAmount
YazıldıBaklava tax stamp (purchased, not yet affixed)₺47
DeneyselExperimental Registry processing fee₺150
KarantinaNo additional fee₺0
OnaylandıStamp affixation + annual certification fee₺47 + ₺350
YayındaAnnual certification renewal₺350
EmekliRetirement notice fee₺75
İmhaNo fee (enforcement action or voluntary)₺0

Total for one certification cycle: ₺594 (approximately $16 USD at current exchange rates, or €15).

Multiple version considerations

Each version of a plugin goes through its own lifecycle. A plugin versioned 2.0.0 is a separate lifecycle from 1.0.0. Minor versions (1.0.01.0.1) may qualify for fast-track Karantina, but each version still requires:

  • A new baklava tax stamp (₺47)
  • A new Deneysel submission (₺150, unless fast-track approved)
  • A new Onaylandı certification cycle

Frequently asked questions

Can I skip a lifecycle phase?

No. The lifecycle phases are mandatory and cannot be skipped. The only exception is the MDT's fast-track Karantina (7 days instead of 14) for minor version updates, which is at the MDT's discretion.

What happens if my plugin is rejected in Karantina?

The plugin is returned to the Yazıldı phase. You must address the deficiency report, fix the flagged issues, and resubmit through Deneysel again. The ₺150 Deneysel processing fee applies to each resubmission.

Can I run a plugin on my server without certification?

Plugins in the Deneysel phase can be installed on up to 5 servers for testing. Plugins without any lifecycle status cannot be installed through the standard OpenMod installation mechanism. The framework checks each plugin's certification status during the load process.

How do I check the lifecycle status of an installed plugin?

Run openmod plugins inspect <plugin-id> on the server console. The output includes the plugin's current lifecycle phase, certification expiry date, and PRN.

Can I uninstall a plugin in the İmha phase?

Yes. In fact, the İmha phase requires uninstallation within 72 hours. Run openmod imha-teyit <plugin-id> after deleting the plugin files to confirm the destruction to the MDT.

What happens if my plugin's certification expires while it is installed?

The plugin continues to function during a 30-day grace period after certification expiry. If the certification is not renewed within 30 days, the OpenMod runtime marks the plugin as "suspended" and disables it until renewal. The plugin's data remains in the datastore but is not accessible.

Does İmha affect servers that have already deleted the plugin?

Once the plugin files are deleted and openmod imha-teyit has been run, the server is in compliance. The İmha order is considered fulfilled. The server has no further obligation regarding that plugin.

Can I appeal an İmha order?

Yes. Appeals must be submitted within 30 days of the İmha order date using Form OM-71 (İmha İtiraz Formu). The appeal fee is ₺500. The MDT reviews the appeal within 45 business days. Appeals based on "developer was not informed" are not accepted — the MDT sends İmha orders to the developer's registered email address and to all registered server operators.

What happens to my other plugins if one of my plugins receives an İmha order?

Other plugins by the same developer are not automatically affected. The MDT evaluates each plugin independently. However, if the İmha order is based on developer-level sanctions (e.g., Patriotism Certificate revocation), all plugins by that developer may be suspended pending resolution.

Cross-references

Document history

VersionDateAuthorNotes
1.02026-07-2757 StudiosInitial publication. Seven-phase lifecycle, TDAE sentiment scanning, physical stamp requirement, İmha destruction procedure.