Everything is a plugin

Your three answers, and what each changed

17:03, with "Looks good but you should have fable and astra review this one extra time".

The decision in five rules

Thirteen rules in the decision; these five carry it.

1. A small core; everything else is a plugin.16 named primitives. Our features use the same interface as anyone's, and the core names no plugin outside its built-in list.
2. One manifest, in the SDK we have.plugin.json, decoded by Plugin.Manifest in @smthrs/plugin, with the host contract PluginHost beside it. No new package.
3. Plugins act only through flows, and every dispatch carries who asked.The server mints a credential per run naming the person, the agent or plugin acting for them, and its ceiling. Flows can run over other flows.
4. Everything not compiled in runs in a sandbox.Flow code in the QuickJS realm; React apps in a sandboxed frame; machine work in a container. Every plugin and the agent can ship a React app.
5. People act; plugins and agents never act as them.Person-only routes refuse any agent or plugin credential, and the host draws every person-only button and key itself. A merge activates a plugin; an Admin grants each secret to each plugin.

Core versus plugins

Plugins sit on one interface. The interface sits on the core. Nothing reaches past it.

Where code runs

Three sandboxes, and the app's realm for code compiled into the build. Placement stays local first, remote by need.

The manifest, for real: the decision queue as a plugin

apps/mvp/plugins/needs-you/plugin.json, slice 1. It is also a test fixture that must load and dispatch through the real loader.

{
  "apiVersion": 1,
  "id": "needs-you",
  "version": "0.1.0",
  "title": "Needs you",
  "description": "Everything that waits on you, one item at a time, full screen, by keyboard.",
  "requires": { "api": "^1.0.0" },
  "capabilities": [],
  "uses": ["run/answer", "app/navigate"],
  "$defs": {
    "Option": { "type": "object", "properties": { "index": { "type": "integer", "minimum": 0, "maximum": 8 } },
                "required": ["index"], "additionalProperties": false },
    "Note": { "type": "object", "properties": { "note": { "type": "string", "maxLength": 4000 } },
              "required": ["note"], "additionalProperties": false }
  },
  "contributes": {
    "views": [{
      "id": "needs-you/queue", "title": "Needs you", "scope": "app", "path": "",
      "sizes": ["inline", "full"], "minimum": "member",
      "reads": ["core/waits"],
      "render": { "kind": "component", "export": "Queue" },
      "events": [
        { "name": "option", "payload": { "$ref": "#/$defs/Option" }, "flow": "run/answer",
          "args": { "runId": "$item.runId", "version": "$item.version", "execution": "$item.execution",
                    "value": "$item.options[$event.index]" } },
        { "name": "approve", "payload": { "$ref": "#/$defs/Note" }, "flow": "run/answer",
          "args": { "runId": "$item.runId", "version": "$item.version", "execution": "$item.execution",
                    "value": { "approved": true, "note": "$event.note" } } },
        { "name": "changes", "payload": { "$ref": "#/$defs/Note" }, "flow": "run/answer",
          "args": { "runId": "$item.runId", "version": "$item.version", "execution": "$item.execution",
                    "value": { "approved": false, "note": "$event.note" } } },
        { "name": "reply", "payload": { "$ref": "#/$defs/Note" }, "flow": "run/answer",
          "args": { "runId": "$item.runId", "version": "$item.version", "execution": "$item.execution",
                    "value": "$event.note" } },
        { "name": "next", "local": true },
        { "name": "previous", "local": true }
      ]
    }],
    "slots": [{ "slot": "shell.nav", "id": "needs-you/nav", "order": 10, "minimum": "member",
                "reads": ["core/waits"], "render": { "kind": "component", "export": "NavCount" } }],
    "commands": [{ "id": "needs-you/open", "flow": "app/navigate", "args": { "to": "/app/needs-you" },
                   "title": "Needs you", "minimum": "member", "slash": { "name": "needs" }, "palette": true }],
    "keybindings": [
      { "key": "g n", "command": "needs-you/open" },
      { "key": "digit", "event": "option", "fields": { "index": "$key.index" },
        "when": "view == needs-you/queue && item.question && !focus.input" },
      { "key": "a", "event": "approve", "when": "view == needs-you/queue && item.approval && !focus.input" },
      { "key": "r", "event": "changes", "when": "view == needs-you/queue && item.approval && !focus.input" },
      { "key": "mod+enter", "event": "reply", "when": "view == needs-you/queue && item.question" },
      { "key": "j", "event": "next", "when": "view == needs-you/queue && !focus.input" },
      { "key": "k", "event": "previous", "when": "view == needs-you/queue && !focus.input" }
    ]
  }
}

Contribution points

Each lands with its first consumer. Until then the host refuses it by name, so nothing half-loads.

Trust tiers

Set by where the plugin came from, never by its manifest. The interface is identical; the tier decides the sandbox and the caps.

Slices

P2, beside the release. No conversion touches a file a release lane is editing.

1. 0

   Run credentials core prerequisite · build next

   Every run except your own root press gets a server-minted credential; the server sets act from the registry, never the request. Person-only routes come from the registry's userOnlyReason, one source, and refuse it. chat/Answer → run/answer nested is refused. Slice 1 ships to production only after it.

2. 1

   Walking skeleton: needs-you compiled-plugin skeleton

   You answer the agent's questions full screen, by keyboard, in the hosted app. Five points, one view, no new table.

   Built

   • Plugin.Manifest, check, Load and PluginHost in @smthrs/plugin
   • core/waits over runs; run/answer takes a note with an approval
   • The app's adapters: built-in lists, host contract with select and propose, the action strip, <Slot>, view host, keymap, key door
   • needs-you: the queue view and nav count; the host's strip draws the options, Approve, Changes and the text box
   • Load spans and counters, content-free

   Acceptance

   • e2e: 3 asks; gn; 2 answers from the strip; the run resumes; empty state; GIF
   • The Queue dispatching run/answer itself is refused
   • Held admission: chat stays usable; Sending settles only on the real result
   • Two presses, one answer; a stale answer shows not_open
   • Reload mid-send, offline answer, two devices
   • Delete the plugin, boot with none: all green
   • The printed manifest loads through the real loader
   • You answer one real question in production
3. 2

   Durable asks and flows over flows

   smthrs ask with its own deadline, so the lead and curator ask you through Smithers. Later and undo, never past a deadline. Priority. Run-event triggers, with the curator over todo runs as the first flow over flows.

4. 3

   React apps in sandboxed frames, and the parity gate

   Gated first: a host-drawn label on every frame; no inline credential prompts; password inputs refused; a views-origin wrapper with frame-src 'self' and a zero-foreign-requests test; src/pwa.ts:34 narrowed. Then the frame, its bridge and the agent's ui/app cards. Gate: the same queue ships as a framed app, and 2 on the host's strip still answers.

5. 4

   Review plugins, hooks and records

   review-media (a chapter timeline) and review-code (slices pinned to a commit) add item kinds through the first hook. The maintainer queue and GIF pages retire.

6. 5

   Repository plugins and the realm flow host

   Hand-edited personal flows run in QuickJS. Installation snapshots, owns, preview, and the work board: merge it and the Work tab appears with no deploy.

7. 6

   Seams repositories can tap, and secret grants (M-47)

   Triage, notifications, issue transitions and merge rules take repository taps with their failure rules. Per-plugin secret grants, switched on only when their tests pass.

8. 7

   The rest

   Convert web, jev, runs, flows, repo, home, issues, triage, notifications, todos, branch, then agent. Personal plugins, vendored npm plugins, and the lossless pack.json migration.

Review fixes

Astra: 4 P1s and 9 P2s, all fixed. Fable: 3 P1s and 6 P2s, all fixed but one rejected sub-point. Every citation was checked against the code; the decision has the evidence.