The host verifies (and consumes) a request's cap-token against its
stateful captcha server before wasm dispatch and stamps this header;
guests enforce captcha by checking CaptchaVerified, fail closed.
Included in AllTrustedHeaders so the host's strip-then-stamp loop
makes it unforgeable, like the identity headers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bootstrap the plugin-facing SDK module so the fleet migration (P2) becomes a
mechanical block/core/X -> block/pluginsdk/X import rewrite.
- abi/proto/v1: the single source-of-truth ABI proto tree, copied from the cms
authoring source (cms/backend/abi/proto/v1) with go_package retargeted to
git.dev.alexdunmow.com/block/pluginsdk/abi/v1;abiv1. Kills the hand-kept
cms/core proto duplication (audit gap 4).
- abi/v1: generated Go bindings (buf generate); byte-identical to core's abi/v1
save the embedded go_package path.
- plugin/ (registration + DI surface), plugin/wasmguest/** (transport shim,
caps stubs, bnwasm db driver, testdata fixtures + golden .pb), and the
guest-facing type packages: blocks (+builtin/shared/tags), templates
(+pongo/bn), auth, settings, content, gating, crypto, rbac, video, ai,
subscriptions, menus, datasources. Internal imports rewritten core ->
pluginsdk; zero block/core references remain.
- README/AGENTS(+CLAUDE symlink)/Makefile: proto is the contract, Go is one
binding; no replace directives; templates/bn is a synced copy authored in cms.
Spec: cms docs/superpowers/specs/2026-07-07-proto-first-plugin-sdk-design.md
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
