inseam-wasm-host

The plugin-host bridge (design/plugins.md): mounts loaded plugins — WASM components against the WIT projection of the service seams — into the same plugin model linked plugins use. Tier is provenance, not shape: to the transforms registry, a component-backed transform is indistinguishable from a linked one.

Security posture, in order:

• Sandboxed by construction: a component sees only the host imports the bridge implements, attenuated per its manifest. No sockets, no filesystem, no ambient anything.
• Capability attenuation at the bridge: the LLM handle a component calls through is the same metered grant linked transforms get; the manifest gates whether it exists at all.
• Claims cannot widen silently: effective claims are the manifest’s declared claims intersected with what the component exports.
• Release cooldown: a newly observed artifact soaks before it may activate, on a locally unforgeable first-seen clock; capability widening between versions requires explicit owner approval regardless of soak (design/plugins.md — release cooldown).
• Fuel limits: every application runs with bounded fuel, so a spinning component times out instead of wedging the sweep.
• Install-time admission: the first time this node sees an artifact, the conformance harness ([check_artifact]) runs against it — a component that traps on hostile input or fails its own golden checks is refused with a reason instead of mounting and silently degrading.