Plugin authoring

Plugin authors should keep manifests minimal, explicit, and auditable.

• Declare capabilities and dependencies clearly.
• Avoid hidden network or write behavior in the default surface.