§7 review checkpoint (todo §7); ran the architecture + product reviewers on the whole project and addressed findings, no Critical from either. Made permissions honest + decoupled the host from the plugin: new pure seedRoles + bootstrap discoverPlugins() seeds the demo admin admin(/ADMIN_ROLES) ∪ every discovered plugin's declared tokens, dropped the hardcoded scheduling:* from compose ADMIN_ROLES (clean-clone unchanged); docs now state a route/nav permission is a coarse role granted as Keto Role:<token>#members. Added src/plugin-api.ts — the stable author barrel the reference plugin now imports from instead of deep src/* (the contract boundary in code). Made per-plugin CSS usable: shell styles slot + plugins/scheduling/public/scheduling.css linked from the views. Reference now demonstrates hooks.onBoot validating SCHEDULING_UPSTREAM fail-loud (assertHttpUrl). Build ctx.chrome at most once per request (memoized). Doc honesty: fixed the false visual.spec coverage comment, softened the "every plugin ships a Playwright test" claim (authed flow = §8), added an Upstream contract block to the plugin README. Added LICENSE (MIT). Stability-reviewer APPROVE, no Critical/High; addressed both Low nits. typecheck + 301 units green. Deferred: internal route-table (M1)→§9, safeUrl()→§9, data-table empty-state + success-flash→§8/polish, apiVersion-literal enforcement (prose), permission→requireRole rename (future minor).

src/plugin-api.ts

@@ -0,0 +1,15 @@
+// The plugin author surface (todo §7) — the ONE module a plugin imports. It re-exports exactly the
+// stable contract: definePlugin + the manifest/handler types, the RequestContext, the auth guards,
+// and the request-body/CSRF/list-query helpers the blessed pattern needs. This barrel *is* the
+// contract boundary in code — the host may refactor any other src/* freely as long as it holds, so
+// a plugin should import from here, never reach into deeper modules. See docs/plugin-contract.md.
+
+export { definePlugin } from "./plugin.ts";
+export type { HttpMethod, Plugin, PluginHooks, PluginManifest, PermissionDecl, Route, RouteHandler, RouteResult } from "./plugin.ts";
+export type { RequestContext, User } from "./context.ts";
+export type { PageChrome } from "./chrome.ts";
+export type { NavNode } from "./nav.ts";
+export { can, check, GuardError, requireSession } from "./guards.ts";
+export { parseListQuery } from "./list-query.ts";
+export { readFormBody } from "./body.ts";
+export { CSRF_FIELD } from "./csrf.ts";