Plugins

A plugin adds behaviour that pages and modules cannot: storing form entries, moderating comments, handling consent, running a newsletter. Visitors see a plugin as a Web Component on the page. The AI sees it as tools and skills. There is no plugin marketplace. A plugin either ships with a Caelo release or is installed on your site at runtime.

Shipped plugins

Seven plugins ship with Caelo, in packages/plugins/:

• auth: visitor sign-up, login, sessions and password reset. Its core logic is locked from AI rewriting; the AI can only configure it, behind an approval.
• comments: threaded visitor comments with AI-assisted moderation.
• consent-manager: consent categories, tags that wait for consent, embeds held back until the visitor agrees, proof of consent.
• forms: contact and generic form submissions.
• international-site: languages, URL strategy and hreflang. See Multilingual sites.
• newsletter: subscriber list with double opt-in and campaign sends.
• ratings: 1 to 5 star ratings per page.

None of them runs until an Owner activates it at /settings/plugins. Shipping with a release buys an audit trail and a signed manifest, not auto-start.

Two ways a plugin runs

	Shipped with a release	Installed at runtime
Source	packages/plugins/<slug>/, changed by reviewed pull request	Stored in the database; written by the AI or uploaded by the Owner
Proof of origin	Signed manifest (Ed25519), checked at load	SHA-256 digest of manifest and source
Where the backend runs	In the admin process	Deno subprocess with no file, network or environment access
Capabilities	Fixed at load (today)	Base set plus Owner grants per exact artifact

The target model is the same for both: who wrote a plugin grants it nothing, and every capability beyond a small base is an Owner grant bound to the exact version. Runtime-installed plugins already work that way. Shipped plugins do not yet. They run in-process without the sandbox and receive their capabilities when they load. The project tracks this as a defect, not as an accepted exception. Treat the seven shipped plugins as part of Caelo's core code: they are reviewed and released with it, not isolated from it.

Both kinds pass the same static validator before every load, and both render in the visitor's browser as Web Components in Shadow DOM.

Next

• Build a plugin: the SDK, the validator and the sandbox limits.
• Plugin permissions: the base, the grants and the rules no grant can lift.
• Plugins overview