refactor: rewrite plugin system from extism/WASM to stabby native dylibs

.github/workflows/ci.yml

@@ -19,8 +19,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
         with:
-          # build.rs cross-compiles hm-plugin-* wasm artifacts.
-          targets: wasm32-wasip1
           components: clippy
       - uses: Swatinem/rust-cache@v2
 
@@ -63,8 +61,6 @@ jobs:
           path: harmont-py
 
       - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-wasip1
       - uses: Swatinem/rust-cache@v2
         with:
           workspaces: harmont-cli

.github/workflows/examples.yml

@@ -43,20 +43,13 @@ jobs:
   build-hm:
     needs: validate-matrix
     runs-on: ubuntu-latest
-    # Debug build only — examples just need a working `hm` binary;
-    # release-mode LTO/codegen on wasmtime+cranelift can't finish in
-    # GH's 6h cap on a 2-vCPU runner. Debug builds in ~10 minutes
-    # cold, ~1 minute warm.
+    # Debug build only — examples just need a working `hm` binary.
+    # Debug builds in ~10 minutes cold, ~1 minute warm.
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 
       - uses: dtolnay/rust-toolchain@stable
-        with:
-          # crates/hm/build.rs cross-compiles hm-plugin-docker as a wasm
-          # plugin embedded into the binary, so the target must be on
-          # the toolchain.
-          targets: wasm32-wasip1
 
       - uses: Swatinem/rust-cache@v2
         with:

.github/workflows/release.yml

@@ -18,11 +18,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@stable
-        with:
-          # crates/hm/build.rs cross-compiles hm-plugin-docker as a wasm
-          # plugin embedded into the binary, so the target must be on
-          # the toolchain for the `cargo check` in the next step.
-          targets: wasm32-wasip1
       - uses: Swatinem/rust-cache@v2
 
       - name: Set version from tag
@@ -37,7 +32,7 @@ jobs:
           # is what consumers will receive).
           sed -i "s|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"0.0.0-dev\" }|hm-plugin-protocol = { path = \"crates/hm-plugin-protocol\", version = \"$VERSION\" }|" Cargo.toml
           sed -i "s|hm-plugin-sdk      = { path = \"crates/hm-plugin-sdk\",      version = \"0.0.0-dev\" }|hm-plugin-sdk      = { path = \"crates/hm-plugin-sdk\",      version = \"$VERSION\" }|" Cargo.toml
-          cargo check --workspace --exclude hm-fixtures
+          cargo check --workspace
 
       - name: Publish hm-plugin-protocol
         run: |
@@ -61,25 +56,6 @@ jobs:
       - name: Wait for crates.io index
         run: sleep 30
 
-      - name: Build embedded WASM plugins
-        # The harmont-cli build.rs prefers crates/hm/embedded/*.wasm
-        # over the in-workspace cross-compile. Stage them here so the
-        # `cargo publish -p harmont-cli` verify-build (which runs in
-        # target/package/harmont-cli-<ver>/ without the sibling plugin
-        # crates) and any downstream `cargo install harmont-cli` both
-        # find the wasms already cooked. The include = [...] in
-        # crates/hm/Cargo.toml carries them into the tarball.
-        run: |
-          set -euo pipefail
-          for crate in hm-plugin-docker hm-plugin-output-human hm-plugin-output-json hm-plugin-cloud; do
-            cargo build --target wasm32-wasip1 -p "$crate" --release
-          done
-          mkdir -p crates/hm/embedded
-          for name in hm_plugin_docker hm_plugin_output_human hm_plugin_output_json hm_plugin_cloud; do
-            cp "target/wasm32-wasip1/release/$name.wasm" "crates/hm/embedded/$name.wasm"
-          done
-          ls -la crates/hm/embedded/
-
       - name: Publish harmont-cli
         run: |
           if curl -sf -A "harmont-release-ci (github-actions)" "https://crates.io/api/v1/crates/harmont-cli/$VERSION" > /dev/null 2>&1; then

CLAUDE.md

@@ -1,13 +1,14 @@
-The `cli/` directory is a Cargo workspace.
+The `crates/` directory holds a Cargo workspace rooted at the repo root.
 
 - `crates/hm/` — the `hm` binary (today's CLI body).
 - `crates/hm-util/` — shared OS and filesystem utilities.
 - `crates/hm-plugin-protocol/` — wire types (serde structs only).
-- `crates/hm-plugin-sdk/` — authoring SDK for plugin writers.
-- `crates/hm-fixtures/` — test-only WASM plugins; compiled to
-  `target/wasm32-wasip1/debug/` by the test harness.
+- `crates/hm-plugin-sdk/` — authoring SDK for plugin writers; exposes the stabby-based FFI traits.
+- `crates/hm-plugin-macros/` — proc-macro crate powering `register_plugin!`.
+- `crates/hm-plugin-runtime/` — plugin loading, discovery, host-API runtime. Owns `LoadedPlugin`, `PluginRegistry`, `HostApiImpl`.
+- `crates/hm-plugin-docker/`, `crates/hm-plugin-cloud/` — bundled plugins (native cdylib dylibs).
+- `tests/fixtures/` — test-only cdylib crates (`noop-executor`, `recording-hook`, etc.) built via `cargo build` as native shared libraries.
 
-Run `cargo build` from the workspace root. Plugin fixtures need the
-`wasm32-wasip1` target; install with `rustup target add wasm32-wasip1`.
+Run `cargo build` from the workspace root. Run `cargo test --workspace` to exercise all crates.
 
 For cross-cutting doctrine see [PRINCIPLES.md](../PRINCIPLES.md).