Checkpoint guarded source request broker

vision/first-party-source-plugins.md

@@ -6,8 +6,9 @@ Compose worker. No external plugin was installed, no host was probed, and no
 live queue, delay, or container was changed. The broker, generic runner, new
 hoster pilot, admin controls, and full deployment validation below remain work
 to do; the diagram describes the target rather than the current implementation.
-Parser-result URL validation and bounded worker messages were added next; full
-redirect/DNS enforcement and source-specific CDN allowlists are still pending.
+Parser-result URL validation and bounded worker messages were added next. The
+opt-in WeebCentral path now validates redirect hops and pins public DNS answers;
+source-specific image CDN allowlists and generic broker integration remain pending.
 
 ## Decision