The Federation of Extensions
Fifteen arts gather beneath one skin.
Search the web, judge an artifact, train a model candidate, carry a voice: different work needs different organs. The fifteen Extension Domains below say where each responsibility belongs. They map jurisdictions; a name on the map promises neither an installed package nor delivered behavior.
The Federation of Fifteen
| Name | Work it owns |
|---|---|
| Oculus | Evidence and observability: follow bounded observations, derivations, correlations and explicit gaps back to their sources. |
| Tether | Private reachability: open exact private paths. |
| Veil | Hostile ingress: terminate TLS and protocols, canonicalize metadata and admit declared routes. |
| Ward | IAM and authority: resolve principals and recheck current permission over an exact object or effect. |
| Spellweaver | Workflow: validate Spell contracts and Scroll/Pattern lifecycle, admit castings and preserve continuity and logical time. |
| Scout | Web acquisition: bound search, fetch, extraction, rendering and interaction. |
| Smith | Assimilation: re-express admitted material as attributable candidate code. |
| Soulforge | Training: bind admitted corpus, base digest, objective, Recipe, Training Run, evaluation and candidate-weight lineage. |
| Drift | Evaluation: test exact subjects against declared goals through versioned trials and calibrated findings that retain uncertainty. |
| Toll | Economics: distinguish quote, authorization, settlement, delivery, refund and reconciliation. |
| Prism | Visual and spatial grounding: bind observations, transformations, reconstructions and generated forms to exact sources and derivatives, keeping them distinct. |
| Echo | Speech lifecycle: carry capture, transcription, synthesis and delivery with origin, consent and outcome intact. |
| Shadow | Possibility lineage: hold isolated candidate worlds with exact parentage, evidence and terminal disposition. |
| Mirror | Identity: preserve Persona lineage, hydration provenance and attribution. |
| Legion | Distributed embodiment: fence delegation across operator-owned bodies while each retains authority over its iron. |
The offices cooperate through their own contracts. A private path or admitted edge route still leaves application authority with the service behind it. Acquiring a source establishes neither its truth nor a wider permission. Oculus keeps observations distinct from owning records, and Mirror's identity binding supplies no caller authority. A Shadow branch, Smith candidate or favorable Drift finding must reach the responsible owner before it can become an admitted effect; none can promote its own conclusion or grant privilege.
Domain, package, and provider
| Term | Place in the body |
|---|---|
| Extension Domain | One of the fifteen stable user-facing jurisdictions through which the Lich may grow |
| extension package | Explicitly selected built-in or private Crypt code admitted through register(context) and shaped stores |
| Registrant | Core or one selected extension package performing registration under a host-assigned registrant_id |
| Contribution | A typed addition admitted by one explicit receiving Core office or Extension Domain while that owner keeps authority |
| Provider | A concrete engine or service supplying mechanism behind a typed contract |
Packages may contribute across several Core offices or Domains; a Domain may have several packages or Providers. Compositions and Products use and package those contracts while retaining their own offices. Activation names a concrete package or declared instance, never an abstract Domain.
How an organ enters
For a first contribution, follow Extension authoring through the existing Phoenix registration shim, typed Rune, Quadlet contributor, and configuration test.
The coupled pre-v1 Extension Protocol admits explicitly selected built-in and private Crypt
packages through register(context); it neither scans the environment nor discovers arbitrary
entry points. Built-ins evolve atomically with Core, while private packages accept refactor
breakage. A versioned independent extension-package API and conformance suite remain future work, so an
external protocol is the present boundary where process or lifecycle coupling is unacceptable.
The selected assembly is frozen for one Vessel process: there is no hot-load, hot-replace, or hot-unload path. A change to code, package selection, dependencies, or contribution contracts requires a new body generation under Evolution. Its continuity comes from compatible Phylactery truth and explicit Reanimation, not migration of volatile extension objects. The boot boundary is enforced; automated Evolution remains Designed.
ADR 05 owns admission and compatibility. State of Work records the five-store surface, its v1 capability attribution, and the remaining lifecycle limits. Selection grants shaped registration—not route, secret, workflow, migration, workload, effect, or automatic activation authority.
How an organ earns permanence
Authorship, tests, and evaluation produce a candidate and evidence for the target owner's promotion decision. Smith, Shadow, and Drift cannot promote their own conclusions. Required HitL or eligible policy supplies authorization; packaging, migration, activation, and verification remain separately owned effects. Follow the Assimilation passage to prepare that handoff with its failures and uncertainty still attributed.
Automated Smith and Forge promotion is Designed, not delivered. State of Work owns delivery; the Assimilation Covenant owns the fuller passage from bounded candidate work to an accepted organ.