The Federation of Extensions
An organ may extend the body. It does not inherit the body's authority.
An unfamiliar organ becomes legible by its attachment, governing jurisdiction, and concrete form. This directory maps fifteen Extension Domains. Their names say where work belongs; presence on the map proves neither a package nor delivered behavior.
| Term | Place in the body |
|---|---|
| Extension Domain | One of the fifteen stable user-facing jurisdictions through which the Lich may grow |
| extension package | Explicitly selected built-in or private Crypt code admitted through register(context) and shaped stores |
| Manifestation | The form a Domain takes in one profile: Core office, package-provided contribution, managed Provider, external attachment, or dormant design |
| Contribution | A typed addition admitted through a Domain-owned store while that Domain keeps authority |
| Provider | A concrete engine or service supplying mechanism behind a typed contract |
| Composition | A reusable native application capability with a Pattern catalogue, domain state, judgment, policy, and effects |
| Product | A named professional or market package selecting Compositions, Suites, profiles, projections, and supported use cases without inheriting their authority |
Packages may contribute across several Domains; a Domain may have several packages or Providers. Compositions use Domain contracts without becoming Domains or Manifestations. Products package Compositions without becoming Extension Domains, extension packages, or authority owners. Activation names a concrete package or declared instance, never an abstract Domain.
Manifestation is only a descriptive profile view, not a shared registry kind, base class, identity, lifecycle, or activation target. Operational contracts name the exact office, Contribution, Provider, attachment, or dormant profile underneath it.
The Federation of Fifteen
| Name | Jurisdiction |
|---|---|
| Oculus | Evidence and observability: relates bounded observations, derivations, correlations, and explicit gaps without displacing owning records |
| Tether | Private reachability: opens exact private paths while tunnel possession grants no application authority |
| Veil | Hostile ingress: terminates TLS and protocols, canonicalizes metadata, and admits routes while authority stays behind the edge |
| Ward | IAM and authority: resolves principals and rechecks current permission over an exact object or effect |
| Spellweaver | Workflow: validates Spell contracts and Scroll/Pattern lifecycle, admits castings, and owns continuity and logical time |
| Scout | Web acquisition: bounds search, fetch, extraction, rendering, and interaction without turning contact into truth or stronger permission |
| Smith | Assimilation: re-expresses admitted material as attributable candidate code; authorship supplies no promotion authority |
| Soulforge | Training: binds admitted corpus, base digest, objective, Recipe, Training Run, evaluation, and candidate-weight lineage |
| Riddle | Evaluation: binds exact subjects to versioned trials and returns calibrated findings with uncertainty; privilege and promotion remain elsewhere |
| Toll | Economics: separates quote, authorization, settlement, delivery, refund, and reconciliation |
| Prism | Visual and spatial grounding: binds observations, transformations, reconstructions, and generated forms to exact sources and derivatives without replacing one with another |
| Echo | Speech lifecycle: carries audio capture, transcription, synthesis, and delivery with origin, consent, and outcome intact |
| Shadow | Possibility lineage: holds isolated candidate worlds with exact parentage, evidence, and terminal disposition; no branch appoints reality |
| Mirror | Identity: preserves Persona lineage, hydration provenance, and attribution without minting caller authority |
| Legion | Distributed embodiment: fences delegation across operator-owned bodies while each body retains authority over its iron |
How an organ enters
The coupled pre-v1 Extension Protocol admits explicitly selected built-in and private Crypt
packages through register(context); it neither scans the environment nor discovers arbitrary
entry points. Built-ins evolve atomically with Core, while private packages accept refactor
breakage. A versioned independent extension-package API and conformance suite remain future work, so an
external protocol is the present boundary where process or lifecycle coupling is unacceptable.
That assembly is one frozen extension generation per Vessel process. There is no hot-load, hot-replace, or hot-unload path. Changing executable code, package selection, dependencies, or a contribution contract changes the next body generation; the current process keeps its exact assembly until a controlled Evolution replaces it. Volatile extension objects are not migrated or cleaned into a new shape. Continuity comes from compatible Phylactery truth and explicit Reanimation, not from preserving process memory. Automated Evolution remains designed rather than delivered; the current implementation enforces the frozen-generation side of this boundary at boot.
ADR 05 owns admission and compatibility. State of Work records the Partial five-store surface and its attribution limits. Selection grants shaped registration—not route, secret, workflow, migration, workload, effect, or automatic activation authority.
How an organ earns permanence
Authorship, testing, and evaluation can establish a candidate and its evidence. Smith, Shadow, and Riddle cannot promote their own conclusions. The target owner revalidates identity, base, evidence, current authority, and recovery; required HitL or eligible policy supplies authorization where the effect demands it. Packaging, migration, activation, and verification remain separately owned effects, with failure or uncertainty still attributed.
Automated Smith and Forge promotion is Designed, not delivered. State of Work owns delivery; the Assimilation Covenant owns the fuller passage from bounded candidate work to an accepted organ.