The loop no longer classifies a tool-call turn that arrived without
reasoning, retries it, or keeps a file-backed cooldown for it. Removes the
watch and the cooldown state, the deferred stream sink they needed, the
provider policy interfaces and their implementations, the descriptor field on
the extension wire (schema and SDK regenerated), the state-dir path, the
run-metrics counters and the protocol-recovery kinds.
The protocol-recovery audit channel itself stays for now.
internal/ was 141 packages side by side, so nothing but a reader's memory
said which were foundations and which assembled the rest. Each now sits in a
layer directory, and the directory is the declaration:
base L0 foundation with no domain in it
contract L1 types and interfaces the layers above agree on
model, tools, safety, ext, state, platform
L2 subsystems, peers of one another
runtime L3 the turn engine
session L4 the controller
assembly L5 the composition root
frontend L6 cli, serve, acp and the host adapters
Only paths change: package names, code and behaviour do not. Imports,
repolint and coverage baselines, sensitive paths, CI package lists and docs
follow the new paths; release notes keep the paths they were written with,
and sample paths inside tests and fixtures keep theirs.
repolint gains layer-order: a package may import its own layer and those
below it, read from where it lives. The 47 imports that point upward today
are recorded as that rule's opening debt (-allow-widen, a new rule's first
baseline) and can only go down. Most of it is config, which still reaches
into eight subsystems and is the next thing to take apart; the rest is
event, history and a few tools reaching into runtime for types that belong
in contract.
A runtime could only replace a tool by name, and that slot was never routed
to it, so a plugin that wanted to add one had to ship an MCP server. A
runtime now declares tools in its manifest, under runtime.tools with the
tools capability: a name, a description and an object input schema, known
before the process starts and shown in the install plan and the package
list. At initialize the runtime names the declared tools it serves; one the
manifest does not describe fails the handshake as capability_not_declared.
The model sees each as ext__<plugin>__<tool> and reaches it through the
capability catalog the way it reaches MCP tools, so installing or reloading
a plugin never moves the cached prompt prefix, and every call passes the
permission check under that name. A call is the new host request
extension/tool/call, bounded at five minutes; isError carries a failure the
tool reports about its own work, apart from a call that could not run.
A runtime that failed to start contributes no tools.
The Go SDK serves them from Options.Tools and names them in the handshake.
An effect test drives a call through the real assembly to a fake runtime and
back to the model, and fails with the registration removed.
Deletes what the documentation standard (6b6a41d36) classes as dead on
the studio line, as reviewed and approved item by item.
Deleted:
- Stale or unreferenced: production_checklist (a "v5.9.9 stable" that
never existed), the 4-line WINDOWS_LTSC_2019 stub,
SESSION_REFERENCE_ARCHITECTURE, docs/superpowers (the retired
autoresearch plans), docs/research, RELEASING.md (main-v2's three-tag
line), SIGNPATH_WINDOWS_ADMIN_SOP.md (desktop line only) and
CHANGELOG.md (main-v2's Go line).
- Chinese copies: 30 zh-CN documents with an English original, plus
three with none (COLLABORATION_MODES, DESKTOP_HOOKS, GOAL_ENFORCEMENT).
Only README, GUIDE and CLI keep a Chinese page.
- main-v2 release pipeline: the prepare-release-notes, release-notes,
release-verify-issues and pages workflows; their release-notes,
generate, event, stable-validation and public-contract scripts; and
release-notes/releases.json.
What had to move with it:
- releases.json was embedded, so the docs tool served main-v2's
1.17-1.24 history inside Studio 2.17, where "latest release" answered
1.24.1. productdocs drops the release catalog: release_notes.go, the
virtual changelog paths, the version boost and Manifest.ReleaseNotes.
docs-manifest --verify-source now compares docs/ only. The /docs
example no longer promises a changelog.
- spec-parity held SPEC.zh-CN.md to SPEC.md. With one language it has
nothing to compare, so the rule and its tests are removed.
- The spatiotemporal golden fixtures lived under docs/superpowers but
are test data. They move to internal/extension/testdata.
- Links: onboarding pages point at the English documents; English
documents lose their switch to a copy that is gone. GUIDE drops the
pointer to the Chinese-only hooks page. The theme provenance generator
stops writing THEME_ASSETS.zh-CN.md. ci.yml stops linting and running
what was deleted. CODEOWNERS and the standard lose the two dead paths.
Checked: no broken relative .md link remains; actionlint passes;
go test ./... passes; make lint is clean.
Baseline only goes down:
- doc-language 33 -> 0
- doc-owner 91 -> 44
- doc-prose 2755 -> 2375
- spec-parity removed
site/ is also main-v2's and still reads releases.json. It was not on the
approved list and is left for a separate decision.
Two things the workbench could describe but not act on.
An extension that publishes a view against a tool call now draws inside that
call's card. The takeover replaces the body only: the name, the status, the cost
and the failure line stay the host's, so a redrawn card is still recognisably
this call and still visibly the extension's work. The surface travels as a
first-class DTO through eventwire and uihub rather than as an opaque blob.
The shell tool's interpreter becomes a setting. It was already auto-detected —
real bash first, Git for Windows next, PowerShell only when a Windows host has
no bash — but nothing in the new UI said which one was chosen, and nothing could
change it. sandbox now exposes what auto-detection picks from (DetectShells) and
whether a chosen one actually runs (VerifyShell); the settings pane offers only
interpreters this machine really has, names what "自动" resolves to here, and
says on the row itself that Windows PowerShell 5.1 will not parse '&&'. Choosing
one persists to [tools.shell] and rebuilds the runtime, because boot binds the
interpreter into the tool while assembling it — the same path a role assignment
takes, and refused mid-turn for the same reason.
A shell card spends its mono tag on the interpreter instead of on the tool id:
the name above already says Bash, and on a host without one the command was
handed to PowerShell, which is the difference between a command that works and
the same text failing on '&&'.
Working snapshot of the studio branch: installable plugin packages (plan
ticket, archive, export, install-source permission subject), the extension
protocol's view/slot rendering path, desktop theme tokens, and the file-drop
surface on the next shell.
Grouped as one commit because the pieces share the generated protocol schema
and the desktop port they land through.
An extension could publish a card, a form, a notification, a status line —
every one of them a thing that happens and then scrolls away. What it could not
do is describe something that is still true: a watcher running, a sync at 40%,
a connection holding. That state belongs in the side rail, and there was no
surface kind for it.
UISurfacePanel is that kind, and it is a kind rather than a new RPC on purpose.
The method registry is frozen; growing it per feature is what turns version
compatibility into every extension author's problem. A new surface travels the
publish path that already exists, so an extension built against an older host
degrades to an unknown kind instead of a broken call.
UIPanelPayload carries no Markdown, unlike UICardPayload. The rail is a narrow
column and a rendered document there costs the layout more than it tells the
reader; an extension with a long story to tell publishes a card into the
transcript, which is what the transcript is for.
Registering the kind is what actually admits it: protocol.enumTypes is the one
table the strict decoder, the JSON Schema, and the generated SDK all read. The
generator's own guard caught the rest — a surface kind with no matching
UI<Kind>Payload in the SDK fails generation loudly, which is how it should
have gone. Regenerated artifacts follow, schema hash included.
The Extension* types move out of event.go and eventwire/wire.go into their own
files while passing through: both were already over the size ceiling, a new
surface kind touches every one of those structs, and the two conversion blocks
are the only thing in eventwire that is not a one-liner.
Problem:
The reference fullsidecar binary activated strategies, providers, and UI that its manifest did not declare, while conformance tests bypassed the real manifest and installed-package layout. The host also omitted Manifest v2 dependency identities from initialize requests.
Root cause:
The fixture built pluginpkg.Package values by hand, and the sidecar handshake projected only runtime intercept/replacement/capability strings.
Fix:
Declare the complete fullsidecar capability surface, project requires/provides and dependency schema versions into the handshake, echo activated provides from the SDK example, and drive conformance through a temporary installed v2 package including enable, disable, remove, and kernel contribution checks.
Verification:
- go test ./... -count=1
- go test -race ./internal/extension/sidecar ./internal/extension/conformance -count=1
- cd desktop && go test ./... -count=1
- cd sdk/go && go test ./... -count=1
- go run ./cmd/extension-protocol-gen -check -root .
- git diff --check
Problem:
Runtime publish gates, receipts, file priors, message deduplication, and stream cancellation were process-global, so rebuilding one session could drain or overwrite another session's lifecycle evidence. The v2 manifest path also still exposed migration behavior for versioned manifests.
Root cause:
Lifecycle state was wired through package globals instead of the controller/session lineage, and migration/parser compatibility retained assumptions from the unpublished manifest v1 design. Drain cancellation also allowed callbacks to register after a generation had already expired.
Fix:
Introduce an explicit RuntimeOwner carried through boot, controller, provider, UI, host streams, receipts, and file-write compensation. Reuse it only within a rebuild lineage, defer replacement publication until commit, reject draining turns, make late drain registrations cancel immediately, and enforce v2-only versioned manifests while limiting explicit migration to pre-extension manifests without apiVersion.
Verification:
- go test -race ./internal/agent ./internal/boot ./internal/control ./internal/extension ./internal/extension/providerext ./internal/extension/uihub ./internal/tool/builtin -count=1
- go test ./internal/extension ./internal/pluginpkg ./internal/recovery ./internal/agent ./internal/control ./internal/boot -count=1
- go test ./... -count=1 (sdk/go)
- focused Desktop plugin lifecycle tests
esengine