Extensions — the capabilities aisle

Every capability you could add, with its honest face: what it does, where it plugs in, and the register its output carries — what it taints, and what it can never read. Every install enters at shadow; standing is earned on outcomes, never bought.

5extensions, in the registry

The registry — capability · reach · register

Each row is a capability with its honest face. The register column is the taint law: computed output is verifiable by re-execution; machine output is a recorded input that taints everything downstream. Open the glass box to see exactly what one may touch.
capabilitywhat it doesplugs intoregister
Stripe webhook railthe payment-attestation seam for the Stripe rail — a signature-verified webhook becomes an attested movement; a declarative binding over the webhook interpreterconnectorcomputed
Document storethe document store for outside records — your bytes live off-spine in storage you control; a declarative binding over the storage interpreter; bytes never touch the engineconnectorcomputed
Daylight ledger themethe daylight theme — proof a theme IS a pure-manifest plugin over the closed ontology; it can change how things look, never what is truethemecomputed
Who acts next lensthe who-acts-next lens for the personal board — proof a lens IS a pure-manifest plugin: a different arrangement of the same tasks, never new factsboard-lenscomputed
Pdf text adapterthe first-party TIER-2 exemplar (foreign code — text extraction from a document): enters at SHADOW, its output is a RECORDED INPUT carrying the machine register that taints everything downstream. Proves the sandbox + the register taint; it is NOT opened to outside authors (that is a later, gated decision).functionmachine