[saphid]

Panels currently require an app fork. This adds the extension authoring SDK, versioned typed API catalogue, React surfaces, package builder and capability-scoped worker runtime.

The public contracts cover workspace and file operations, terminal output, browser engines and profiles, PR actions, agent workflows, persisted views and host UI primitives. Examples exercise packaged consumers; this layer does not load extensions in an app. The bundle tooling referenced by the package audit scripts lands in a follow-up.

Review

This is the bottom layer and targets main directly.

Verification

Check	First run	Final
CI=true vp i (reuse when lockfile unchanged)	pass	pass
SDK and runtime builds	pass	pass
vp lint	pass	pass
vp fmt --check	pass	pass
git merge-tree against fetched main	pass	pass
vp run knip:check	pass	pass
server.test.ts and RpcAuthorization.test.ts	local HTTP port collision (rc 1)	pass
extension-runtime tests	pass	pass
web/server/desktop and touched workspace typechecks	pass	pass
Effect import subpath case check	pass	pass
release smoke	pass	pass
apps/server suite	local HTTP port collision (rc 1)	local HTTP port collision (rc 1)
sdk test	pass	pass
external consumer	pass	pass
contracts test	pass	pass
contracts typecheck	pass	pass
shared test	pass	pass
shared typecheck	pass	pass
persisted state test	pass	pass
bundle freshness (integrated version; generated bundles excluded from these PRs)	N/A	N/A; integrated version checked separately

The only failing results are server HTTP tests on the author's machine: an unrelated local service occupies the same port number on IPv4, causing bootstrap requests to receive that service's 403 or 404 responses. The same failures occur on unmodified main, and the same suite passes in full on layers containing all server changes, including Terminal. CI on Linux is the authority for the server suite.

The final integrated extension rebuild and bundle-freshness check passed. Generated bundles are excluded from the review layers and built from source there.

Earlier integration testing used real web and Electron desktop clients and real GitHub workflows. Desktop testing verified Browser menus, picture-in-picture and pressed-state styling; web testing verified Diff gap expansion, folding/reveal and Open/Copy actions for all four path cases, the Version Control workflow and Files remote editor routing. Agents testing verified launch, script viewing and opening a seeded session. This evidence covers the integrated implementation; these individual PR branches have not had a fresh real-client pass.

Testing against local Forgejo verified both native and extension reviewer pickers in the web client: candidates appeared once without repeated listing, user and team assignment/removal succeeded through the picker, and disabled-state reasons appeared on hover and keyboard focus. GitLab workflows remain unverified in a real client, and mobile extension support remains follow-up work.

Current parity assessment: 182 PARITY / 0 SHIPPED-UNVERIFIED / 0 GAP / 2 DEFERRED of 184 scored rows, plus one N/A.

GPT-6.1 Sol via T3 Code

[saphid]

Closing this draft: it is superseded. Maintainer-style review showed the full extension stack is too large to review and does not replace any native panel, and CONTRIBUTING requires agreeing direction first. The proposed smaller direction (an internal panel registry, piloted by moving Diff with no visible change, then one panel per PR that deletes its native implementation) is up for discussion in #14938. Nothing further will be pushed here.