@network-harness/core-protocols

Claims ctx.protocols. The install lifecycle, the manifest registry, each extension's state directory, and the schedules a manifest declared.

It does not sit between a protocol and the components. A loaded protocol reaches them directly and each one derives its caller, so the host's job ends once an entry exists. What an extension may then do is policy's answer, not the host's.

Installing asks; approving installs. install renders the manifest for the human and writes nothing. The manifest is the informed-install decision: what the extension is, what it sends and accepts, which sources it wants to learn about, which operations it will request, and what it accepts always needing consent. The entry appears when the answer comes back approved -- including an answer given while the node was down.

Disabling is enough. Everything an extension registered is an effect of its scope, so one flag withdraws its advertisements, routes, served resources, workspaces, and schedules. kill differs only in what a restart does: a killed extension comes back, a disabled one does not.

A protocol runs no loop of its own. Background work is a declared schedule fired as an event in the extension's own context, which is what makes it visible to a human, stoppable by disabling, and durable across a restart. An extension's schedules start their clock at install, so installing something does not fire everything it has at once.

Two records, on purpose. The loader's entry file says what to load; the install record says what the human was shown and agreed to. Keeping both means a manifest cannot drift from the entry it justifies, and a refusal is remembered rather than looking like a question that was never asked.

ctx.extension is one service that answers per caller -- see binding.ts. A service rather than an accessor, because an extension declares inject: ["extension"] and cordis gates an inject on a service being available.

The one composition rule is in layer.ts: a layer written on behalf of a third party may not be a spine row or claim a spine service key. The human's own layer may, because the human owns the node.