From 2e5dde27ab7dbf5d1b39b022863046988281b128 Mon Sep 17 00:00:00 2001 From: Gustavo Madeira Santana Date: Sun, 15 Mar 2026 22:19:00 +0000 Subject: [PATCH] Docs: refresh backend catalog policy status --- ...capability-catalog-and-arbitration-spec.md | 2 +- ...law-extension-host-implementation-guide.md | 3 +- ...w-kernel-extension-host-transition-plan.md | 1 + src/extension-host/cutover-inventory.md | 160 +++++++++--------- 4 files changed, 84 insertions(+), 82 deletions(-) diff --git a/docs/.internal/extension-host-migration/openclaw-capability-catalog-and-arbitration-spec.md b/docs/.internal/extension-host-migration/openclaw-capability-catalog-and-arbitration-spec.md index 8218bd7c0bf..b8e1c1f5580 100644 --- a/docs/.internal/extension-host-migration/openclaw-capability-catalog-and-arbitration-spec.md +++ b/docs/.internal/extension-host-migration/openclaw-capability-catalog-and-arbitration-spec.md @@ -618,7 +618,7 @@ Capability selection must emit structured events for: - channel capabilities from `extensions/discord/src/channel.ts:74`, `extensions/slack/src/channel.ts:107`, and `extensions/telegram/src/channel.ts:120` collapse into canonical messaging action families - diffs becomes an agent-visible tool family plus a host-managed route surface from `extensions/diffs/index.ts:27` - provider integration from `extensions/google-gemini-cli-auth/index.ts:24` becomes operator-visible setup and auth capabilities -- catalog-backed runtime-family descriptors for embeddings, media, and TTS now route through `src/extension-host/runtime-backend-catalog.ts`; embedding shared backend definitions in `src/extension-host/embedding-runtime-backends.ts`, media shared backend definitions in `src/extension-host/media-runtime-backends.ts`, TTS shared backend definitions in `src/extension-host/tts-runtime-backends.ts`, initial runtime-family arbitration in `src/extension-host/runtime-backend-arbitration.ts`, and shared default and preferred backend ordering plus fallback chaining in `src/extension-host/runtime-backend-policy.ts`; embedding auto-provider selection, embedding local setup guidance, memory doctor guidance for embedding auto-provider order, and explicit embedding fallback policy in `src/extension-host/embedding-runtime-policy.ts`, media provider candidate ordering plus default-model fallback selection in `src/extension-host/media-runtime-policy.ts`, and TTS request setup, status, compatibility provider-order exports, plus explicit TTS configured-fallback policy in `src/extension-host/tts-runtime-policy.ts` already consume that catalog-backed arbitration and backend-policy data, and broader consumer adoption and arbitration should continue moving those subsystem runtimes toward runtime-internal registries rather than leaving them as a universal plugin-provider API shape +- catalog-backed runtime-family descriptors for embeddings, media, and TTS now route through `src/extension-host/runtime-backend-catalog.ts`; embedding shared backend definitions in `src/extension-host/embedding-runtime-backends.ts`, media shared backend definitions in `src/extension-host/media-runtime-backends.ts`, TTS shared backend definitions in `src/extension-host/tts-runtime-backends.ts`, initial runtime-family arbitration in `src/extension-host/runtime-backend-arbitration.ts`, and shared default and preferred backend ordering plus fallback chaining in `src/extension-host/runtime-backend-policy.ts`; the catalog helpers for generic subsystem ordering, media auto-ordering, and TTS preferred-provider ordering now also route through that shared backend-policy layer; embedding auto-provider selection, embedding local setup guidance, memory doctor guidance for embedding auto-provider order, and explicit embedding fallback policy in `src/extension-host/embedding-runtime-policy.ts`, media provider candidate ordering plus default-model fallback selection in `src/extension-host/media-runtime-policy.ts`, and TTS request setup, status, compatibility provider-order exports, plus explicit TTS configured-fallback policy in `src/extension-host/tts-runtime-policy.ts` already consume that catalog-backed arbitration and backend-policy data, and broader consumer adoption and arbitration should continue moving those subsystem runtimes toward runtime-internal registries rather than leaving them as a universal plugin-provider API shape - extension-backed web search should become an agent-visible tool family unless it is only a runtime-internal backend feeding another host-owned surface - voice-call from `extensions/voice-call/index.ts:230` becomes a mix of agent-visible actions, runtime providers, and operator surfaces - ACP backend registration from `extensions/acpx/src/service.ts:55` becomes runtime-internal backend arbitration diff --git a/docs/.internal/extension-host-migration/openclaw-extension-host-implementation-guide.md b/docs/.internal/extension-host-migration/openclaw-extension-host-implementation-guide.md index 0abcb8e7933..ef0ed7faa9f 100644 --- a/docs/.internal/extension-host-migration/openclaw-extension-host-implementation-guide.md +++ b/docs/.internal/extension-host-migration/openclaw-extension-host-implementation-guide.md @@ -277,6 +277,7 @@ Committed implementation slices so far: - `c205208497` `Media: add runtime selection policy` - `a9e5d36f7e` `Runtime: share backend policy helper` - `8d8b9ba42d` `Memory: adopt shared backend policy` +- `dd0c10c999` `Runtime: route backend catalog through shared policy` - `89414ed857` `Docs: track extension host migration internally` - `d8af1eceaf` `Docs: refresh extension host migration status` @@ -296,7 +297,7 @@ Recent plan refinements: - it now explicitly treats interactive callback routing, namespace ownership, dedupe, and fallback behavior as first-class migration surfaces - it now explicitly treats inbound claim as a canonical ingress-stage concern rather than a permanent plugin-era hook shape - it now explicitly treats Telegram and Discord as the first validated rollout targets for interactive control surfaces while keeping the underlying contracts generic, host-owned, and kernel-agnostic -- it now explicitly treats embeddings, media understanding, and TTS as in-progress host-owned subsystem runtimes, with embedding backend definitions now shared between `src/extension-host/embedding-runtime-backends.ts`, `src/extension-host/embedding-runtime-registry.ts`, and `src/extension-host/runtime-backend-catalog.ts`, shared default and preferred runtime-backend ordering plus fallback chaining now landing in `src/extension-host/runtime-backend-policy.ts`, embedding selection, fallback routing, explicit fallback policy in `src/extension-host/embedding-runtime-policy.ts`, public runtime surface, result typing, manager-side batch and fallback policy, sync plus reindex planning, sync plus reindex orchestration, reindex sync-body execution plus unsafe reset, safe-reindex temp-db creation, file swap, reopen, and cleanup, plus runtime-backend catalog descriptors now extracted and embedding auto-provider selection, local setup guidance, and memory doctor guidance already consuming the catalog-backed embedding backend-policy order, media backend definitions now shared between `src/extension-host/media-runtime-backends.ts`, `src/extension-host/media-runtime-registry.ts`, and `src/extension-host/runtime-backend-catalog.ts`, with media registry, explicit selection policy in `src/extension-host/media-runtime-policy.ts`, execution, auto-entry selection, orchestration, planning helpers, remaining API composition, lazy entrypoint wiring, plus runtime-backend catalog descriptors now extracted and media provider candidate ordering plus default-model fallback lookup already consuming that catalog-backed backend-policy order, TTS backend definitions now shared between `src/extension-host/tts-runtime-backends.ts`, `src/extension-host/tts-runtime-registry.ts`, and `src/extension-host/runtime-backend-catalog.ts`, with TTS registry, execution, request setup, config normalization, preferences, payload planning, shared status state, API composition, plus runtime-backend catalog descriptors now extracted, initial runtime-family arbitration now landing in `src/extension-host/runtime-backend-arbitration.ts`, explicit configured-fallback policy now landing in `src/extension-host/tts-runtime-policy.ts`, and TTS request setup, status, plus compatibility provider-order exports already consuming that arbitration-backed backend-policy order, and broader consumer adoption and arbitration on top of those catalog-backed runtime-family descriptors still pending, all with capability routing, typed request envelopes, provider-id normalization, and fallback policy +- it now explicitly treats embeddings, media understanding, and TTS as in-progress host-owned subsystem runtimes, with embedding backend definitions now shared between `src/extension-host/embedding-runtime-backends.ts`, `src/extension-host/embedding-runtime-registry.ts`, and `src/extension-host/runtime-backend-catalog.ts`, shared default and preferred runtime-backend ordering plus fallback chaining now landing in `src/extension-host/runtime-backend-policy.ts`, the catalog helpers for generic subsystem ordering, media auto-ordering, and TTS preferred-provider ordering now also routing through that shared backend-policy layer, embedding selection, fallback routing, explicit fallback policy in `src/extension-host/embedding-runtime-policy.ts`, public runtime surface, result typing, manager-side batch and fallback policy, sync plus reindex planning, sync plus reindex orchestration, reindex sync-body execution plus unsafe reset, safe-reindex temp-db creation, file swap, reopen, and cleanup, plus runtime-backend catalog descriptors now extracted and embedding auto-provider selection, local setup guidance, and memory doctor guidance already consuming the catalog-backed embedding backend-policy order, media backend definitions now shared between `src/extension-host/media-runtime-backends.ts`, `src/extension-host/media-runtime-registry.ts`, and `src/extension-host/runtime-backend-catalog.ts`, with media registry, explicit selection policy in `src/extension-host/media-runtime-policy.ts`, execution, auto-entry selection, orchestration, planning helpers, remaining API composition, lazy entrypoint wiring, plus runtime-backend catalog descriptors now extracted and media provider candidate ordering plus default-model fallback lookup already consuming that catalog-backed backend-policy order, TTS backend definitions now shared between `src/extension-host/tts-runtime-backends.ts`, `src/extension-host/tts-runtime-registry.ts`, and `src/extension-host/runtime-backend-catalog.ts`, with TTS registry, execution, request setup, config normalization, preferences, payload planning, shared status state, API composition, plus runtime-backend catalog descriptors now extracted, initial runtime-family arbitration now landing in `src/extension-host/runtime-backend-arbitration.ts`, explicit configured-fallback policy now landing in `src/extension-host/tts-runtime-policy.ts`, and TTS request setup, status, plus compatibility provider-order exports already consuming that arbitration-backed backend-policy order, and broader consumer adoption and arbitration on top of those catalog-backed runtime-family descriptors still pending, all with capability routing, typed request envelopes, provider-id normalization, and fallback policy - it now explicitly rejects widening the legacy `registerProvider(...)` or `ProviderPlugin` surface into a universal runtime API while retaining capability routing, typed request envelopes, provider-id normalization, and fallback behavior where those are part of the target model - it now explicitly treats extension-backed search as either a canonical tool contribution or a host-owned runtime backend depending on whether the search surface is agent-visible diff --git a/docs/.internal/extension-host-migration/openclaw-kernel-extension-host-transition-plan.md b/docs/.internal/extension-host-migration/openclaw-kernel-extension-host-transition-plan.md index 480bfd44861..05bc9b8f001 100644 --- a/docs/.internal/extension-host-migration/openclaw-kernel-extension-host-transition-plan.md +++ b/docs/.internal/extension-host-migration/openclaw-kernel-extension-host-transition-plan.md @@ -263,6 +263,7 @@ Committed implementation slices so far: - `c205208497` `Media: add runtime selection policy` - `a9e5d36f7e` `Runtime: share backend policy helper` - `8d8b9ba42d` `Memory: adopt shared backend policy` +- `dd0c10c999` `Runtime: route backend catalog through shared policy` - `89414ed857` `Docs: track extension host migration internally` - `d8af1eceaf` `Docs: refresh extension host migration status` diff --git a/src/extension-host/cutover-inventory.md b/src/extension-host/cutover-inventory.md index 13f10dce6ba..4883b8a119c 100644 --- a/src/extension-host/cutover-inventory.md +++ b/src/extension-host/cutover-inventory.md @@ -25,86 +25,86 @@ This is an implementation checklist, not a future-design spec. ## Current Inventory -| Surface | Current implementation | Target owner | Status | How it has been handled so far | -| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| Active runtime registry state | `src/plugins/runtime.ts` plus global plugin runtime state | `src/extension-host/active-registry.ts` | `moved` | Host-owned active registry exists; `src/plugins/runtime.ts` is now a compatibility facade. | -| Normalized extension descriptor model | plugin manifests and package metadata interpreted ad hoc across `src/plugins/manifest.ts`, `src/plugins/discovery.ts`, `src/plugins/install.ts` | `src/extension-host/schema.ts` | `partial` | `ResolvedExtension`, `ResolvedContribution`, and `ContributionPolicy` exist; current manifests project into them through compatibility adapters. | -| Resolved static registry | flat rows in `src/plugins/manifest-registry.ts` | `src/extension-host/resolved-registry.ts` | `partial` | Manifest records now carry `resolvedExtension`; a host-owned resolved registry view exists for static consumers. | -| Manifest/package metadata loading | `src/plugins/manifest.ts`, `src/plugins/discovery.ts`, `src/plugins/install.ts` | `src/extension-host/schema.ts` and `src/extension-host/manifest-registry.ts` | `partial` | Package metadata parsing is routed through host schema helpers; legacy loader flow still supplies the source manifests. | -| Loader SDK alias compatibility | `src/plugins/loader.ts` | `src/extension-host/loader-compat.ts` | `partial` | Plugin-SDK alias candidate ordering, alias-file resolution, and scoped alias-map construction now live in host-owned loader compatibility helpers. | -| Loader alias-wired module loader creation | `src/plugins/loader.ts` | `src/extension-host/loader-module-loader.ts` | `partial` | Lazy Jiti creation and SDK-alias-wired module loading now delegate through a host-owned loader-module-loader helper. | -| Loader cache key and registry cache control | `src/plugins/loader.ts` | `src/extension-host/loader-cache.ts` | `partial` | Cache-key construction, LRU registry cache reads and writes, and cache clearing now delegate through host-owned loader-cache helpers while preserving the current cache shape and cap. | -| Loader lazy runtime proxy creation | `src/plugins/loader.ts` | `src/extension-host/loader-runtime-proxy.ts` | `partial` | Lazy plugin runtime creation now delegates through a host-owned loader-runtime-proxy helper instead of remaining inline in the orchestrator. | -| Loader provenance and duplicate-order policy | `src/plugins/loader.ts` | `src/extension-host/loader-policy.ts` | `partial` | Plugin-record creation, duplicate precedence, and provenance indexing now live in host-owned loader-policy helpers. | -| Loader discovery policy results | mixed inside `src/extension-host/loader-policy.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-discovery-policy.ts` | `partial` | Open-allowlist discovery warnings now resolve through explicit host-owned discovery-policy results before the orchestrator logs them. | -| Loader initial candidate planning and record creation | `src/plugins/loader.ts` | `src/extension-host/loader-records.ts` | `partial` | Duplicate detection, initial record creation, manifest metadata attachment, and first-pass enable-state planning now delegate through host-owned loader-records helpers. | -| Loader entry-path opening and module import | `src/plugins/loader.ts` | `src/extension-host/loader-import.ts` | `partial` | Boundary-checked entry opening and module import now delegate through host-owned loader-import helpers while preserving the current trusted in-process loading model. | -| Loader module-export, config-validation, and memory-slot decisions | `src/plugins/loader.ts` | `src/extension-host/loader-runtime.ts` | `partial` | Module export resolution, export-metadata application, config validation, and early or final memory-slot decisions now delegate through host-owned loader-runtime helpers. | -| Loader post-import planning and register execution | `src/plugins/loader.ts` | `src/extension-host/loader-register.ts` | `partial` | Definition application, post-import validation planning, and `register(...)` execution now delegate through host-owned loader-register helpers while preserving current plugin behavior. | -| Loader per-candidate orchestration | `src/plugins/loader.ts` | `src/extension-host/loader-flow.ts` | `partial` | The per-candidate load flow now runs through a host-owned orchestrator that composes planning, import, runtime validation, register execution, and record-state helpers. | -| Loader top-level load orchestration | `src/plugins/loader.ts` | `src/extension-host/loader-orchestrator.ts` | `partial` | High-level load entry and compatibility facade behavior now route through a host-owned loader orchestrator while `src/plugins/loader.ts` remains the external compatibility surface. | -| Loader host process state | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-host-state.ts` | `partial` | Shared discovery warning-cache state and loader reset behavior now delegate through a host-owned loader-host-state helper. | -| Loader preflight and cache-hit setup | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-preflight.ts` | `partial` | Test-default application, config normalization, cache-key construction, cache-hit activation, and command-clear preflight now delegate through a host-owned loader-preflight helper. | -| Loader post-preflight pipeline composition | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-pipeline.ts` | `partial` | Post-preflight execution setup and session-run composition now delegate through a host-owned loader-pipeline helper. | -| Loader execution setup composition | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-execution.ts` | `partial` | Runtime creation, registry creation, bootstrap setup, module-loader creation, and session creation now delegate through a host-owned loader-execution helper. | -| Loader discovery and manifest bootstrap | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-bootstrap.ts` | `partial` | Discovery, manifest loading, manifest diagnostics, discovery-policy logging, provenance building, and candidate ordering now delegate through a host-owned loader-bootstrap helper. | -| Loader mutable activation state session | local variables in `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-session.ts` | `partial` | Seen-id tracking, memory-slot selection state, and finalization inputs now live in a host-owned loader session instead of being spread across top-level loader variables. | -| Loader session run and finalization composition | mixed inside `src/extension-host/loader-orchestrator.ts` and `src/extension-host/loader-session.ts` | `src/extension-host/loader-run.ts` | `partial` | Candidate iteration, manifest lookup, per-candidate session processing, and finalization handoff now delegate through a host-owned loader-run helper. | -| Loader activation policy outcomes | open-coded in `src/extension-host/loader-flow.ts` | `src/extension-host/loader-activation-policy.ts` | `partial` | Duplicate precedence, config enablement, and early memory-slot gating now resolve through explicit host-owned activation-policy outcomes instead of remaining as inline loader decisions. | -| Loader record-state transitions | `src/plugins/loader.ts` | `src/extension-host/loader-state.ts` | `partial` | The loader now enforces an explicit lifecycle transition model (`prepared -> imported -> validated -> registered -> ready`, plus terminal `disabled` and `error`) while still mapping back to compatibility `PluginRecord.status` values. | -| Loader finalization policy results | mixed inside `src/extension-host/loader-policy.ts` and `src/extension-host/loader-finalize.ts` | `src/extension-host/loader-finalization-policy.ts` | `partial` | Memory-slot finalization warnings and provenance-based untracked-extension warnings now resolve through explicit host-owned finalization-policy results before the finalizer applies them. | -| Loader final cache, readiness, and activation finalization | `src/plugins/loader.ts` | `src/extension-host/loader-finalize.ts` | `partial` | Cache writes, readiness promotion, and registry activation now delegate through a host-owned loader-finalize helper; broader host lifecycle and policy semantics are still pending. | -| Channel lookup | `src/channels/plugins/index.ts`, `src/channels/plugins/registry-loader.ts`, `src/channels/registry.ts` | extension-host-backed registries plus kernel channel contracts | `partial` | Readers now consume host-owned runtime-registry channel accessors, and channel registrations now also keep host-owned runtime-registry storage with mirrored legacy compatibility arrays. Writes still originate from plugin registration. | -| Dock lookup | `src/channels/dock.ts` | host-owned static descriptors | `partial` | Runtime lookup now uses the host boundary; dock ownership itself has not moved yet. | -| Message-channel normalization | `src/utils/message-channel.ts` | host-owned channel registry view | `partial` | Lookup path now reads through host-owned runtime-registry channel accessors instead of raw legacy channel arrays. | -| Default plugin HTTP route lookup | `src/plugins/http-registry.ts` | host-owned route registry | `partial` | Default route registration and lookup now use host-owned runtime-registry state with a mirrored legacy `registry.httpRoutes` compatibility view. The plugin API still remains the external call surface for static route registration. | -| Channel catalog static metadata | `src/channels/plugins/catalog.ts` | host-owned static descriptors | `partial` | Package metadata parsing now flows through host schema helpers; full canonical catalog migration has not started. | -| Plugin skill discovery | `src/agents/skills/plugin-skills.ts` | host-owned resolved registry | `moved` | Static consumer now reads only resolved-extension data for skill paths and enablement filtering. | -| Plugin auto-enable | `src/config/plugin-auto-enable.ts` | host-owned resolved registry | `partial` | Primary logic runs on resolved-extension data; old manifest-registry injection remains as a compatibility input for older callers and tests. | -| Config validation indexing | `src/config/validation.ts`, `src/config/resolved-extension-validation.ts` | host-owned resolved registry | `moved` | Validation indexing now builds from resolved-extension records instead of flat manifest rows. | -| Config doc baseline generation | `src/config/doc-baseline.ts` | host-owned resolved registry | `moved` | Bundled plugin and channel metadata now load through the resolved-extension registry. | -| Plugin tool resolution and metadata | `src/plugins/tools.ts` | `src/extension-host/tool-runtime.ts` | `partial` | Optional-tool gating, plugin-id and tool-name conflict handling, tool-factory resolution, and plugin-tool metadata tracking now delegate through a host-owned tool-runtime helper while tool registrations now also keep host-owned runtime-registry storage with a mirrored legacy compatibility view. `src/plugins/tools.ts` remains the loader and config-normalization facade. | -| Plugin provider resolution | `src/plugins/providers.ts` | `src/extension-host/provider-runtime.ts` | `partial` | Provider projection from registry entries into runtime provider objects now delegates through a host-owned provider-runtime helper while `src/plugins/providers.ts` remains the loader and config-normalization facade. | -| Plugin provider discovery | `src/plugins/provider-discovery.ts` | `src/extension-host/provider-discovery.ts` | `partial` | Discovery-capable provider filtering, order grouping, and result normalization now delegate through a host-owned provider-discovery helper while `src/plugins/provider-discovery.ts` remains the compatibility facade around the legacy provider loader path. | -| Plugin provider auth helpers | `src/commands/provider-auth-helpers.ts` | `src/extension-host/provider-auth.ts` | `partial` | Provider matching, auth-method selection, config-patch merging, and default-model application now delegate through a host-owned provider-auth helper while command and onboarding entry points remain compatibility surfaces. | -| Plugin provider wizard metadata and choice resolution | `src/plugins/provider-wizard.ts` | `src/extension-host/provider-wizard.ts` | `partial` | Onboarding option building, model-picker entry building, and provider-method choice resolution now delegate through a host-owned provider-wizard helper while `src/plugins/provider-wizard.ts` remains the compatibility facade around loader-backed provider access and post-selection hooks. | -| Plugin provider auth application flow | `src/commands/auth-choice.apply.plugin-provider.ts` | `src/extension-host/provider-auth-flow.ts` | `partial` | Loaded-provider auth application, plugin-enable gating, auth-method execution, and post-auth default-model handling now delegate through a host-owned provider-auth-flow helper while `src/commands/auth-choice.apply.plugin-provider.ts` remains the compatibility entry point. | -| Plugin provider post-selection hook execution | `src/plugins/provider-wizard.ts`, `src/commands/model-picker.ts` | `src/extension-host/provider-model-selection.ts` | `partial` | Provider post-selection hook lookup and invocation now delegate through a host-owned provider-model-selection helper while `src/plugins/provider-wizard.ts` remains a compatibility facade and existing command consumers continue migrating onto the host-owned surface. | -| Plugin loader activation | `src/plugins/loader.ts` | extension host lifecycle + compatibility loader | `partial` | Activation now routes through `src/extension-host/activation.ts`, but discovery, enablement, provenance, module loading, and policy still live in the legacy plugin loader. | -| Plugin API compatibility facade | `src/plugins/registry.ts` | `src/extension-host/plugin-api.ts` | `partial` | Compatibility `OpenClawPluginApi` composition and logger shaping now delegate through a host-owned helper; concrete registration callbacks now come from `src/extension-host/plugin-registry.ts` while `src/plugins/registry.ts` remains the external wrapper. | -| Plugin registry compatibility facade | `src/plugins/registry.ts` | `src/extension-host/plugin-registry.ts` | `partial` | The compatibility plugin-registry facade now delegates through a host-owned helper; `src/plugins/registry.ts` mainly defines shared types and forwards to the host-owned facade. | -| Plugin registry compatibility policy | mixed inside `src/extension-host/plugin-registry.ts` | `src/extension-host/plugin-registry-compat.ts` | `partial` | Provider normalization, command duplicate enforcement, and registry-local diagnostic shaping now delegate through a host-owned compatibility helper; the underlying provider-validation and plugin-command subsystems still remain legacy-owned. | -| Plugin registry registration actions | mixed inside `src/extension-host/plugin-registry.ts` | `src/extension-host/plugin-registry-registrations.ts` | `partial` | Low-risk registration actions for tools, hooks, gateway methods, HTTP routes, channels, CLI, services, typed hooks, and context engines now delegate through a host-owned helper; the compatibility facade still composes those actions with provider and command compatibility policy. | -| Runtime registry read surface | direct reads of `registry.channels`, `registry.providers`, `registry.tools`, `registry.services`, `registry.cliRegistrars`, `registry.commands`, `registry.gatewayHandlers`, and `registry.httpRoutes` across runtime consumers | `src/extension-host/runtime-registry.ts` | `partial` | Host-owned runtime-registry accessors now serve channel, provider, tool, service, CLI, command, gateway-method, and HTTP-route consumers. Channel registrations, provider registrations, tool registrations, command registrations, HTTP routes, gateway methods, CLI registrations, and service registrations now also have host-owned runtime-registry storage with mirrored legacy compatibility views, and the CLI pre-load fast path treats any pre-seeded runtime entry surface as already loaded. | -| Channel registration writes | `src/plugins/registry.ts` | host-owned channel registry | `partial` | Validation and normalization now delegate to `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry channel state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. The legacy plugin API still remains the call surface. | -| Provider registration writes | `src/plugins/registry.ts` | host-owned provider registry | `partial` | Provider normalization and compatibility diagnostics now delegate through `src/extension-host/plugin-registry-compat.ts`, duplicate detection and normalized registration shape still delegate to `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry provider state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. | -| HTTP route registration writes | `src/plugins/registry.ts` | host-owned route registry | `partial` | Route validation and normalization now delegate to `src/extension-host/runtime-registrations.ts`, and append or replace writes now land in host-owned runtime-registry route state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. | -| Gateway method registration writes | `src/plugins/registry.ts` | host-owned runtime contribution registry | `partial` | Duplicate detection and normalized method registration now delegate to `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry gateway-handler state via `src/extension-host/registry-writes.ts` with a mirrored legacy compatibility map. | -| Tool registration writes | `src/plugins/registry.ts` | host-owned tool registry | `partial` | Tool-name normalization and tool-factory shaping delegate through `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry tool state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. Duplicate handling still follows the legacy tool path. | -| CLI registration writes | `src/plugins/registry.ts` | host-owned CLI registry | `partial` | CLI command-name normalization delegates through `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry CLI state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. The legacy plugin API still remains the call surface. | -| Service registration writes | `src/plugins/registry.ts` | host-owned service registry | `partial` | Service-id normalization delegates through `src/extension-host/runtime-registrations.ts`, writes now land in host-owned runtime-registry service state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays, and broader lifecycle ownership now starts in `src/extension-host/service-lifecycle.ts`. | -| Command registration writes | `src/plugins/registry.ts` | host-owned command registry | `partial` | Command-name normalization and duplicate-enforcement diagnostics now delegate through `src/extension-host/plugin-registry-compat.ts`, and writes now land in host-owned runtime-registry command state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. | -| Plugin command runtime | `src/plugins/commands.ts`, `src/auto-reply/reply/commands-plugin.ts`, `src/auto-reply/status.ts`, `src/extension-host/loader-orchestrator.ts` | `src/extension-host/command-runtime.ts` | `partial` | Command registration, matching, execution, listing, native command-spec projection, and loader reload clearing now delegate through a host-owned command-runtime helper while `src/plugins/commands.ts` remains the compatibility facade. | -| Context-engine registration writes | `src/plugins/registry.ts` | host-owned context-engine registry | `partial` | Context-engine id normalization now delegates to `src/extension-host/runtime-registrations.ts`, and the compatibility write plus runtime resolution now route through `src/extension-host/context-engine-runtime.ts` via `src/extension-host/registry-writes.ts` and the `src/context-engine/registry.ts` compatibility facade. | -| Legacy hook registration writes | `src/plugins/registry.ts` | host-owned hook registry | `partial` | Hook-entry construction and event normalization now delegate to `src/extension-host/runtime-registrations.ts`, and the compatibility write now routes through `src/extension-host/registry-writes.ts`; internal-hook bridging still remains in the legacy plugin registry. | -| Typed-hook registration writes | `src/plugins/registry.ts` | host-owned typed-hook registry | `partial` | Typed-hook record construction and hook-name validation now delegate to `src/extension-host/runtime-registrations.ts`, and the compatibility write now routes through `src/extension-host/registry-writes.ts`; prompt-injection policy and execution semantics remain legacy-owned. | -| Hook compatibility policy and bridging | `src/plugins/registry.ts` | `src/extension-host/hook-compat.ts` | `partial` | Legacy internal-hook bridging and typed prompt-injection compatibility policy now delegate through a host-owned helper; actual hook execution ownership remains legacy-owned. | -| Hook execution and global runner | `src/plugins/hook-runner-global.ts`, `src/hooks/internal-hooks.ts`, plugin hook registration in `src/plugins/registry.ts` | canonical kernel event stages + host bridges | `not started` | No canonical event-stage migration has landed yet. | -| Service lifecycle | `src/plugins/services.ts` and plugin service registration | `src/extension-host/service-lifecycle.ts` | `partial` | Service startup, stop ordering, service-context creation, and failure logging now delegate through a host-owned service-lifecycle helper while `src/plugins/services.ts` remains the compatibility entry point. | -| CLI registration | plugin CLI registration in `src/plugins/registry.ts` and CLI loaders | `src/extension-host/cli-lifecycle.ts` plus static descriptors where possible | `partial` | CLI duplicate detection, registrar invocation, and async failure logging now delegate through a host-owned CLI-lifecycle helper while `src/plugins/cli.ts` remains the compatibility entry point. | -| Gateway/server methods | `src/plugins/registry.ts` gateway handler registration plus gateway runtime consumers | `src/extension-host/gateway-methods.ts` plus host-owned runtime contribution registry | `partial` | Gateway method-id aggregation, plugin diagnostic shaping, and extra-handler composition now delegate through a host-owned gateway-methods helper, and gateway handlers now live in host-owned runtime-registry state with a mirrored legacy compatibility map. Request dispatch semantics still live in the gateway server code. | -| Conversation binding ownership, approvals, and restore semantics | `src/plugins/conversation-binding.ts` plus `src/infra/outbound/session-binding-service.ts` | host-owned binding registry and approval policy surface | `not started` | This is a real missing migration surface. The host needs to own plugin-scoped conversation binding, approval persistence, restore-on-restart behavior, detached-binding cleanup, and legacy binding migration without making `src/plugins/conversation-binding.ts` the long-term public surface. | -| Interactive callback routing and namespace ownership | `src/plugins/interactive.ts` plus Telegram and Discord monitor-specific callback wiring | host-owned interaction router and namespace registry | `not started` | This needs to be explicit. The host should own namespace registration, dedupe, fallback rules, and callback dispatch. The first validated rollout may target Telegram and Discord, but the contract itself should stay generic and kernel-agnostic. | -| Ingress claim and bound-route short-circuit semantics | `src/plugins/hooks.ts` typed `inbound_claim` hook plus `src/auto-reply/reply/dispatch-from-config.ts` | canonical event-pipeline ingress claim stage | `not started` | The behavior is conceptually in-scope today, but it should land as a canonical ingress-stage contract with legacy hook bridging only as migration. The key parity rule is first-claim-wins for route ownership while passive observers still run through their own stages. | -| Interactive channel control verbs for bound agents | product-shaped runtime helpers added under `src/plugins/runtime/*` and direct channel-specific helpers in extension code | host-owned adapter runtime contracts and interaction capabilities | `not started` | The host needs a bounded first-cut set of control verbs for interactive agents, such as typing leases plus message or conversation actions. Those verbs should be expressed as generic host-owned adapter capabilities, even if the first validated rollout only exercises them through Telegram and Discord. | -| Slot arbitration | `src/plugins/slots.ts` | `src/extension-host/slot-arbitration.ts` | `partial` | Exclusive-slot selection and default-slot resolution now route through a host-owned slot-arbitration helper while `src/plugins/slots.ts` remains the compatibility facade. Broader slot and catalog arbitration are still pending. | -| ACP backend registry | `src/acp/runtime/registry.ts` | `src/extension-host/acp-runtime-backend-registry.ts` | `partial` | ACP backend registration and resolution now route through a host-owned ACP runtime-backend registry while `src/acp/runtime/registry.ts` remains the compatibility facade. Broader runtime-backend catalog ownership and ACPX pilot migration are still pending. | -| Runtime-backend family catalog | built-in embedding, media-understanding, and TTS runtime descriptors currently implied by runtime-specific host registries | `src/extension-host/runtime-backend-catalog.ts`, `src/extension-host/runtime-backend-arbitration.ts`, and `src/extension-host/runtime-backend-policy.ts` | `partial` | Embedding, media-understanding, and TTS runtime families now publish host-owned `capability.runtime-backend` catalog descriptors through `src/extension-host/runtime-backend-catalog.ts`. The catalog keeps subsystem ids, selector keys, capabilities, explicit auto-selection metadata, default models, and default ranking explicit without widening the legacy provider API. Embedding now shares host-owned backend definitions between `src/extension-host/embedding-runtime-backends.ts`, `src/extension-host/embedding-runtime-registry.ts`, and the runtime-backend catalog instead of the catalog deriving those built-ins from the registry facade. Media-understanding now shares host-owned backend definitions between `src/extension-host/media-runtime-backends.ts`, `src/extension-host/media-runtime-registry.ts`, and the runtime-backend catalog instead of the catalog deriving those built-ins from the registry facade. TTS now shares host-owned backend definitions between `src/extension-host/tts-runtime-backends.ts`, `src/extension-host/tts-runtime-registry.ts`, and the runtime-backend catalog instead of the catalog deriving those built-ins from the registry facade. Initial runtime-family arbitration now routes through `src/extension-host/runtime-backend-arbitration.ts`, shared default and preferred backend ordering plus fallback chaining now route through `src/extension-host/runtime-backend-policy.ts`, embeddings, media, and TTS now also have explicit host-owned policy seams in `src/extension-host/embedding-runtime-policy.ts`, `src/extension-host/media-runtime-policy.ts`, and `src/extension-host/tts-runtime-policy.ts`, and embedding auto-provider selection, embedding local setup guidance, memory doctor guidance, media provider candidate ordering plus default-model lookup, and TTS request setup, status, plus compatibility provider-order exports now read runtime-family data through that catalog-backed arbitration and backend-policy path. Broader selection and arbitration consumers still need to adopt it. | -| Embedding provider registry and fallback routing | `src/memory/embeddings.ts`, `src/memory/manager.ts`, `src/memory/manager-sync-ops.ts`, plus plugin provider capability filtering through `src/plugins/runtime.ts` | `src/extension-host/embedding-runtime-backends.ts`, `src/extension-host/embedding-runtime-policy.ts`, `src/extension-host/embedding-runtime-registry.ts`, `src/extension-host/embedding-runtime.ts`, `src/extension-host/embedding-runtime-types.ts`, `src/extension-host/embedding-manager-runtime.ts`, `src/extension-host/embedding-sync-planning.ts`, `src/extension-host/embedding-sync-execution.ts`, `src/extension-host/embedding-reindex-execution.ts`, and `src/extension-host/embedding-safe-reindex.ts` | `partial` | Built-in embedding backend ids, default-model metadata, default local backend identity, and auto-selection metadata now route through shared host-owned definitions in `src/extension-host/embedding-runtime-backends.ts`, which feed both `src/extension-host/embedding-runtime-registry.ts` and the runtime-backend catalog. Embedding-provider auto-selection, provider creation, local-setup guidance, and primary plus fallback routing now route through a host-owned embedding runtime-registry helper, with auto-provider order and local setup guidance now reading remote backend ordering from `src/extension-host/embedding-runtime-policy.ts` instead of the backend-definition module directly. Explicit embedding fallback-model selection now routes through `src/extension-host/embedding-runtime-policy.ts`, and both the runtime registry and manager fallback activation reuse that one host-owned policy seam instead of keeping duplicate provider-specific fallback logic. The public embedding runtime surface and result typing now route through `src/extension-host/embedding-runtime.ts` and `src/extension-host/embedding-runtime-types.ts`, the main memory-manager consumers now use that host-owned boundary, manager-side batch policy plus fallback activation now route through `src/extension-host/embedding-manager-runtime.ts`, sync and reindex planning now route through `src/extension-host/embedding-sync-planning.ts`, sync and reindex orchestration now route through `src/extension-host/embedding-sync-execution.ts`, reindex sync-body execution plus unsafe reset now route through `src/extension-host/embedding-reindex-execution.ts`, and safe-reindex temp-db creation, file swap, reopen, and cleanup now route through `src/extension-host/embedding-safe-reindex.ts` while `src/memory/embeddings.ts` remains the compatibility facade. Runtime-backend catalog descriptors now also route through `src/extension-host/runtime-backend-catalog.ts`, and memory doctor guidance now reads the embedding auto-provider order from that policy seam. Remaining embedding work is down to broader consumer adoption and arbitration on top of that catalog surface. | -| Media-understanding provider registry and execution routing | `src/media-understanding/providers/index.ts`, `src/media-understanding/runner.ts`, `src/media-understanding/runner.entries.ts`, `src/media-understanding/resolve.ts`, plus plugin provider capability filtering through `src/plugins/runtime.ts` | `src/extension-host/media-runtime-backends.ts`, `src/extension-host/media-runtime-registry.ts`, `src/extension-host/media-runtime-policy.ts`, `src/extension-host/media-runtime-execution.ts`, `src/extension-host/media-runtime-auto.ts`, `src/extension-host/media-runtime-orchestration.ts`, `src/extension-host/media-runtime-config.ts`, `src/extension-host/media-runtime-decision.ts`, `src/extension-host/media-runtime-api.ts`, and `src/extension-host/media-runtime-entrypoints.ts` | `partial` | Built-in media backend ids, provider normalization, auto-selection seed order, selector-key shaping, and default-model metadata now route through shared host-owned definitions in `src/extension-host/media-runtime-backends.ts`, which feed both `src/extension-host/media-runtime-registry.ts` and the runtime-backend catalog. Override merging and runtime lookup now route through a host-owned media runtime-registry helper. Media provider candidate ordering, active-model precedence, and default-model fallback selection now route through `src/extension-host/media-runtime-policy.ts`, so `src/extension-host/media-runtime-auto.ts` no longer open-codes that subsystem-local ordering. Provider and CLI entry execution, output parsing, provider query normalization, provider auth and context shaping, and proxy-aware fetch handling now route through `src/extension-host/media-runtime-execution.ts`. Local-binary probing, auto-entry selection, and top-level capability orchestration now route through `src/extension-host/media-runtime-auto.ts` and `src/extension-host/media-runtime-orchestration.ts`. Prompt, timeout, scope, model-entry, and concurrency planning now route through `src/extension-host/media-runtime-config.ts`, and media decision shaping now routes through `src/extension-host/media-runtime-decision.ts`. The remaining API composition in `src/media-understanding/runner.ts` now routes through `src/extension-host/media-runtime-api.ts`, and the remaining lazy provider and CLI entrypoint wiring in `src/media-understanding/runner.entries.ts` now routes through `src/extension-host/media-runtime-entrypoints.ts`, leaving `src/media-understanding/providers/index.ts`, `src/media-understanding/runner.ts`, `src/media-understanding/runner.entries.ts`, and `src/media-understanding/resolve.ts` as compatibility facades. Runtime-backend catalog descriptors now also route through `src/extension-host/runtime-backend-catalog.ts`, and media auto-selection plus default-model lookup now consume that catalog through the shared media policy seam. Remaining media work is down to broader consumer adoption and arbitration on top of that catalog surface. | -| TTS provider registry and execution routing | `src/tts/tts.ts`, `src/gateway/server-methods/tts.ts`, and `src/auto-reply/reply/commands-tts.ts` | `src/extension-host/tts-runtime-backends.ts`, `src/extension-host/tts-runtime-registry.ts`, `src/extension-host/tts-runtime-policy.ts`, `src/extension-host/tts-runtime-execution.ts`, `src/extension-host/tts-runtime-setup.ts`, `src/extension-host/tts-config.ts`, `src/extension-host/tts-preferences.ts`, `src/extension-host/tts-payload.ts`, `src/extension-host/tts-status.ts`, and `src/extension-host/tts-api.ts` | `partial` | Built-in TTS backend metadata now routes through shared host-owned definitions in `src/extension-host/tts-runtime-backends.ts`, which feed both `src/extension-host/tts-runtime-registry.ts` and the runtime-backend catalog. Provider ordering, API-key resolution, configuration checks, and telephony support now route through that shared host-owned TTS runtime surface. Explicit TTS override and configured-fallback policy now routes through `src/extension-host/tts-runtime-policy.ts`, so default provider selection and fallback chaining no longer depend on hardcoded local ordering. Provider execution loops, output-format selection, telephony synthesis, and provider-error shaping now route through `src/extension-host/tts-runtime-execution.ts`. Provider selection and request setup now route through `src/extension-host/tts-runtime-setup.ts`. TTS config normalization, defaults, and model-override policy now route through `src/extension-host/tts-config.ts`. Prefs-path resolution, auto-mode policy, and persisted TTS preference reads and writes now route through `src/extension-host/tts-preferences.ts`. Auto-TTS gating, directive cleanup, truncation, summarization, and payload planning now route through `src/extension-host/tts-payload.ts`. Last-attempt state, status snapshots, and shared status formatting now route through `src/extension-host/tts-status.ts`. The remaining API composition in `src/tts/tts.ts` now routes through `src/extension-host/tts-api.ts`, so `src/tts/tts.ts` is down to a compatibility facade. Runtime-backend catalog descriptors now also route through `src/extension-host/runtime-backend-catalog.ts`, and TTS request setup, status, plus compatibility provider-order exports now consume that catalog-backed arbitration policy directly. Remaining TTS work is down to broader consumer adoption and arbitration on top of that catalog surface. | -| Onboarding/install/setup surfaces | `src/plugins/install.ts`, package manifests, channel catalog, onboarding commands | host-owned static descriptors | `partial` | Static metadata normalization has started; full setup/install descriptor migration is not done. | -| Pilot migrations | `extensions/thread-ownership`, `extensions/telegram`, `extensions/acpx` | extension-host path with parity tracking | `not started` | No pilot runs through the host path yet. | +| Surface | Current implementation | Target owner | Status | How it has been handled so far | +| ------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| Active runtime registry state | `src/plugins/runtime.ts` plus global plugin runtime state | `src/extension-host/active-registry.ts` | `moved` | Host-owned active registry exists; `src/plugins/runtime.ts` is now a compatibility facade. | +| Normalized extension descriptor model | plugin manifests and package metadata interpreted ad hoc across `src/plugins/manifest.ts`, `src/plugins/discovery.ts`, `src/plugins/install.ts` | `src/extension-host/schema.ts` | `partial` | `ResolvedExtension`, `ResolvedContribution`, and `ContributionPolicy` exist; current manifests project into them through compatibility adapters. | +| Resolved static registry | flat rows in `src/plugins/manifest-registry.ts` | `src/extension-host/resolved-registry.ts` | `partial` | Manifest records now carry `resolvedExtension`; a host-owned resolved registry view exists for static consumers. | +| Manifest/package metadata loading | `src/plugins/manifest.ts`, `src/plugins/discovery.ts`, `src/plugins/install.ts` | `src/extension-host/schema.ts` and `src/extension-host/manifest-registry.ts` | `partial` | Package metadata parsing is routed through host schema helpers; legacy loader flow still supplies the source manifests. | +| Loader SDK alias compatibility | `src/plugins/loader.ts` | `src/extension-host/loader-compat.ts` | `partial` | Plugin-SDK alias candidate ordering, alias-file resolution, and scoped alias-map construction now live in host-owned loader compatibility helpers. | +| Loader alias-wired module loader creation | `src/plugins/loader.ts` | `src/extension-host/loader-module-loader.ts` | `partial` | Lazy Jiti creation and SDK-alias-wired module loading now delegate through a host-owned loader-module-loader helper. | +| Loader cache key and registry cache control | `src/plugins/loader.ts` | `src/extension-host/loader-cache.ts` | `partial` | Cache-key construction, LRU registry cache reads and writes, and cache clearing now delegate through host-owned loader-cache helpers while preserving the current cache shape and cap. | +| Loader lazy runtime proxy creation | `src/plugins/loader.ts` | `src/extension-host/loader-runtime-proxy.ts` | `partial` | Lazy plugin runtime creation now delegates through a host-owned loader-runtime-proxy helper instead of remaining inline in the orchestrator. | +| Loader provenance and duplicate-order policy | `src/plugins/loader.ts` | `src/extension-host/loader-policy.ts` | `partial` | Plugin-record creation, duplicate precedence, and provenance indexing now live in host-owned loader-policy helpers. | +| Loader discovery policy results | mixed inside `src/extension-host/loader-policy.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-discovery-policy.ts` | `partial` | Open-allowlist discovery warnings now resolve through explicit host-owned discovery-policy results before the orchestrator logs them. | +| Loader initial candidate planning and record creation | `src/plugins/loader.ts` | `src/extension-host/loader-records.ts` | `partial` | Duplicate detection, initial record creation, manifest metadata attachment, and first-pass enable-state planning now delegate through host-owned loader-records helpers. | +| Loader entry-path opening and module import | `src/plugins/loader.ts` | `src/extension-host/loader-import.ts` | `partial` | Boundary-checked entry opening and module import now delegate through host-owned loader-import helpers while preserving the current trusted in-process loading model. | +| Loader module-export, config-validation, and memory-slot decisions | `src/plugins/loader.ts` | `src/extension-host/loader-runtime.ts` | `partial` | Module export resolution, export-metadata application, config validation, and early or final memory-slot decisions now delegate through host-owned loader-runtime helpers. | +| Loader post-import planning and register execution | `src/plugins/loader.ts` | `src/extension-host/loader-register.ts` | `partial` | Definition application, post-import validation planning, and `register(...)` execution now delegate through host-owned loader-register helpers while preserving current plugin behavior. | +| Loader per-candidate orchestration | `src/plugins/loader.ts` | `src/extension-host/loader-flow.ts` | `partial` | The per-candidate load flow now runs through a host-owned orchestrator that composes planning, import, runtime validation, register execution, and record-state helpers. | +| Loader top-level load orchestration | `src/plugins/loader.ts` | `src/extension-host/loader-orchestrator.ts` | `partial` | High-level load entry and compatibility facade behavior now route through a host-owned loader orchestrator while `src/plugins/loader.ts` remains the external compatibility surface. | +| Loader host process state | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-host-state.ts` | `partial` | Shared discovery warning-cache state and loader reset behavior now delegate through a host-owned loader-host-state helper. | +| Loader preflight and cache-hit setup | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-preflight.ts` | `partial` | Test-default application, config normalization, cache-key construction, cache-hit activation, and command-clear preflight now delegate through a host-owned loader-preflight helper. | +| Loader post-preflight pipeline composition | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-pipeline.ts` | `partial` | Post-preflight execution setup and session-run composition now delegate through a host-owned loader-pipeline helper. | +| Loader execution setup composition | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-execution.ts` | `partial` | Runtime creation, registry creation, bootstrap setup, module-loader creation, and session creation now delegate through a host-owned loader-execution helper. | +| Loader discovery and manifest bootstrap | mixed inside `src/plugins/loader.ts` and `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-bootstrap.ts` | `partial` | Discovery, manifest loading, manifest diagnostics, discovery-policy logging, provenance building, and candidate ordering now delegate through a host-owned loader-bootstrap helper. | +| Loader mutable activation state session | local variables in `src/extension-host/loader-orchestrator.ts` | `src/extension-host/loader-session.ts` | `partial` | Seen-id tracking, memory-slot selection state, and finalization inputs now live in a host-owned loader session instead of being spread across top-level loader variables. | +| Loader session run and finalization composition | mixed inside `src/extension-host/loader-orchestrator.ts` and `src/extension-host/loader-session.ts` | `src/extension-host/loader-run.ts` | `partial` | Candidate iteration, manifest lookup, per-candidate session processing, and finalization handoff now delegate through a host-owned loader-run helper. | +| Loader activation policy outcomes | open-coded in `src/extension-host/loader-flow.ts` | `src/extension-host/loader-activation-policy.ts` | `partial` | Duplicate precedence, config enablement, and early memory-slot gating now resolve through explicit host-owned activation-policy outcomes instead of remaining as inline loader decisions. | +| Loader record-state transitions | `src/plugins/loader.ts` | `src/extension-host/loader-state.ts` | `partial` | The loader now enforces an explicit lifecycle transition model (`prepared -> imported -> validated -> registered -> ready`, plus terminal `disabled` and `error`) while still mapping back to compatibility `PluginRecord.status` values. | +| Loader finalization policy results | mixed inside `src/extension-host/loader-policy.ts` and `src/extension-host/loader-finalize.ts` | `src/extension-host/loader-finalization-policy.ts` | `partial` | Memory-slot finalization warnings and provenance-based untracked-extension warnings now resolve through explicit host-owned finalization-policy results before the finalizer applies them. | +| Loader final cache, readiness, and activation finalization | `src/plugins/loader.ts` | `src/extension-host/loader-finalize.ts` | `partial` | Cache writes, readiness promotion, and registry activation now delegate through a host-owned loader-finalize helper; broader host lifecycle and policy semantics are still pending. | +| Channel lookup | `src/channels/plugins/index.ts`, `src/channels/plugins/registry-loader.ts`, `src/channels/registry.ts` | extension-host-backed registries plus kernel channel contracts | `partial` | Readers now consume host-owned runtime-registry channel accessors, and channel registrations now also keep host-owned runtime-registry storage with mirrored legacy compatibility arrays. Writes still originate from plugin registration. | +| Dock lookup | `src/channels/dock.ts` | host-owned static descriptors | `partial` | Runtime lookup now uses the host boundary; dock ownership itself has not moved yet. | +| Message-channel normalization | `src/utils/message-channel.ts` | host-owned channel registry view | `partial` | Lookup path now reads through host-owned runtime-registry channel accessors instead of raw legacy channel arrays. | +| Default plugin HTTP route lookup | `src/plugins/http-registry.ts` | host-owned route registry | `partial` | Default route registration and lookup now use host-owned runtime-registry state with a mirrored legacy `registry.httpRoutes` compatibility view. The plugin API still remains the external call surface for static route registration. | +| Channel catalog static metadata | `src/channels/plugins/catalog.ts` | host-owned static descriptors | `partial` | Package metadata parsing now flows through host schema helpers; full canonical catalog migration has not started. | +| Plugin skill discovery | `src/agents/skills/plugin-skills.ts` | host-owned resolved registry | `moved` | Static consumer now reads only resolved-extension data for skill paths and enablement filtering. | +| Plugin auto-enable | `src/config/plugin-auto-enable.ts` | host-owned resolved registry | `partial` | Primary logic runs on resolved-extension data; old manifest-registry injection remains as a compatibility input for older callers and tests. | +| Config validation indexing | `src/config/validation.ts`, `src/config/resolved-extension-validation.ts` | host-owned resolved registry | `moved` | Validation indexing now builds from resolved-extension records instead of flat manifest rows. | +| Config doc baseline generation | `src/config/doc-baseline.ts` | host-owned resolved registry | `moved` | Bundled plugin and channel metadata now load through the resolved-extension registry. | +| Plugin tool resolution and metadata | `src/plugins/tools.ts` | `src/extension-host/tool-runtime.ts` | `partial` | Optional-tool gating, plugin-id and tool-name conflict handling, tool-factory resolution, and plugin-tool metadata tracking now delegate through a host-owned tool-runtime helper while tool registrations now also keep host-owned runtime-registry storage with a mirrored legacy compatibility view. `src/plugins/tools.ts` remains the loader and config-normalization facade. | +| Plugin provider resolution | `src/plugins/providers.ts` | `src/extension-host/provider-runtime.ts` | `partial` | Provider projection from registry entries into runtime provider objects now delegates through a host-owned provider-runtime helper while `src/plugins/providers.ts` remains the loader and config-normalization facade. | +| Plugin provider discovery | `src/plugins/provider-discovery.ts` | `src/extension-host/provider-discovery.ts` | `partial` | Discovery-capable provider filtering, order grouping, and result normalization now delegate through a host-owned provider-discovery helper while `src/plugins/provider-discovery.ts` remains the compatibility facade around the legacy provider loader path. | +| Plugin provider auth helpers | `src/commands/provider-auth-helpers.ts` | `src/extension-host/provider-auth.ts` | `partial` | Provider matching, auth-method selection, config-patch merging, and default-model application now delegate through a host-owned provider-auth helper while command and onboarding entry points remain compatibility surfaces. | +| Plugin provider wizard metadata and choice resolution | `src/plugins/provider-wizard.ts` | `src/extension-host/provider-wizard.ts` | `partial` | Onboarding option building, model-picker entry building, and provider-method choice resolution now delegate through a host-owned provider-wizard helper while `src/plugins/provider-wizard.ts` remains the compatibility facade around loader-backed provider access and post-selection hooks. | +| Plugin provider auth application flow | `src/commands/auth-choice.apply.plugin-provider.ts` | `src/extension-host/provider-auth-flow.ts` | `partial` | Loaded-provider auth application, plugin-enable gating, auth-method execution, and post-auth default-model handling now delegate through a host-owned provider-auth-flow helper while `src/commands/auth-choice.apply.plugin-provider.ts` remains the compatibility entry point. | +| Plugin provider post-selection hook execution | `src/plugins/provider-wizard.ts`, `src/commands/model-picker.ts` | `src/extension-host/provider-model-selection.ts` | `partial` | Provider post-selection hook lookup and invocation now delegate through a host-owned provider-model-selection helper while `src/plugins/provider-wizard.ts` remains a compatibility facade and existing command consumers continue migrating onto the host-owned surface. | +| Plugin loader activation | `src/plugins/loader.ts` | extension host lifecycle + compatibility loader | `partial` | Activation now routes through `src/extension-host/activation.ts`, but discovery, enablement, provenance, module loading, and policy still live in the legacy plugin loader. | +| Plugin API compatibility facade | `src/plugins/registry.ts` | `src/extension-host/plugin-api.ts` | `partial` | Compatibility `OpenClawPluginApi` composition and logger shaping now delegate through a host-owned helper; concrete registration callbacks now come from `src/extension-host/plugin-registry.ts` while `src/plugins/registry.ts` remains the external wrapper. | +| Plugin registry compatibility facade | `src/plugins/registry.ts` | `src/extension-host/plugin-registry.ts` | `partial` | The compatibility plugin-registry facade now delegates through a host-owned helper; `src/plugins/registry.ts` mainly defines shared types and forwards to the host-owned facade. | +| Plugin registry compatibility policy | mixed inside `src/extension-host/plugin-registry.ts` | `src/extension-host/plugin-registry-compat.ts` | `partial` | Provider normalization, command duplicate enforcement, and registry-local diagnostic shaping now delegate through a host-owned compatibility helper; the underlying provider-validation and plugin-command subsystems still remain legacy-owned. | +| Plugin registry registration actions | mixed inside `src/extension-host/plugin-registry.ts` | `src/extension-host/plugin-registry-registrations.ts` | `partial` | Low-risk registration actions for tools, hooks, gateway methods, HTTP routes, channels, CLI, services, typed hooks, and context engines now delegate through a host-owned helper; the compatibility facade still composes those actions with provider and command compatibility policy. | +| Runtime registry read surface | direct reads of `registry.channels`, `registry.providers`, `registry.tools`, `registry.services`, `registry.cliRegistrars`, `registry.commands`, `registry.gatewayHandlers`, and `registry.httpRoutes` across runtime consumers | `src/extension-host/runtime-registry.ts` | `partial` | Host-owned runtime-registry accessors now serve channel, provider, tool, service, CLI, command, gateway-method, and HTTP-route consumers. Channel registrations, provider registrations, tool registrations, command registrations, HTTP routes, gateway methods, CLI registrations, and service registrations now also have host-owned runtime-registry storage with mirrored legacy compatibility views, and the CLI pre-load fast path treats any pre-seeded runtime entry surface as already loaded. | +| Channel registration writes | `src/plugins/registry.ts` | host-owned channel registry | `partial` | Validation and normalization now delegate to `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry channel state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. The legacy plugin API still remains the call surface. | +| Provider registration writes | `src/plugins/registry.ts` | host-owned provider registry | `partial` | Provider normalization and compatibility diagnostics now delegate through `src/extension-host/plugin-registry-compat.ts`, duplicate detection and normalized registration shape still delegate to `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry provider state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. | +| HTTP route registration writes | `src/plugins/registry.ts` | host-owned route registry | `partial` | Route validation and normalization now delegate to `src/extension-host/runtime-registrations.ts`, and append or replace writes now land in host-owned runtime-registry route state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. | +| Gateway method registration writes | `src/plugins/registry.ts` | host-owned runtime contribution registry | `partial` | Duplicate detection and normalized method registration now delegate to `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry gateway-handler state via `src/extension-host/registry-writes.ts` with a mirrored legacy compatibility map. | +| Tool registration writes | `src/plugins/registry.ts` | host-owned tool registry | `partial` | Tool-name normalization and tool-factory shaping delegate through `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry tool state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. Duplicate handling still follows the legacy tool path. | +| CLI registration writes | `src/plugins/registry.ts` | host-owned CLI registry | `partial` | CLI command-name normalization delegates through `src/extension-host/runtime-registrations.ts`, and writes now land in host-owned runtime-registry CLI state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. The legacy plugin API still remains the call surface. | +| Service registration writes | `src/plugins/registry.ts` | host-owned service registry | `partial` | Service-id normalization delegates through `src/extension-host/runtime-registrations.ts`, writes now land in host-owned runtime-registry service state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays, and broader lifecycle ownership now starts in `src/extension-host/service-lifecycle.ts`. | +| Command registration writes | `src/plugins/registry.ts` | host-owned command registry | `partial` | Command-name normalization and duplicate-enforcement diagnostics now delegate through `src/extension-host/plugin-registry-compat.ts`, and writes now land in host-owned runtime-registry command state via `src/extension-host/registry-writes.ts` with mirrored legacy compatibility arrays. | +| Plugin command runtime | `src/plugins/commands.ts`, `src/auto-reply/reply/commands-plugin.ts`, `src/auto-reply/status.ts`, `src/extension-host/loader-orchestrator.ts` | `src/extension-host/command-runtime.ts` | `partial` | Command registration, matching, execution, listing, native command-spec projection, and loader reload clearing now delegate through a host-owned command-runtime helper while `src/plugins/commands.ts` remains the compatibility facade. | +| Context-engine registration writes | `src/plugins/registry.ts` | host-owned context-engine registry | `partial` | Context-engine id normalization now delegates to `src/extension-host/runtime-registrations.ts`, and the compatibility write plus runtime resolution now route through `src/extension-host/context-engine-runtime.ts` via `src/extension-host/registry-writes.ts` and the `src/context-engine/registry.ts` compatibility facade. | +| Legacy hook registration writes | `src/plugins/registry.ts` | host-owned hook registry | `partial` | Hook-entry construction and event normalization now delegate to `src/extension-host/runtime-registrations.ts`, and the compatibility write now routes through `src/extension-host/registry-writes.ts`; internal-hook bridging still remains in the legacy plugin registry. | +| Typed-hook registration writes | `src/plugins/registry.ts` | host-owned typed-hook registry | `partial` | Typed-hook record construction and hook-name validation now delegate to `src/extension-host/runtime-registrations.ts`, and the compatibility write now routes through `src/extension-host/registry-writes.ts`; prompt-injection policy and execution semantics remain legacy-owned. | +| Hook compatibility policy and bridging | `src/plugins/registry.ts` | `src/extension-host/hook-compat.ts` | `partial` | Legacy internal-hook bridging and typed prompt-injection compatibility policy now delegate through a host-owned helper; actual hook execution ownership remains legacy-owned. | +| Hook execution and global runner | `src/plugins/hook-runner-global.ts`, `src/hooks/internal-hooks.ts`, plugin hook registration in `src/plugins/registry.ts` | canonical kernel event stages + host bridges | `not started` | No canonical event-stage migration has landed yet. | +| Service lifecycle | `src/plugins/services.ts` and plugin service registration | `src/extension-host/service-lifecycle.ts` | `partial` | Service startup, stop ordering, service-context creation, and failure logging now delegate through a host-owned service-lifecycle helper while `src/plugins/services.ts` remains the compatibility entry point. | +| CLI registration | plugin CLI registration in `src/plugins/registry.ts` and CLI loaders | `src/extension-host/cli-lifecycle.ts` plus static descriptors where possible | `partial` | CLI duplicate detection, registrar invocation, and async failure logging now delegate through a host-owned CLI-lifecycle helper while `src/plugins/cli.ts` remains the compatibility entry point. | +| Gateway/server methods | `src/plugins/registry.ts` gateway handler registration plus gateway runtime consumers | `src/extension-host/gateway-methods.ts` plus host-owned runtime contribution registry | `partial` | Gateway method-id aggregation, plugin diagnostic shaping, and extra-handler composition now delegate through a host-owned gateway-methods helper, and gateway handlers now live in host-owned runtime-registry state with a mirrored legacy compatibility map. Request dispatch semantics still live in the gateway server code. | +| Conversation binding ownership, approvals, and restore semantics | `src/plugins/conversation-binding.ts` plus `src/infra/outbound/session-binding-service.ts` | host-owned binding registry and approval policy surface | `not started` | This is a real missing migration surface. The host needs to own plugin-scoped conversation binding, approval persistence, restore-on-restart behavior, detached-binding cleanup, and legacy binding migration without making `src/plugins/conversation-binding.ts` the long-term public surface. | +| Interactive callback routing and namespace ownership | `src/plugins/interactive.ts` plus Telegram and Discord monitor-specific callback wiring | host-owned interaction router and namespace registry | `not started` | This needs to be explicit. The host should own namespace registration, dedupe, fallback rules, and callback dispatch. The first validated rollout may target Telegram and Discord, but the contract itself should stay generic and kernel-agnostic. | +| Ingress claim and bound-route short-circuit semantics | `src/plugins/hooks.ts` typed `inbound_claim` hook plus `src/auto-reply/reply/dispatch-from-config.ts` | canonical event-pipeline ingress claim stage | `not started` | The behavior is conceptually in-scope today, but it should land as a canonical ingress-stage contract with legacy hook bridging only as migration. The key parity rule is first-claim-wins for route ownership while passive observers still run through their own stages. | +| Interactive channel control verbs for bound agents | product-shaped runtime helpers added under `src/plugins/runtime/*` and direct channel-specific helpers in extension code | host-owned adapter runtime contracts and interaction capabilities | `not started` | The host needs a bounded first-cut set of control verbs for interactive agents, such as typing leases plus message or conversation actions. Those verbs should be expressed as generic host-owned adapter capabilities, even if the first validated rollout only exercises them through Telegram and Discord. | +| Slot arbitration | `src/plugins/slots.ts` | `src/extension-host/slot-arbitration.ts` | `partial` | Exclusive-slot selection and default-slot resolution now route through a host-owned slot-arbitration helper while `src/plugins/slots.ts` remains the compatibility facade. Broader slot and catalog arbitration are still pending. | +| ACP backend registry | `src/acp/runtime/registry.ts` | `src/extension-host/acp-runtime-backend-registry.ts` | `partial` | ACP backend registration and resolution now route through a host-owned ACP runtime-backend registry while `src/acp/runtime/registry.ts` remains the compatibility facade. Broader runtime-backend catalog ownership and ACPX pilot migration are still pending. | +| Runtime-backend family catalog | built-in embedding, media-understanding, and TTS runtime descriptors currently implied by runtime-specific host registries | `src/extension-host/runtime-backend-catalog.ts`, `src/extension-host/runtime-backend-arbitration.ts`, and `src/extension-host/runtime-backend-policy.ts` | `partial` | Embedding, media-understanding, and TTS runtime families now publish host-owned `capability.runtime-backend` catalog descriptors through `src/extension-host/runtime-backend-catalog.ts`. The catalog keeps subsystem ids, selector keys, capabilities, explicit auto-selection metadata, default models, and default ranking explicit without widening the legacy provider API. Embedding now shares host-owned backend definitions between `src/extension-host/embedding-runtime-backends.ts`, `src/extension-host/embedding-runtime-registry.ts`, and the runtime-backend catalog instead of the catalog deriving those built-ins from the registry facade. Media-understanding now shares host-owned backend definitions between `src/extension-host/media-runtime-backends.ts`, `src/extension-host/media-runtime-registry.ts`, and the runtime-backend catalog instead of the catalog deriving those built-ins from the registry facade. TTS now shares host-owned backend definitions between `src/extension-host/tts-runtime-backends.ts`, `src/extension-host/tts-runtime-registry.ts`, and the runtime-backend catalog instead of the catalog deriving those built-ins from the registry facade. Initial runtime-family arbitration now routes through `src/extension-host/runtime-backend-arbitration.ts`, shared default and preferred backend ordering plus fallback chaining now route through `src/extension-host/runtime-backend-policy.ts`, the catalog helpers for generic subsystem ordering, media auto-ordering, and TTS preferred-provider ordering now also route through that shared backend-policy layer, embeddings, media, and TTS now also have explicit host-owned policy seams in `src/extension-host/embedding-runtime-policy.ts`, `src/extension-host/media-runtime-policy.ts`, and `src/extension-host/tts-runtime-policy.ts`, and embedding auto-provider selection, embedding local setup guidance, memory doctor guidance, media provider candidate ordering plus default-model lookup, and TTS request setup, status, plus compatibility provider-order exports now read runtime-family data through that catalog-backed arbitration and backend-policy path. Broader selection and arbitration consumers still need to adopt it. | +| Embedding provider registry and fallback routing | `src/memory/embeddings.ts`, `src/memory/manager.ts`, `src/memory/manager-sync-ops.ts`, plus plugin provider capability filtering through `src/plugins/runtime.ts` | `src/extension-host/embedding-runtime-backends.ts`, `src/extension-host/embedding-runtime-policy.ts`, `src/extension-host/embedding-runtime-registry.ts`, `src/extension-host/embedding-runtime.ts`, `src/extension-host/embedding-runtime-types.ts`, `src/extension-host/embedding-manager-runtime.ts`, `src/extension-host/embedding-sync-planning.ts`, `src/extension-host/embedding-sync-execution.ts`, `src/extension-host/embedding-reindex-execution.ts`, and `src/extension-host/embedding-safe-reindex.ts` | `partial` | Built-in embedding backend ids, default-model metadata, default local backend identity, and auto-selection metadata now route through shared host-owned definitions in `src/extension-host/embedding-runtime-backends.ts`, which feed both `src/extension-host/embedding-runtime-registry.ts` and the runtime-backend catalog. Embedding-provider auto-selection, provider creation, local-setup guidance, and primary plus fallback routing now route through a host-owned embedding runtime-registry helper, with auto-provider order and local setup guidance now reading remote backend ordering from `src/extension-host/embedding-runtime-policy.ts` instead of the backend-definition module directly. Explicit embedding fallback-model selection now routes through `src/extension-host/embedding-runtime-policy.ts`, and both the runtime registry and manager fallback activation reuse that one host-owned policy seam instead of keeping duplicate provider-specific fallback logic. The public embedding runtime surface and result typing now route through `src/extension-host/embedding-runtime.ts` and `src/extension-host/embedding-runtime-types.ts`, the main memory-manager consumers now use that host-owned boundary, manager-side batch policy plus fallback activation now route through `src/extension-host/embedding-manager-runtime.ts`, sync and reindex planning now route through `src/extension-host/embedding-sync-planning.ts`, sync and reindex orchestration now route through `src/extension-host/embedding-sync-execution.ts`, reindex sync-body execution plus unsafe reset now route through `src/extension-host/embedding-reindex-execution.ts`, and safe-reindex temp-db creation, file swap, reopen, and cleanup now route through `src/extension-host/embedding-safe-reindex.ts` while `src/memory/embeddings.ts` remains the compatibility facade. Runtime-backend catalog descriptors now also route through `src/extension-host/runtime-backend-catalog.ts`, and memory doctor guidance now reads the embedding auto-provider order from that policy seam. Remaining embedding work is down to broader consumer adoption and arbitration on top of that catalog surface. | +| Media-understanding provider registry and execution routing | `src/media-understanding/providers/index.ts`, `src/media-understanding/runner.ts`, `src/media-understanding/runner.entries.ts`, `src/media-understanding/resolve.ts`, plus plugin provider capability filtering through `src/plugins/runtime.ts` | `src/extension-host/media-runtime-backends.ts`, `src/extension-host/media-runtime-registry.ts`, `src/extension-host/media-runtime-policy.ts`, `src/extension-host/media-runtime-execution.ts`, `src/extension-host/media-runtime-auto.ts`, `src/extension-host/media-runtime-orchestration.ts`, `src/extension-host/media-runtime-config.ts`, `src/extension-host/media-runtime-decision.ts`, `src/extension-host/media-runtime-api.ts`, and `src/extension-host/media-runtime-entrypoints.ts` | `partial` | Built-in media backend ids, provider normalization, auto-selection seed order, selector-key shaping, and default-model metadata now route through shared host-owned definitions in `src/extension-host/media-runtime-backends.ts`, which feed both `src/extension-host/media-runtime-registry.ts` and the runtime-backend catalog. Override merging and runtime lookup now route through a host-owned media runtime-registry helper. Media provider candidate ordering, active-model precedence, and default-model fallback selection now route through `src/extension-host/media-runtime-policy.ts`, so `src/extension-host/media-runtime-auto.ts` no longer open-codes that subsystem-local ordering. Provider and CLI entry execution, output parsing, provider query normalization, provider auth and context shaping, and proxy-aware fetch handling now route through `src/extension-host/media-runtime-execution.ts`. Local-binary probing, auto-entry selection, and top-level capability orchestration now route through `src/extension-host/media-runtime-auto.ts` and `src/extension-host/media-runtime-orchestration.ts`. Prompt, timeout, scope, model-entry, and concurrency planning now route through `src/extension-host/media-runtime-config.ts`, and media decision shaping now routes through `src/extension-host/media-runtime-decision.ts`. The remaining API composition in `src/media-understanding/runner.ts` now routes through `src/extension-host/media-runtime-api.ts`, and the remaining lazy provider and CLI entrypoint wiring in `src/media-understanding/runner.entries.ts` now routes through `src/extension-host/media-runtime-entrypoints.ts`, leaving `src/media-understanding/providers/index.ts`, `src/media-understanding/runner.ts`, `src/media-understanding/runner.entries.ts`, and `src/media-understanding/resolve.ts` as compatibility facades. Runtime-backend catalog descriptors now also route through `src/extension-host/runtime-backend-catalog.ts`, and media auto-selection plus default-model lookup now consume that catalog through the shared media policy seam. Remaining media work is down to broader consumer adoption and arbitration on top of that catalog surface. | +| TTS provider registry and execution routing | `src/tts/tts.ts`, `src/gateway/server-methods/tts.ts`, and `src/auto-reply/reply/commands-tts.ts` | `src/extension-host/tts-runtime-backends.ts`, `src/extension-host/tts-runtime-registry.ts`, `src/extension-host/tts-runtime-policy.ts`, `src/extension-host/tts-runtime-execution.ts`, `src/extension-host/tts-runtime-setup.ts`, `src/extension-host/tts-config.ts`, `src/extension-host/tts-preferences.ts`, `src/extension-host/tts-payload.ts`, `src/extension-host/tts-status.ts`, and `src/extension-host/tts-api.ts` | `partial` | Built-in TTS backend metadata now routes through shared host-owned definitions in `src/extension-host/tts-runtime-backends.ts`, which feed both `src/extension-host/tts-runtime-registry.ts` and the runtime-backend catalog. Provider ordering, API-key resolution, configuration checks, and telephony support now route through that shared host-owned TTS runtime surface. Explicit TTS override and configured-fallback policy now routes through `src/extension-host/tts-runtime-policy.ts`, so default provider selection and fallback chaining no longer depend on hardcoded local ordering. Provider execution loops, output-format selection, telephony synthesis, and provider-error shaping now route through `src/extension-host/tts-runtime-execution.ts`. Provider selection and request setup now route through `src/extension-host/tts-runtime-setup.ts`. TTS config normalization, defaults, and model-override policy now route through `src/extension-host/tts-config.ts`. Prefs-path resolution, auto-mode policy, and persisted TTS preference reads and writes now route through `src/extension-host/tts-preferences.ts`. Auto-TTS gating, directive cleanup, truncation, summarization, and payload planning now route through `src/extension-host/tts-payload.ts`. Last-attempt state, status snapshots, and shared status formatting now route through `src/extension-host/tts-status.ts`. The remaining API composition in `src/tts/tts.ts` now routes through `src/extension-host/tts-api.ts`, so `src/tts/tts.ts` is down to a compatibility facade. Runtime-backend catalog descriptors now also route through `src/extension-host/runtime-backend-catalog.ts`, and TTS request setup, status, plus compatibility provider-order exports now consume that catalog-backed arbitration policy directly. Remaining TTS work is down to broader consumer adoption and arbitration on top of that catalog surface. | +| Onboarding/install/setup surfaces | `src/plugins/install.ts`, package manifests, channel catalog, onboarding commands | host-owned static descriptors | `partial` | Static metadata normalization has started; full setup/install descriptor migration is not done. | +| Pilot migrations | `extensions/thread-ownership`, `extensions/telegram`, `extensions/acpx` | extension-host path with parity tracking | `not started` | No pilot runs through the host path yet. | ## Completed Pattern So Far