[m-mdy-m]

Summary

Implement the Runtime-owned semantic contribution path for extension panels and prompts. Extensions use owner-scoped contributions instead of publishing arbitrary UI snapshots directly to Backend.

Changes

• Add bounded Runtime-side validation for accepted UI presentation v1 shapes:
  • semantic RGBA/emphasis style attributes and stable role IDs;
  • panel and prompt identity, limits and lifecycle fields;
  • label, text, list, tree, button and input widgets;
  • typed action maps, UTF-8 byte limits, nesting/count limits, duplicate IDs and reserved input value handling;
  • unknown widget/panel kinds remain data-only for compatible Frontend static fallback.
• Add owner-aware core.ui:register_panel, update_panel, remove_panel, set_prompt and clear_prompt methods backed by Runtime UIModel.
• Remove each extension's panels/prompts after failed initialization, explicit unload and Runtime shutdown. Cross-owner replacement/removal is rejected.
• Publish a Runtime-owned UI snapshot after extension load/unload.
• Security boundary: core.ui.publish is not exposed to extensions by default. A trusted host may explicitly opt in with allow_legacy_extension_ui_publish = true for migration only; that path is outside the stable Extension Contract and must not be enabled for untrusted extensions.
• Validate theme style attributes against the same typed RGBA/emphasis schema.

Spec traceability

• Runtime UI Model v1: semantic panels, prompts, styles and atomic snapshot source.
• ADR-0026 / UI presentation contract v1: bounded portable presentation schemas, action routing and static fallback.
• Extension model EXT-030/031/032: declarative widgets, optional canvas boundary and extension ownership.
• ADR-0011: Runtime owns semantic contribution state; Frontend owns rendering.

Verification

Exact latest head 1b42779cfc3c78035fa182a7ca928d2d7e85809d:

• Runtime CI 43459807211: passed Windows Lua 5.4, macOS Lua 5.4, Linux Lua 5.5, Pipeline quality and documentation/workflow validation.
• Package workflow 43459793982: running; requires source/module tests, build, extracted-package checks and checksum verification to pass before this PR is considered fully verified.

Capability boundary

This PR implements the Runtime-side semantic source and validator. It does not advertise ui-presentation/1, render widgets, or claim Backend/Frontend conformance is complete. Interactive widget use remains unavailable until the corresponding Backend and Frontend implementations pass shared vectors and the capability is explicitly accepted in HELLO_ACK. The optional canvas capability remains separate.

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-13T15:54:35.639542Z We couldn’t complete this review. Comment @codex review to try again.	19fb8ec	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.