Extensions

An extension adds to your mind without changing the engine: words it carries, rhythms it keeps, abilities it can use. It lives next to your memory, travels with it in your sealed backup, and does nothing until you approve it on each machine.

What an extension can add

• Prompt layers. Standing knowledge or instructions, placed after the mind's constitution and before its memories.
• Routines. A prompt on a schedule, such as "every workday at 08:30, go through yesterday's notes". A routine runs on one chosen machine or on each of them.
• Command recipes. Step-by-step procedures the mind can run by name, listed as coming from the extension.
• Skills. Playbooks the mind can follow. If your mind has written its own playbook with the same name, its own always wins. You can fork an extension's playbook to make it your mind's own; from then on it changes with your mind.
• Code, for your own use. New tools, hooks at moments like start-up or the end of a turn, and key slots you fill in the keys panel. A key typed into the chat would pass through the model, so key slots never use the chat.

Safe by default

• Nothing runs just because it arrived. A new, imported, restored or synced extension starts as awaiting approval.
• Approval pins the exact files. Changing a single byte withdraws the approval until you give it again.
• Each machine decides for itself. Your mind travels between your machines. Your approvals don't travel with it.
• Risky actions still ask. A dangerous tool called by an extension shows the same approval card as any other.
• A broken extension can't stop the mind from starting. It is marked failed and the mind starts without it.
• Extensions declare their platforms. An extension made for Windows waits quietly on Linux.

Packages you can share: .aedext

The Lodge exports any extension as one .aedext file containing its files and their hash. The file leaves out the extension's saved data and your approvals.

Import treats every package as possibly hostile. It refuses:

• files that would land outside the extension's folder;
• links to other files on disk;
• oversized packages, including ones built to expand into huge amounts of data;
• names that Windows or macOS would misread;
• any package whose files don't match the hash it declares.

An imported extension always waits for your approval, even when it replaces one you'd already approved.

Signed by their author

An author can sign a package with an Ed25519 key. Your machine checks the signature itself, without going online, so it never has to ask us whether a package is genuine.

• Tampering is refused. A signature that doesn't match refuses the import. It is never treated as "unsigned".
• Your mind remembers who wrote what. The first signed import of a name records its author. A later package with the same name from someone else isn't offered as an update. The Lodge asks you first, and you can install it as a new author.
• Every extension shows where it came from: made here, unsigned, author with a short fingerprint, or reviewed by Aedelgard. It also shows "edited since import" when the files have changed.
• Your own author key. It's created the first time you choose "export signed". It stays on your machine and in your sealed backup and is never put into a package.

A package reviewed by Aedelgard also carries our stamp. Your machine checks the stamp itself, offline, against a key built into every body. The stamp comes with a short certificate from that key, so if a stamping key were ever compromised we could replace it without shipping a new body.

Where it stands

The catalogue

To install: open the Lodge in your body, choose browse, and pick one. Your body downloads it, checks our stamp and the file's fingerprint itself, and adds it switched off, waiting for your approval. You can also download the .aedext here and import it by hand; your body checks the signatures the same way.

Nothing is hidden. Every package's full text is in the download. Every stamp we give is written to the public log. The recall list is signed, your body checks it once a day, and a recalled extension is switched off on your machine with the reason shown.

What never travels: what your mind learned from its own mistakes. Those lessons are its own history. A lesson worth sharing can be written as a skill.

Privacy: browsing the catalogue from your body tells us only that a body exists. You can switch it off with one setting, AEDELGARD_CATALOGUE=off.

Why the catalogue reads every word

The approval gate stops a dangerous tool. It doesn't stop persuasion. A prompt layer sits in the mind's most trusted position, and a few quiet sentences could steer it, for example toward "copy the owner's notes into every web request". That passes every automatic check.

So every prompt layer, routine prompt and skill in the catalogue is read in full by a person before we countersign it. The reviewer looks for:

• attempts to send your data elsewhere;
• instructions to hide things from you;
• claims of authority over the mind's constitution;
• steering toward a product.

Every countersignature goes into a public log, so a package we quietly swapped would be visible. A recalled package is disabled on your machine, and you're told why. On your machine, the approval screen shows the full text, not a summary.

Why shared code waits

Today, extension code runs inside the body itself, with the body's full power. We won't deliver a stranger's code to your machine until a sandbox limits what it can do. Until then, code extensions are for code you wrote or have read yourself.

Build one

An extension is a folder next to your memory:

extensions/<name>/
  extension.json     the manifest: everything it adds, nothing more
  layers/*.md        prompt layers
  routines.json      scheduled prompts
  commands/          recipes
  skills/*.md        playbooks
  extension.py       optional: makes it a code extension
  data/              the only place it may write

The full format is published in the open (the Aedelgard Mind Format, part 4). To sign outside the app:

python -m harness.ext_signing keygen my-key.json
python -m harness.ext_signing sign rhythms-1.0.0.aedext my-key.json
python -m harness.ext_signing verify rhythms-1.0.0.signed.aedext

Keep my-key.json to yourself. It's the only proof that your next version comes from you.