v0.6.5: Renderer pipeline, docs rewrite, architecture diagrams

Lift block rendering to kernel SDK primitives (sw.renderers + sw.markdown)
so all surfaces share one markdown pipeline. Rewrite docs for external
audience — remove all fork history references. Add Mermaid architecture
diagrams, CONTRIBUTING guide, and extension tutorial.

- sw.renderers SDK module: kernel-level renderer registry
- sw.markdown SDK module: unified marked v16 + DOMPurify pipeline
- Browser extension script loader for renderer injection
- Notes + Docs surfaces migrated to sw.markdown.renderSync()
- 4 renderer extensions rewritten to IIFE + sw.renderers.register()
- 6 Mermaid diagrams in ARCHITECTURE.md
- CONTRIBUTING.md + TUTORIAL-FIRST-EXTENSION.md
- DESIGN-WORKFLOWS.md replaces fork-era design doc
- Surface alias routes removed from main.go
- ICD/SDK runners migrated to /admin/packages/ endpoints
- 13 new renderer tests
- Docs, CHANGELOG, ROADMAP cleaned of fork references

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

packages/icd-test-runner/js/crud/dashboard-package.js

@@ -65,9 +65,9 @@
       T.assert(d.version === '0.31.1', 'version mismatch');
     });
 
-    await T.test('crud', 'dashboardPackage', 'dashpkg: GET /admin/surfaces (dashboard in list)', async function () {
-      var d = await T.apiGet('/admin/surfaces');
-      T.assertHasKey(d, 'data', '/admin/surfaces');
+    await T.test('crud', 'dashboardPackage', 'dashpkg: GET /admin/packages (dashboard in list)', async function () {
+      var d = await T.apiGet('/admin/packages');
+      T.assertHasKey(d, 'data', '/admin/packages');
       var found = d.data.some(function (s) { return s.id === 'dashboard'; });
       T.assert(found, 'dashboard package should appear in surfaces list');
     });

packages/icd-test-runner/js/crud/editor-package.js

@@ -68,9 +68,9 @@
       T.assert(d.version === '0.31.0', 'version mismatch');
     });
 
-    await T.test('crud', 'editorPackage', 'edpkg: GET /admin/surfaces (editor in list)', async function () {
-      var d = await T.apiGet('/admin/surfaces');
-      T.assertHasKey(d, 'data', '/admin/surfaces');
+    await T.test('crud', 'editorPackage', 'edpkg: GET /admin/packages (editor in list)', async function () {
+      var d = await T.apiGet('/admin/packages');
+      T.assertHasKey(d, 'data', '/admin/packages');
       var found = d.data.some(function (s) { return s.id === 'editor'; });
       T.assert(found, 'editor package should appear in surfaces list');
     });
@@ -78,7 +78,7 @@
     await T.test('crud', 'editorPackage', 'edpkg: core /editor removed (404)', async function () {
       // The old /editor route should no longer exist — it was removed in CS1.
       // We test by checking the surfaces list for a core editor entry.
-      var d = await T.apiGet('/admin/surfaces');
+      var d = await T.apiGet('/admin/packages');
       var surfaces = d.data || [];
       var coreEditor = surfaces.find(function (s) { return s.id === 'editor' && s.source === 'core'; });
       T.assert(!coreEditor, 'no core editor surface should exist — editor is now a package');
@@ -139,7 +139,7 @@
 
     await T.test('crud', 'editorPackage', 'edpkg: editor in extension nav items', async function () {
       // When installed, editor should appear in the surfaces list as an extension surface
-      var d = await T.apiGet('/admin/surfaces');
+      var d = await T.apiGet('/admin/packages');
       var surfaces = d.data || [];
       var editorSurface = surfaces.find(function (s) { return s.id === 'editor'; });
       T.assert(editorSurface, 'editor should be in surfaces list');

packages/icd-test-runner/js/crud/surfaces.js

@@ -20,7 +20,7 @@
 
     var surfaceId = null;
 
-    await T.test('crud', 'surfaces', 'POST /admin/surfaces/install (happy path)', async function () {
+    await T.test('crud', 'surfaces', 'POST /admin/packages/install (happy path)', async function () {
       surfaceId = 'icd-test-' + Date.now();
       var manifest = JSON.stringify({
         id: surfaceId,
@@ -28,32 +28,32 @@
         route: '/s/' + surfaceId
       });
       var zipBlob = buildTestZip({ 'manifest.json': manifest });
-      await T.apiUpload('/admin/surfaces/install', zipBlob, surfaceId + '.surface');
+      await T.apiUpload('/admin/packages/install', zipBlob, surfaceId + '.surface');
 
       // Verify it exists
-      var d = await T.apiGet('/admin/surfaces/' + surfaceId);
+      var d = await T.apiGet('/admin/packages/' + surfaceId);
       T.assert(d.id === surfaceId, 'installed surface id mismatch');
       T.assert(d.title === 'ICD Test Surface', 'title mismatch');
       T.registerCleanup(async function () {
         if (surfaceId) {
           var token = await T.getAuthToken();
-          return T.authFetch(token, 'DELETE', '/admin/surfaces/' + surfaceId);
+          return T.authFetch(token, 'DELETE', '/admin/packages/' + surfaceId);
         }
       });
     });
 
     if (surfaceId) {
-      await T.test('crud', 'surfaces', 'GET /admin/surfaces/:id (read)', async function () {
-        var d = await T.apiGet('/admin/surfaces/' + surfaceId);
+      await T.test('crud', 'surfaces', 'GET /admin/packages/:id (read)', async function () {
+        var d = await T.apiGet('/admin/packages/' + surfaceId);
         T.assertShape(d, T.S.surfaceAdmin, 'surface detail');
         T.assert(d.id === surfaceId, 'id mismatch');
         T.assert(d.source === 'extension', 'source should be extension');
         T.assert(d.enabled === true, 'newly installed surface should be enabled');
       });
 
-      await T.test('crud', 'surfaces', 'GET /admin/surfaces (list includes new)', async function () {
-        var d = await T.apiGet('/admin/surfaces');
-        T.assertHasKey(d, 'data', '/admin/surfaces');
+      await T.test('crud', 'surfaces', 'GET /admin/packages (list includes new)', async function () {
+        var d = await T.apiGet('/admin/packages');
+        T.assertHasKey(d, 'data', '/admin/packages');
         var found = d.data.some(function (s) { return s.id === surfaceId; });
         T.assert(found, 'installed surface should appear in admin list');
       });
@@ -70,9 +70,9 @@
         T.assert(entry.enabled === undefined, 'nav entry should NOT have enabled');
       });
 
-      await T.test('crud', 'surfaces', 'PUT /admin/surfaces/:id/disable', async function () {
+      await T.test('crud', 'surfaces', 'PUT /admin/packages/:id/disable', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'PUT',
-          '/admin/surfaces/' + surfaceId + '/disable');
+          '/admin/packages/' + surfaceId + '/disable');
         T.assertStatus(d, 200, 'disable');
         T.assert(d.enabled === false, 'should report disabled');
       });
@@ -83,16 +83,16 @@
         T.assert(!found, 'disabled surface should NOT appear in user nav list');
       });
 
-      await T.test('crud', 'surfaces', 'GET /admin/surfaces (disabled still in admin)', async function () {
-        var d = await T.apiGet('/admin/surfaces');
+      await T.test('crud', 'surfaces', 'GET /admin/packages (disabled still in admin)', async function () {
+        var d = await T.apiGet('/admin/packages');
         var entry = d.data.find(function (s) { return s.id === surfaceId; });
         T.assert(entry, 'disabled surface should still appear in admin list');
         T.assert(entry.enabled === false, 'should show as disabled in admin list');
       });
 
-      await T.test('crud', 'surfaces', 'PUT /admin/surfaces/:id/enable', async function () {
+      await T.test('crud', 'surfaces', 'PUT /admin/packages/:id/enable', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'PUT',
-          '/admin/surfaces/' + surfaceId + '/enable');
+          '/admin/packages/' + surfaceId + '/enable');
         T.assertStatus(d, 200, 'enable');
         T.assert(d.enabled === true, 'should report enabled');
       });
@@ -103,53 +103,53 @@
         T.assert(found, 're-enabled surface should appear in user nav list');
       });
 
-      await T.test('crud', 'surfaces', 'PUT /admin/surfaces/chat/disable (reject → 400)', async function () {
+      await T.test('crud', 'surfaces', 'PUT /admin/packages/chat/disable (reject → 400)', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'PUT',
-          '/admin/surfaces/chat/disable');
+          '/admin/packages/chat/disable');
         T.assert(d._status === 400, 'disabling chat should return 400, got ' + d._status);
       });
 
-      await T.test('crud', 'surfaces', 'PUT /admin/surfaces/admin/disable (reject → 400)', async function () {
+      await T.test('crud', 'surfaces', 'PUT /admin/packages/admin/disable (reject → 400)', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'PUT',
-          '/admin/surfaces/admin/disable');
+          '/admin/packages/admin/disable');
         T.assert(d._status === 400, 'disabling admin should return 400, got ' + d._status);
       });
 
-      await T.test('crud', 'surfaces', 'DELETE /admin/surfaces/chat (core reject → 400)', async function () {
+      await T.test('crud', 'surfaces', 'DELETE /admin/packages/chat (core reject → 400)', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'DELETE',
-          '/admin/surfaces/chat');
+          '/admin/packages/chat');
         T.assert(d._status === 400, 'deleting core surface should return 400, got ' + d._status);
       });
 
-      await T.test('crud', 'surfaces', 'GET /admin/surfaces/:id (not found → 404)', async function () {
+      await T.test('crud', 'surfaces', 'GET /admin/packages/:id (not found → 404)', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'GET',
-          '/admin/surfaces/nonexistent-surface-id');
+          '/admin/packages/nonexistent-surface-id');
         T.assert(d._status === 404, 'nonexistent should return 404, got ' + d._status);
       });
 
-      await T.test('crud', 'surfaces', 'PUT /admin/surfaces/nonexistent/disable (404)', async function () {
+      await T.test('crud', 'surfaces', 'PUT /admin/packages/nonexistent/disable (404)', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'PUT',
-          '/admin/surfaces/nonexistent-surface-id/disable');
+          '/admin/packages/nonexistent-surface-id/disable');
         T.assert(d._status === 404, 'disable nonexistent should return 404, got ' + d._status);
       });
 
-      await T.test('crud', 'surfaces', 'POST /admin/surfaces/install (missing manifest → 400)', async function () {
+      await T.test('crud', 'surfaces', 'POST /admin/packages/install (missing manifest → 400)', async function () {
         var zipBlob = buildTestZip({ 'readme.txt': 'no manifest here' });
         var d;
         try {
-          d = await T.apiUpload('/admin/surfaces/install', zipBlob, 'bad.surface');
+          d = await T.apiUpload('/admin/packages/install', zipBlob, 'bad.surface');
           T.assert(false, 'should have thrown');
         } catch (e) {
           T.assert(e.message.indexOf('400') !== -1, 'missing manifest should 400: ' + e.message);
         }
       });
 
-      await T.test('crud', 'surfaces', 'POST /admin/surfaces/install (core conflict → 409)', async function () {
+      await T.test('crud', 'surfaces', 'POST /admin/packages/install (core conflict → 409)', async function () {
         var manifest = JSON.stringify({ id: 'chat', title: 'Evil Chat', route: '/s/chat' });
         var zipBlob = buildTestZip({ 'manifest.json': manifest });
         var d;
         try {
-          d = await T.apiUpload('/admin/surfaces/install', zipBlob, 'chat.surface');
+          d = await T.apiUpload('/admin/packages/install', zipBlob, 'chat.surface');
           // If no throw, check status manually
           T.assert(false, 'overwriting core surface should have thrown');
         } catch (e) {
@@ -157,10 +157,10 @@
         }
       });
 
-      await T.test('crud', 'surfaces', 'POST /admin/surfaces/install (reseed preserves enabled)', async function () {
+      await T.test('crud', 'surfaces', 'POST /admin/packages/install (reseed preserves enabled)', async function () {
         // Surface was re-enabled above. Disable it, then re-install.
         await T.authFetch(await T.getAuthToken(), 'PUT',
-          '/admin/surfaces/' + surfaceId + '/disable');
+          '/admin/packages/' + surfaceId + '/disable');
 
         // Re-install same ID
         var manifest = JSON.stringify({
@@ -169,33 +169,33 @@
           route: '/s/' + surfaceId
         });
         var zipBlob = buildTestZip({ 'manifest.json': manifest });
-        await T.apiUpload('/admin/surfaces/install', zipBlob, surfaceId + '.surface');
+        await T.apiUpload('/admin/packages/install', zipBlob, surfaceId + '.surface');
 
         // Verify title updated but enabled preserved as false
-        var d = await T.apiGet('/admin/surfaces/' + surfaceId);
+        var d = await T.apiGet('/admin/packages/' + surfaceId);
         T.assert(d.title === 'ICD Test Surface v2', 'title should be updated after reseed');
         T.assert(d.enabled === false, 'enabled should be preserved as false after reseed');
 
         // Re-enable for cleanup
         await T.authFetch(await T.getAuthToken(), 'PUT',
-          '/admin/surfaces/' + surfaceId + '/enable');
+          '/admin/packages/' + surfaceId + '/enable');
       });
 
-      await T.test('crud', 'surfaces', 'DELETE /admin/surfaces/:id', async function () {
+      await T.test('crud', 'surfaces', 'DELETE /admin/packages/:id', async function () {
         var token = await T.getAuthToken();
-        var d = await T.authFetch(token, 'DELETE', '/admin/surfaces/' + surfaceId);
+        var d = await T.authFetch(token, 'DELETE', '/admin/packages/' + surfaceId);
         T.assertStatus(d, 200, 'delete');
         T.assert(d.deleted === true, 'should report deleted');
 
         // Verify gone
-        var check = await T.authFetch(token, 'GET', '/admin/surfaces/' + surfaceId);
+        var check = await T.authFetch(token, 'GET', '/admin/packages/' + surfaceId);
         T.assert(check._status === 404, 'deleted surface should 404 on get');
         surfaceId = null;
       });
 
-      await T.test('crud', 'surfaces', 'DELETE /admin/surfaces/nonexistent (404)', async function () {
+      await T.test('crud', 'surfaces', 'DELETE /admin/packages/nonexistent (404)', async function () {
         var d = await T.authFetch(await T.getAuthToken(), 'DELETE',
-          '/admin/surfaces/nonexistent-surface-id');
+          '/admin/packages/nonexistent-surface-id');
         T.assert(d._status === 404, 'delete nonexistent should return 404, got ' + d._status);
       });
     }

packages/icd-test-runner/js/framework.js

@@ -227,7 +227,7 @@
   };
 
   // ─── API Wrappers ───────────────────────────────────────────
-  // v0.37.14: raw fetch — old API._* globals removed in scorched earth.
+  // Raw fetch — kernel provides no global API wrappers; extensions use fetch directly.
 
   async function _fetchJSON(method, path, body) {
     var token = await T.getAuthToken();

packages/icd-test-runner/js/tier-authz.js

@@ -28,7 +28,7 @@
     var adminGets = [
       '/admin/stats', '/admin/users', '/admin/settings',
       '/admin/configs', '/admin/models', '/admin/personas',
-      '/admin/teams', '/admin/groups', '/admin/surfaces',
+      '/admin/teams', '/admin/groups', '/admin/packages',
       '/admin/providers/health', '/admin/routing/policies',
       '/admin/permissions', '/admin/roles', '/admin/vault/status',
       '/admin/storage/status', '/admin/audit', '/admin/pricing',
@@ -72,8 +72,8 @@
         'expected 403/401, got ' + d._status);
     });
 
-    await T.test('authz', 'admin-deny', 'user → POST /admin/surfaces/install (expect 403)', async function () {
-      var d = await T.authFetch(testUser.token, 'POST', '/admin/surfaces/install', {});
+    await T.test('authz', 'admin-deny', 'user → POST /admin/packages/install (expect 403)', async function () {
+      var d = await T.authFetch(testUser.token, 'POST', '/admin/packages/install', {});
       T.assert(d._status === 403 || d._status === 401 || d._status === 400,
         'expected 403/401/400, got ' + d._status);
     });

packages/icd-test-runner/js/tier-security.js

@@ -543,7 +543,7 @@
     await T.test('security', 'input-validation', '[P0] path traversal in surface archive', async function () {
       var blob = new Blob([JSON.stringify({ id: '../../../etc/evil', title: 'Path Traversal Test' })], { type: 'application/json' });
       try {
-        var d = await T.apiUpload('/admin/surfaces/install', blob, 'evil.surface');
+        var d = await T.apiUpload('/admin/packages/install', blob, 'evil.surface');
         T.assert(d._status === 400 || d._status === 409,
           'path traversal surface accepted! got ' + d._status);
       } catch (e) {
@@ -644,8 +644,8 @@
         assertDenied(d._status, 'CRITICAL: team admin can delete users');
       });
 
-      await T.test('security', 'escalation', '[P0] teamAdmin → POST /admin/surfaces/install', async function () {
-        var d = await T.authFetch(teamAdmin.token, 'POST', '/admin/surfaces/install', {});
+      await T.test('security', 'escalation', '[P0] teamAdmin → POST /admin/packages/install', async function () {
+        var d = await T.authFetch(teamAdmin.token, 'POST', '/admin/packages/install', {});
         if (d._status === 400) return; // bad upload format, not a security issue
         assertDenied(d._status, 'team admin can install surfaces');
       });

packages/icd-test-runner/js/tier-smoke.js

@@ -326,9 +326,9 @@
         T.assertHasKey(d, 'data', '/admin/groups');
       });
 
-      await T.test('smoke', 'admin', 'GET /admin/surfaces', async function () {
-        var d = await T.apiGet('/admin/surfaces');
-        T.assertHasKey(d, 'data', '/admin/surfaces');
+      await T.test('smoke', 'admin', 'GET /admin/packages', async function () {
+        var d = await T.apiGet('/admin/packages');
+        T.assertHasKey(d, 'data', '/admin/packages');
         T.assert(Array.isArray(d.data), 'surfaces should be array');
         if (d.data.length > 0) {
           T.assertShape(d.data[0], T.S.surfaceAdmin, 'surfaces[0]');