v0.6.5: Renderer pipeline, docs rewrite, architecture diagrams

Lift block rendering to kernel SDK primitives (sw.renderers + sw.markdown)
so all surfaces share one markdown pipeline. Rewrite docs for external
audience — remove all fork history references. Add Mermaid architecture
diagrams, CONTRIBUTING guide, and extension tutorial.

- sw.renderers SDK module: kernel-level renderer registry
- sw.markdown SDK module: unified marked v16 + DOMPurify pipeline
- Browser extension script loader for renderer injection
- Notes + Docs surfaces migrated to sw.markdown.renderSync()
- 4 renderer extensions rewritten to IIFE + sw.renderers.register()
- 6 Mermaid diagrams in ARCHITECTURE.md
- CONTRIBUTING.md + TUTORIAL-FIRST-EXTENSION.md
- DESIGN-WORKFLOWS.md replaces fork-era design doc
- Surface alias routes removed from main.go
- ICD/SDK runners migrated to /admin/packages/ endpoints
- 13 new renderer tests
- Docs, CHANGELOG, ROADMAP cleaned of fork references

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/handlers/packages.go

@@ -55,7 +55,6 @@ func (h *PackageHandler) SetRunner(r *sandbox.Runner) {
 
 // ListPackages returns all registered packages.
 // GET /api/v1/admin/packages
-// GET /api/v1/admin/surfaces (alias)
 func (h *PackageHandler) ListPackages(c *gin.Context) {
 	typeFilter := c.Query("type")
 
@@ -78,7 +77,6 @@ func (h *PackageHandler) ListPackages(c *gin.Context) {
 
 // GetPackage returns a single package by ID.
 // GET /api/v1/admin/packages/:id
-// GET /api/v1/admin/surfaces/:id (alias)
 func (h *PackageHandler) GetPackage(c *gin.Context) {
 	id := c.Param("id")
 	pkg, err := h.stores.Packages.Get(c.Request.Context(), id)
@@ -91,7 +89,6 @@ func (h *PackageHandler) GetPackage(c *gin.Context) {
 
 // EnablePackage enables a package.
 // PUT /api/v1/admin/packages/:id/enable
-// PUT /api/v1/admin/surfaces/:id/enable (alias)
 func (h *PackageHandler) EnablePackage(c *gin.Context) {
 	id := c.Param("id")
 
@@ -116,7 +113,6 @@ func (h *PackageHandler) EnablePackage(c *gin.Context) {
 
 // DisablePackage disables a package. Admin cannot be disabled.
 // PUT /api/v1/admin/packages/:id/disable
-// PUT /api/v1/admin/surfaces/:id/disable (alias)
 func (h *PackageHandler) DisablePackage(c *gin.Context) {
 	id := c.Param("id")
 
@@ -134,7 +130,6 @@ func (h *PackageHandler) DisablePackage(c *gin.Context) {
 
 // DeletePackage uninstalls a package. Core packages cannot be deleted.
 // DELETE /api/v1/admin/packages/:id
-// DELETE /api/v1/admin/surfaces/:id (alias)
 func (h *PackageHandler) DeletePackage(c *gin.Context) {
 	id := c.Param("id")
 
@@ -182,7 +177,6 @@ func (h *PackageHandler) DeletePackage(c *gin.Context) {
 
 // InstallPackage uploads and installs a .pkg/.surface archive.
 // POST /api/v1/admin/packages/install
-// POST /api/v1/admin/surfaces/install (alias)
 //
 // Also supports pre-downloaded files via gin context:
 //   c.Set("_registry_file", "/path/to/file.pkg")   — skip form upload

server/main.go

@@ -830,14 +830,6 @@ func main() {
 			admin.DELETE("/backups/:name", backupH.DeleteBackup)
 			admin.POST("/restore", backupH.RestoreBackup)
 
-			// Surface aliases (backward compat — same handlers)
-			admin.GET("/surfaces", pkgAdm.ListPackages)
-			admin.GET("/surfaces/:id", pkgAdm.GetPackage)
-			admin.POST("/surfaces/install", pkgAdm.InstallPackage)
-			admin.PUT("/surfaces/:id/enable", pkgAdm.EnablePackage)
-			admin.PUT("/surfaces/:id/disable", pkgAdm.DisablePackage)
-			admin.DELETE("/surfaces/:id", pkgAdm.DeletePackage)
-
 		}
 	}
 

server/pages/pages.go

@@ -104,6 +104,8 @@ type PageData struct {
 
 	ExtensionSurfaces []ExtensionNavItem `json:"-"`
 
+	BrowserExtensions []string `json:"-"` // IDs of enabled browser-tier extensions (for script injection)
+
 	InstanceName     string // branding: instance display name
 	LogoURL          string // branding: custom logo URL
 	Tagline          string // branding: tagline under instance name
@@ -178,6 +180,29 @@ func (e *Engine) extensionNavItems() []ExtensionNavItem {
 	return items
 }
 
+// browserExtensionIDs returns IDs of enabled browser-tier extensions.
+// These extensions have JS scripts that should be injected into every page
+// so they can register renderers with the SDK.
+func (e *Engine) browserExtensionIDs() []string {
+	if e.stores.Packages == nil {
+		return nil
+	}
+	ctx := context.Background()
+	pkgs, err := e.stores.Packages.List(ctx)
+	if err != nil {
+		log.Printf("[pages] Failed to load browser extensions: %v", err)
+		return nil
+	}
+
+	var ids []string
+	for _, pkg := range pkgs {
+		if pkg.Enabled && pkg.Type == "extension" && pkg.Tier == "browser" {
+			ids = append(ids, pkg.ID)
+		}
+	}
+	return ids
+}
+
 // UserContext is the authenticated user's info available to templates.
 type UserContext struct {
 	ID          string `json:"id"`
@@ -370,6 +395,7 @@ func (e *Engine) RenderSurface(surfaceID string) gin.HandlerFunc {
 			Manifest:          e.GetSurface(surfaceID),
 			EnabledSurfaces:   e.EnabledSurfaceIDs(),
 			ExtensionSurfaces: e.extensionNavItems(),
+			BrowserExtensions: e.browserExtensionIDs(),
 		})
 	}
 }
@@ -431,6 +457,7 @@ func (e *Engine) RenderExtensionSurface() gin.HandlerFunc {
 			Manifest:          manifest,
 			EnabledSurfaces:   e.EnabledSurfaceIDs(),
 			ExtensionSurfaces: e.extensionNavItems(),
+			BrowserExtensions: e.browserExtensionIDs(),
 		})
 	}
 }

server/pages/templates/base.html

@@ -21,7 +21,7 @@
     <link rel="stylesheet" href="{{.BasePath}}/css/extension-surface.css?v={{.Version}}">
     <link rel="stylesheet" href="{{.BasePath}}/css/sw-shell.css?v={{.Version}}">
     <link rel="stylesheet" href="{{.BasePath}}/css/sw-debug.css?v={{.Version}}">
-    {{/* gutted: css-chat, css-notes, css-projects templates removed */}}
+    {{/* css-chat, css-notes, css-projects templates removed — surfaces provide their own styles */}}
     {{/* v0.27.0: Extension surface CSS — loaded from /surfaces/{id}/css/main.css */}}
     {{if and .Manifest (eq .Manifest.Source "extension")}}
     <link rel="stylesheet" href="{{.BasePath}}/surfaces/{{.Surface}}/css/main.css?v={{.Version}}">
@@ -117,9 +117,8 @@
         {{if .Manifest}}window.__MANIFEST__ = {{.Manifest | toJSON}};{{end}}
     </script>
 
-    {{/* v0.37.14 Scorched Earth IV: sb.js, events.js, switchboard-sdk.js,
-         workflow-surfaces.js removed. All surfaces use Preact SDK boot().
-         Survivors: debug.js, repl.js (standalone, no old-layer deps). */}}
+    {{/* All surfaces use Preact SDK boot(). Legacy script includes removed.
+         Standalone utils: debug.js, repl.js (no SDK dependencies). */}}
 
     {{if eq .Surface "admin"}}{{template "scripts-admin" .}}{{end}}
     {{if eq .Surface "team-admin"}}{{template "scripts-team-admin" .}}{{end}}
@@ -142,6 +141,12 @@
     </script>
     {{end}}
 
+    {{/* v0.6.5: Browser-tier extension scripts (renderers, etc.)
+         Loaded after surface scripts so sw:ready fires first. */}}
+    {{range .BrowserExtensions}}
+    <script nonce="{{$.CSPNonce}}" src="{{$.BasePath}}/surfaces/{{.}}/js/script.js?v={{$.Version}}"></script>
+    {{end}}
+
     {{/* v0.37.13: Legacy UserMenu hydration removed — all surfaces use Preact UserMenu. */}}
 
     {{/* ── Debug Modal (Preact, v0.37.18) ───── */}}