Temporary normative staging unit. Its body is the accepted architecture from refined plan revision 4, section 3.21. Before production code cites this law, promote the relevant clauses into permanent specifications. This file is consumed only after semantic coverage, implemented behavior and retained evidence are accepted. The task/retirement checker cannot perform semantic acceptance.

Existing domain libraries remain authoritative. Extract CLI-local analysis/orchestration into typed application services where necessary; reuse source resolver, compiler/trace, solver, artifact/deploy journals and extension registry. CLI, MCP and an on-demand machine session all call those services. No second resolver/compiler/refactoring engine and no universal writable graph database.

The external path is explicit:

Requirement: trusted context binding + protocol/capability negotiation → discover operations/models and applicability → capture disk/overlay/world/target snapshots → query/navigate/explain/diagnose/compare → prepare concrete action with exact effects/preconditions → resolve typed input/authorization requirements → submit once with idempotency key → observe/control/reattach to the operation → inspect terminal/partial result, evidence and recovery → invalidate affected views and capture the new state

Pure library calls and structured one-shot CLI remain useful without a server. An optional on-demand API host supplies responsive multiplexed requests/events over a versioned local framed transport; initial implementation can use stdio JSON-RPC with a published framing/handshake contract. Standard transport envelope and domain schema epochs are separate. The existing MCP adapter negotiates its actual supported version/capabilities and maps to the same domain requests/results; limited legacy tools remain explicit compatibility adapters. MCP tool inventory is not the complete operation/debug catalog. Do not introduce a permanently resident daemon as a prerequisite for installing/running an environment.

Protocol initialization exchanges supported API/schema versions, model/operation capabilities, position encoding, streaming/replay/control support and trusted context bindings. A workspace manifest or caller-supplied path cannot self-authorize a new root. Context registration comes from the owning local session/server policy, then requests refer to context/target IDs. Multi-root workspaces, a user environment and a remote/container target remain separate bindings; a local Windows path is not automatically valid in the Linux target or on a future remote IDE client.

Strictly validate every input against its owned or admitted extension schema before action; wrong types and unknown fields cannot silently select defaults. Outputs, structured errors and events are validated too. Schema discovery does not execute a native provider or fetch a remote schema. Unknown extension schema version is explicitly unsupported or shown as declared generic structured data; it never enables arbitrary commands.

Suggested public API families are capabilities/models/schema, contexts/snapshots/documents, query/explain/diagnostics, action.prepare/submit, operation.get/events/control, and domain-specific operations below them. These are typed registry dispatch, not shell/eval endpoints. LSP concepts map to document synchronization, navigation, diagnostics and prepared edits; DAP may later adapt actual debugger capabilities. Neither protocol is the whole package/environment/image-management API. No LSP/DAP adapter, IDE plugin or client MVP is scheduled in this programme; their future adapters must consume the same contracts (E51).