Release 0.80.0 — a capability the deployment does not have

[JimmyWesley]

Release 0.80.0 — a capability the deployment does not have

One spec version, v0.80, and the package moves 0.79.0 → 0.80.0. It comes
from a sentence Part G has carried since v0.9: UIs and bots are MCP/library
clients, not plugins. The line was drawn correctly and it left a whole
class of work with nowhere to stand: transcribing audio, converting a format
nobody here has heard of, reading a proprietary export. Not a client, not a
contract change, a capability this deployment simply lacks. Each arrives
with a dependency, and the dependency is the problem: FFmpeg is GPL or LGPL
depending on the build, a converter drags a machine-learning stack, a
transcriber drags another. LICENSING.md splits this tree Apache-2.0 /
AGPL-3.0-only, and that split holds only while the dependency list stays
clean. Pinning any of them makes this project their distributor.

What changed

Part L, extensions (new). An extension is a package that contributes at
named seams and never patches: converters (read by the Gardener above
extra_converters and below an operator's own command hook), curation,
events (on the one emitter that already decides webhooks), tools (on the
MCP menu), routes (under /v1/ext/<id>/), jobs (pulled, never
scheduled), ranking (inside harvest, before the budget), prompt, and
roles. register(api) is enumerated the way ScopedVine is: a new engine
capability needs its own line before an extension can reach it. A handler
marked heavy runs in the extension's own environment and its own process,
which is what keeps the motivating dependency out of the process that
serves the forest.

This project distributes nothing. Four sources (curated index, git,
archive, local file) resolve through one resolver, and whatever the source,
it becomes an immutable artifact before it is validated: a git ref becomes
a commit SHA, because a tag can be force-pushed and the thing that was
signed must be the thing that runs. A moving ref is allowed and marked
tracking, unverified by construction. Three tiers, verified from the
index, signed from a signed tag checked against the forge's published
keys, unverified for everything else. Resolving requirements.txt
executes third-party build code, so the conformance kit runs before
anything is registered, and never before third-party code runs. The
documentation says so in those words.

The mechanism is the engine's, the governance is the Station's. An
operator with no Station installs extensions from the CLI: vine ext install|update|list|remove|config|enable|disable. Global install is a
host-level directory (MONKEYLLM_EXT_HOME); per-forest enablement is
_meta/extensions.yaml, so it is versioned, travels in a snapshot, and
validate reports an extension a forest expects and does not have. _meta
declares expectation and never grants it, and a declared secret may not be
written there.

Inert and named, never an error. A contribution the host cannot serve is
listed as inert. The config schema is the source of truth and a panel is
decoration over it, enforced by the kit, so a console-less host stays
first-class. The console surface is declarative, because J.5.13 admits no
third-party script in the console's origin and that rule is not relaxed for
an extension. Studio gains an Extensions console.

Amends J.4.2, J.10, J.5. The audit row gains via (ext:<id>,
nullable, absent on rows written before this version) while principal
stays whoever caused the act: a forensic question is who asked for this,
and an extension is not an answer to it. A model role gains a kind
(chat/embed/vision/transcribe/rerank), and an extension registers
a role rather than carrying a key: it is handed a bound caller, never an
endpoint or a credential, so its spend is configured, metered and audited
where all other spend is. Quota is per extension per forest and exhaustion
is a refusal, never silence.

The first real extension. extensions/whisper registers the
transcribe role and turns a recording into a media node whose body is
the transcript, so sniff finds a word that was only ever spoken. It adds
no package to the engine's environment, which is the point of it.

Three things caught before release, kept in the task file. The loader
executed an extension's module twice (once for register, once per
handler), so module-level state split in half with no error; it now imports
once per installed tree. The extension list was gated on "has a grant"
where it meant "is admin", caught by the route canary in
test_station_admin_scope. And the MCP tools/list filter's fallback
returned the unfiltered list on an SDK shape it did not recognise; a
visibility filter fails closed.

Also in this release

• The demo harness reads the model's own tool syntax. MiniCPM5-2B
  sometimes emits a tool call in its native XML-like function syntax
  instead of the JSON the prompt asks for; parse_action now translates
  it, typed by the engine's signature table, with no navigation help. With
  it, the 2B scores 18/18 (v2), 11/11 (v3), 7/8 (v4) on the bench
  forest with BM25-only entry search, the same scores as the 12B rows.
• Paper 1.1.0. New §5.4 records that replication with its caveats (one
  run per set, wall-clock not comparable, navigator arm only); abstract,
  setup, Forest Principle, limitations and quickstart updated.

Leftovers, named

• F.194 (signed-tag verification against the forge's published keys) is
  implemented and not measured.
• The curated index is not published yet.
• The Extensions console has had no real-browser pass.
• F.169's curator measurement is still pending from 0.75.

Acceptance

F.174 – F.198. Full suite green locally on the release commit (1816 passed,
0 skipped, Python 3.12) and running in CI on this PR; python -m build +
twine check passed (wheel 243 kB, sdist 562 kB; the wheel carries
monkeyllm/extensions/ and cli_ext.py, and nothing of the Station).