The COMPILED-IN extension registry: entries are module-attribute data, so registry content is a code release — drift is unrepresentable and a beam-census architecture gate asserts nothing reads a registry file at runtime.

Entry fields: namespace, owner, criticality (:critical | :optional), state (:reserved | :active | :deprecated | :retired, advancing monotonically), schema_digest (Digest.to_tagged string or nil when the owner has not authored a schema — nil denies critical bodies at negotiation with :extension_schema_unavailable), a2a_uri (an externally versioned declaration URI, never dereferenced by this package), and promoted_at_revision (the promotion-governance field: optional → critical moves only with a protocol revision increment, which the registry author records here; demotion needs no bump).

Schema authoring contract: an owner digests Digest.hash(:extension_schema, JCS(parsed_document)) — JCS of the PARSED document, never raw file bytes — and the schema must lie inside Schema's bounded 2020-12 dialect (the digest pins that too). This package owns com.example/federation's schema and ships it authored (federation_schema/0); the product-owned entries carry nil until their owners author one. Registry entries are published facts about namespaces; the registry carries no authority. Registry entries are published facts about namespaces; the registry carries no authority.