Vyasa Extension Refactor Audit and Execution Plan

High-Level DiagnosisURL copied

The work took shortcuts in four categories:

  1. Runtime shortcut: extensions are plain modules with META and configure(). They do not implement VyasaExtension.
  1. Registration shortcut: configure(runtime) mutates lists and dicts on ExtensionRuntime directly. That bypasses the restricted app contract and cannot validate that a registration is declared in metadata.
  1. Ownership shortcut: feature renderers still live in vyasa/extensions_builtin/markdown/renderer.py. Mermaid, D2, Cytograph, and Tasks extensions import private functions from Markdown instead of owning their renderers.
  1. Asset shortcut: almost all JavaScript and CSS still lives in vyasa/static/scripts.js and vyasa/static/header.css. Extension folders may have copied assets, but pages still load the global bundle.