test(cli): extension-point journeys + node-key manifest fix + docs (§5.5 C5)

- Move the manifest `extension_points` from a top-level key to an `[app]`/
  `[group]` node key (`ManifestApp`/`ManifestGroup` + a `Manifest::extension_points()`
  accessor). A bare top-level array placed after the node header was silently
  re-nested by TOML into that table and dropped; as a node key it parses
  unambiguously wherever it sits. build_bundle/pull/init updated.
- Journeys (live server + Postgres): a group default body resolves for an
  inheriting app; the app provides its own module and OVERRIDES the EP (the
  inverse of the Phase 4b sealed import); `extension-points ls` shows the
  provider; a body-less EP with no provider fails `pic plan`.
- Re-bless the schema snapshot (new `extension_points` table).
- Docs: §5.5 marked complete (extension points ✅) + CLAUDE.md current-focus.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -10,7 +10,7 @@ Authoritative design: [serverless_cloud_blueprint.md](serverless_cloud_blueprint
 
 **v1.1.x — SDK foundation + services — is complete.** The SDK shape (handle pattern, `::` namespaces, `Services`/`SdkCallCx`; see [docs/sdk-shape.md](docs/sdk-shape.md), stdlib at [docs/stdlib-reference.md](docs/stdlib-reference.md)) fixed in v1.1.0, then KV, docs, modules, HTTP, cron, files, pub/sub, email, users, and durable queues + `invoke()` filled it in through **v1.1.9** — blueprint §12 has the table. Earlier groundwork: blueprint Phase 3 (admin auth, multi-app scoping, Phase 3.5 capability gating — `manager-core::authz::{can, require, Capability}`, migration `0006_users_authz.sql`).
 
-**Current focus: v1.2 _Hierarchies_ — groups + the declarative project tool** ([docs/design/groups-and-project-tool.md](docs/design/groups-and-project-tool.md)). That doc's §11 uses its own **Phase 1–6 numbering, distinct from the blueprint product-phase numbering above — do not conflate them** (its "Phase 3" = group-inherited config, not admin auth). Implemented on `feat/groups-*` branches: §11 Phase 1 (declarative `pic plan`/`apply`/`prune` + env overlays), Phase 2 (single-parent groups tree + hierarchy-aware RBAC), Phase 3 (group-inherited, env-scoped `vars` + secrets resolved **live** via a recursive CTE — no materialized cache), Phase 4-lite (group-owned **endpoint** scripts: `scripts` polymorphic owner in `0050_group_scripts.sql`, `get_by_name_inherited`/`is_invocable_by_app` chain resolution, inherited `invoke()` + declarative route/trigger binding — all **live**, no body materialization), Phase 5 (the **declarative project tool maps onto the group tree**: the reconcile engine generalized to `ApplyOwner{App|Group}`, a `[group]` manifest kind, and a single atomic **tree apply** — `pic plan/apply --dir` reconciles a whole directory tree of `picloud.toml` nodes in one Postgres transaction, groups-before-apps so an app route can bind a group script created in the same tx; the bound token folds in each group's `structure_version`. Multi-repo single-owner/attach-point and per-env approval gating are deferred; groups pre-exist), Phase 4b (group **modules** + the **lexical (sealed-by-default) import resolver**, §5.5: owner-polymorphic `ModuleScript`, origin-rooted `ModuleSource::resolve` walking the importing node's chain, `ExecRequest.script_owner` threaded from every dispatch + `invoke()` site, `_source`-driven lexical chaining in `PicloudModuleResolver` with the compiled-module cache re-keyed by `ScriptId`, group modules/imports allowed, single-node dangling-import `plan` check — an inherited group script's imports **seal to the group**, a leaf can't shadow them). Next: §5.5 **opt-in extension points** (the one deferred §5.5 piece) or §11.6 (group-level collections, v1.3).
+**Current focus: v1.2 _Hierarchies_ — groups + the declarative project tool** ([docs/design/groups-and-project-tool.md](docs/design/groups-and-project-tool.md)). That doc's §11 uses its own **Phase 1–6 numbering, distinct from the blueprint product-phase numbering above — do not conflate them** (its "Phase 3" = group-inherited config, not admin auth). Implemented on `feat/groups-*` branches: §11 Phase 1 (declarative `pic plan`/`apply`/`prune` + env overlays), Phase 2 (single-parent groups tree + hierarchy-aware RBAC), Phase 3 (group-inherited, env-scoped `vars` + secrets resolved **live** via a recursive CTE — no materialized cache), Phase 4-lite (group-owned **endpoint** scripts: `scripts` polymorphic owner in `0050_group_scripts.sql`, `get_by_name_inherited`/`is_invocable_by_app` chain resolution, inherited `invoke()` + declarative route/trigger binding — all **live**, no body materialization), Phase 5 (the **declarative project tool maps onto the group tree**: the reconcile engine generalized to `ApplyOwner{App|Group}`, a `[group]` manifest kind, and a single atomic **tree apply** — `pic plan/apply --dir` reconciles a whole directory tree of `picloud.toml` nodes in one Postgres transaction, groups-before-apps so an app route can bind a group script created in the same tx; the bound token folds in each group's `structure_version`. Multi-repo single-owner/attach-point and per-env approval gating are deferred; groups pre-exist), Phase 4b (group **modules** + the **lexical (sealed-by-default) import resolver**, §5.5: owner-polymorphic `ModuleScript`, origin-rooted `ModuleSource::resolve` walking the importing node's chain, `ExecRequest.script_owner` threaded from every dispatch + `invoke()` site, `_source`-driven lexical chaining in `PicloudModuleResolver` with the compiled-module cache re-keyed by `ScriptId`, group modules/imports allowed, single-node dangling-import `plan` check — an inherited group script's imports **seal to the group**, a leaf can't shadow them), §5.5 **extension points** (opt-in polymorphism — **§5.5 now complete**: marker table `0051_extension_points.sql` (owner-polymorphic, CASCADE — structurally a `secrets` name; default body = a co-located `kind=module` script), `ModuleSource::resolve_policy` with **nearest-declaration-kind-wins** — a concrete module resolves lexically, an EP marker resolves **dynamically against the inheriting app** (its override else the default body up-chain), `NoProvider` is a hard error; declarative-only authoring via the `[app]`/`[group]` manifest key `extension_points = [...]`, reconcile mirrors `secrets`, single-node no-provider `plan` check, read-only `pic extension-points ls` + `pull` round-trip — the app can **override** a group default, the deliberate inverse of the Phase 4b sealed import). Next: §11.6 (group-level collections, v1.3) or multi-node cluster mode.
 
 **Data-model invariant:** app-owned data-plane tables (KV, docs, files, …) start with `app_id UUID NOT NULL REFERENCES apps(id) ON DELETE CASCADE`; the group-inheritable tables — _config_ (`vars`, `secrets`) and now group-owned _code_ (`scripts`, `0050`) — instead carry a **polymorphic owner**: nullable `group_id` and `app_id` with an exactly-one CHECK and per-owner partial-unique indexes (config is `ON DELETE CASCADE`, scripts `RESTRICT` — code is not data). Inheritance resolves **live** down `apps.group_id → groups.parent_id` via `CHAIN_LEVELS_CTE` (no materialized view); nearest-owner-wins with an app's own row shadowing the inherited one (CoW). Every Rhai SDK call resolves its app from `cx.app_id`, never a script-passed arg, and a group script always runs under the *inheriting* app's `cx.app_id` (the cross-app isolation boundary).
 

crates/manager-core/tests/expected_schema.txt

@@ -198,6 +198,14 @@ table: execution_logs
   app_id: uuid NOT NULL
   source: text NOT NULL default='http'::text
 
+table: extension_points
+  id: uuid NOT NULL default=gen_random_uuid()
+  group_id: uuid NULL
+  app_id: uuid NULL
+  name: text NOT NULL
+  created_at: timestamp with time zone NOT NULL default=now()
+  updated_at: timestamp with time zone NOT NULL default=now()
+
 table: files
   app_id: uuid NOT NULL
   collection: text NOT NULL
@@ -463,6 +471,13 @@ indexes on execution_logs:
   execution_logs_pkey: public.execution_logs USING btree (id)
   execution_logs_script_id_created_at_idx: public.execution_logs USING btree (script_id, created_at DESC)
 
+indexes on extension_points:
+  extension_points_app_id_idx: public.extension_points USING btree (app_id) WHERE (app_id IS NOT NULL)
+  extension_points_app_uidx: public.extension_points USING btree (app_id, lower(name)) WHERE (app_id IS NOT NULL)
+  extension_points_group_id_idx: public.extension_points USING btree (group_id) WHERE (group_id IS NOT NULL)
+  extension_points_group_uidx: public.extension_points USING btree (group_id, lower(name)) WHERE (group_id IS NOT NULL)
+  extension_points_pkey: public.extension_points USING btree (id)
+
 indexes on files:
   files_pkey: public.files USING btree (app_id, collection, id)
   idx_files_app_collection: public.files USING btree (app_id, collection)
@@ -656,6 +671,12 @@ constraints on execution_logs:
   [FOREIGN KEY] execution_logs_script_id_fkey: FOREIGN KEY (script_id) REFERENCES scripts(id) ON DELETE SET NULL
   [PRIMARY KEY] execution_logs_pkey: PRIMARY KEY (id)
 
+constraints on extension_points:
+  [CHECK] extension_points_owner_exactly_one: CHECK (((group_id IS NULL) <> (app_id IS NULL)))
+  [FOREIGN KEY] extension_points_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
+  [FOREIGN KEY] extension_points_group_id_fkey: FOREIGN KEY (group_id) REFERENCES groups(id) ON DELETE CASCADE
+  [PRIMARY KEY] extension_points_pkey: PRIMARY KEY (id)
+
 constraints on files:
   [FOREIGN KEY] files_app_id_fkey: FOREIGN KEY (app_id) REFERENCES apps(id) ON DELETE CASCADE
   [PRIMARY KEY] files_pkey: PRIMARY KEY (app_id, collection, id)
@@ -800,3 +821,4 @@ constraints on vars:
   0048: vars
   0049: group secrets
   0050: group scripts
+  0051: extension points

crates/picloud-cli/src/cmds/init.rs

@@ -113,6 +113,7 @@ fn scaffold_manifest(slug: &str, name: &str) -> Manifest {
             slug: slug.to_string(),
             name: name.to_string(),
             description: None,
+            extension_points: Vec::new(),
         }),
         group: None,
         scripts: vec![ManifestScript {
@@ -139,7 +140,6 @@ fn scaffold_manifest(slug: &str, name: &str) -> Manifest {
         triggers: crate::manifest::ManifestTriggers::default(),
         secrets: crate::manifest::ManifestSecrets::default(),
         vars: std::collections::BTreeMap::new(),
-        extension_points: Vec::new(),
     }
 }
 

crates/picloud-cli/src/cmds/plan.rs

@@ -161,7 +161,7 @@ pub fn build_bundle(manifest: &Manifest, base_dir: &Path) -> Result<Value> {
         "triggers": triggers,
         "secrets": manifest.secrets.names,
         "vars": vars,
-        "extension_points": manifest.extension_points,
+        "extension_points": manifest.extension_points(),
     }))
 }
 

crates/picloud-cli/src/cmds/pull.rs

@@ -224,6 +224,7 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
             slug: app.app.slug.clone(),
             name: app.app.name.clone(),
             description: app.app.description.clone(),
+            extension_points,
         }),
         group: None,
         scripts: manifest_scripts,
@@ -233,7 +234,6 @@ pub async fn run(app_ident: &str, dir: &Path, force: bool, mode: OutputMode) ->
             names: secrets.iter().map(|s| s.name.clone()).collect(),
         },
         vars: manifest_vars,
-        extension_points,
     };
 
     std::fs::write(&manifest_path, manifest.to_toml()?)

crates/picloud-cli/src/manifest.rs

@@ -49,12 +49,6 @@ pub struct Manifest {
     /// The overlay merges per-env, last-write-wins by key.
     #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
     pub vars: BTreeMap<String, toml::Value>,
-    /// `extension_points = ["theme", …]` (§5.5) — module names this node marks
-    /// as provided/overridable by descendants. Name-only, like `[secrets]`; the
-    /// optional default body is a co-located `[[scripts]]` module of the same
-    /// name. Allowed on app and group nodes.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub extension_points: Vec<String>,
 }
 
 impl Manifest {
@@ -105,6 +99,17 @@ impl Manifest {
         self.group.is_some()
     }
 
+    /// This node's declared extension-point names (§5.5), from whichever of
+    /// `[app]` / `[group]` is present.
+    #[must_use]
+    pub fn extension_points(&self) -> &[String] {
+        match (&self.app, &self.group) {
+            (Some(a), _) => &a.extension_points,
+            (_, Some(g)) => &g.extension_points,
+            _ => &[],
+        }
+    }
+
     /// Load and parse the manifest at `path`.
     pub fn load(path: &Path) -> Result<Self> {
         let body =
@@ -209,6 +214,12 @@ pub struct ManifestApp {
     pub name: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
+    /// `extension_points = ["theme", …]` (§5.5) — module names this node marks
+    /// as provided/overridable by descendants. Name-only, like `[secrets]`; the
+    /// optional default body is a co-located `[[scripts]]` module of the same
+    /// name. A key of the `[app]` table so TOML can't mis-nest it.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub extension_points: Vec<String>,
 }
 
 /// A `[group]` node (Phase 5): a group's own declarative content — its scripts
@@ -221,6 +232,9 @@ pub struct ManifestGroup {
     pub name: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub description: Option<String>,
+    /// See [`ManifestApp::extension_points`]. A key of the `[group]` table.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub extension_points: Vec<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
@@ -432,6 +446,7 @@ mod tests {
                 slug: "blog".into(),
                 name: "My Blog".into(),
                 description: Some("demo".into()),
+                extension_points: vec!["theme".into()],
             }),
             group: None,
             scripts: vec![
@@ -494,7 +509,6 @@ mod tests {
                 ("region".to_string(), toml::Value::String("eu".into())),
                 ("max-retries".to_string(), toml::Value::Integer(3)),
             ]),
-            extension_points: vec!["theme".into()],
         }
     }
 
@@ -591,6 +605,7 @@ mod tests {
                 slug: "x".into(),
                 name: "X".into(),
                 description: None,
+                extension_points: vec![],
             }),
             group: None,
             scripts: vec![],
@@ -598,7 +613,6 @@ mod tests {
             triggers: ManifestTriggers::default(),
             secrets: ManifestSecrets::default(),
             vars: BTreeMap::new(),
-            extension_points: vec![],
         };
         let text = m.to_toml().unwrap();
         assert!(!text.contains("[[scripts]]"), "got:\n{text}");

crates/picloud-cli/tests/cli.rs

@@ -23,6 +23,7 @@ mod dead_letters;
 mod email_queue;
 mod enabled;
 mod env_overlay;
+mod extension_points;
 mod group_modules;
 mod group_scripts;
 mod group_secrets;

crates/picloud-cli/tests/extension_points.rs

@@ -0,0 +1,231 @@
+//! §5.5 opt-in extension points, end to end via `pic`:
+//!   * a group marks a module `theme` an extension point (default body) and an
+//!     endpoint `render` imports it; an app inherits → uses the DEFAULT,
+//!   * the app provides its OWN `theme` module → `render` now binds the app's
+//!     (DYNAMIC override — the inverse of the Phase 4b sealed/lexical import),
+//!   * `pic extension-points ls --app` shows the resolved provider,
+//!   * an inherited extension point with NO provider is a `pic plan` error.
+
+use std::fs;
+
+use tempfile::TempDir;
+
+use crate::common;
+use crate::common::cleanup::{AppGuard, GroupGuard, ScriptGuard};
+
+fn manifest_dir() -> TempDir {
+    let dir = TempDir::new().expect("tempdir");
+    fs::create_dir_all(dir.path().join("scripts")).expect("scripts dir");
+    dir
+}
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn extension_point_default_then_app_override() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let group = common::unique_slug("ep-grp");
+    let child = common::unique_slug("ep-child");
+
+    let _g = GroupGuard::new(&env.url, &env.token, &group);
+    common::pic_as(&env)
+        .args(["groups", "create", &group])
+        .assert()
+        .success();
+
+    let dir = manifest_dir();
+    // Group default `theme` module + a `render` endpoint importing it.
+    fs::write(
+        dir.path().join("scripts/theme.rhai"),
+        r#"fn color() { "blue" }"#,
+    )
+    .unwrap();
+    common::pic_as(&env)
+        .args(["scripts", "deploy"])
+        .arg(dir.path().join("scripts/theme.rhai"))
+        .args(["--group", &group, "--name", "theme", "--kind", "module"])
+        .assert()
+        .success();
+    fs::write(
+        dir.path().join("scripts/render.rhai"),
+        r#"import "theme" as t; t::color()"#,
+    )
+    .unwrap();
+    common::pic_as(&env)
+        .args(["scripts", "deploy"])
+        .arg(dir.path().join("scripts/render.rhai"))
+        .args(["--group", &group, "--name", "render"])
+        .assert()
+        .success();
+    let _gt = ScriptGuard::new(
+        &env.url,
+        &env.token,
+        &group_script_id(&env, &group, "theme"),
+    );
+    let _gr = ScriptGuard::new(
+        &env.url,
+        &env.token,
+        &group_script_id(&env, &group, "render"),
+    );
+
+    // Mark `theme` an extension point at the group (declarative apply).
+    let gmanifest =
+        format!("[group]\nslug = \"{group}\"\nname = \"EP\"\n\nextension_points = [\"theme\"]\n");
+    let gpath = dir.path().join("group.toml");
+    fs::write(&gpath, &gmanifest).unwrap();
+    common::pic_as(&env)
+        .args(["apply", "--file"])
+        .arg(&gpath)
+        .assert()
+        .success();
+
+    // App under the group; a `caller` invokes the inherited `render`.
+    let _child = AppGuard::new(&env.url, &env.token, &child);
+    common::pic_as(&env)
+        .args(["apps", "create", &child, "--group", &group])
+        .assert()
+        .success();
+    fs::write(
+        dir.path().join("scripts/caller.rhai"),
+        r#"invoke("render", #{})"#,
+    )
+    .unwrap();
+    common::pic_as(&env)
+        .args(["scripts", "deploy"])
+        .arg(dir.path().join("scripts/caller.rhai"))
+        .args(["--app", &child, "--name", "caller"])
+        .assert()
+        .success();
+    let caller_id = app_script_id(&env, &child, "caller");
+
+    // Default: with no app override, `render`'s EP import falls back to the
+    // group's default body → "blue".
+    assert_eq!(
+        invoke_body(&env, &caller_id),
+        serde_json::json!("blue"),
+        "an inherited extension point resolves the group's default body"
+    );
+
+    // DYNAMIC OVERRIDE: the app provides its own `theme`. Because `theme` is an
+    // extension point, the group endpoint's import now binds the APP's module —
+    // the exact inverse of a Phase 4b lexical (sealed) import.
+    fs::write(
+        dir.path().join("scripts/apptheme.rhai"),
+        r#"fn color() { "red" }"#,
+    )
+    .unwrap();
+    common::pic_as(&env)
+        .args(["scripts", "deploy"])
+        .arg(dir.path().join("scripts/apptheme.rhai"))
+        .args(["--app", &child, "--name", "theme", "--kind", "module"])
+        .assert()
+        .success();
+    assert_eq!(
+        invoke_body(&env, &caller_id),
+        serde_json::json!("red"),
+        "the app must override an extension point the group declared"
+    );
+
+    // `extension-points ls --app` shows the resolved provider.
+    let ls = String::from_utf8(
+        common::pic_as(&env)
+            .args(["extension-points", "ls", "--app", &child])
+            .output()
+            .unwrap()
+            .stdout,
+    )
+    .unwrap();
+    assert!(
+        ls.contains("theme") && ls.contains("app override"),
+        "ls should report the app override:\n{ls}"
+    );
+}
+
+#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
+#[test]
+fn extension_point_without_provider_is_rejected_by_plan() {
+    let Some(fx) = common::fixture_or_skip() else {
+        return;
+    };
+    let env = common::admin_env(fx);
+    let group = common::unique_slug("epn-grp");
+    let child = common::unique_slug("epn-child");
+
+    let _g = GroupGuard::new(&env.url, &env.token, &group);
+    common::pic_as(&env)
+        .args(["groups", "create", &group])
+        .assert()
+        .success();
+
+    // Group declares an EP `ghost` with NO default body (body-less).
+    let dir = manifest_dir();
+    let gmanifest =
+        format!("[group]\nslug = \"{group}\"\nname = \"EPN\"\n\nextension_points = [\"ghost\"]\n");
+    let gpath = dir.path().join("group.toml");
+    fs::write(&gpath, &gmanifest).unwrap();
+    common::pic_as(&env)
+        .args(["apply", "--file"])
+        .arg(&gpath)
+        .assert()
+        .success();
+
+    // App under the group provides no `ghost` → any plan for it is refused.
+    let _child = AppGuard::new(&env.url, &env.token, &child);
+    common::pic_as(&env)
+        .args(["apps", "create", &child, "--group", &group])
+        .assert()
+        .success();
+    let amanifest = format!("[app]\nslug = \"{child}\"\nname = \"EPN child\"\n");
+    let apath = dir.path().join("picloud.toml");
+    fs::write(&apath, &amanifest).unwrap();
+    let out = common::pic_as(&env)
+        .args(["plan", "--file"])
+        .arg(&apath)
+        .output()
+        .expect("plan");
+    assert!(
+        !out.status.success(),
+        "an inherited extension point with no provider must fail plan"
+    );
+    let stderr = String::from_utf8_lossy(&out.stderr).to_lowercase();
+    assert!(
+        stderr.contains("ghost") || stderr.contains("no provider") || stderr.contains("extension"),
+        "plan error should name the unprovided extension point:\n{stderr}"
+    );
+}
+
+/// Id of the named script in a group (`pic scripts ls --group <g>`).
+fn group_script_id(env: &common::TestEnv, group: &str, name: &str) -> String {
+    named_id(env, &["scripts", "ls", "--group", group], name)
+}
+
+/// Id of the named script in an app (`pic scripts ls --app <a>`).
+fn app_script_id(env: &common::TestEnv, app: &str, name: &str) -> String {
+    named_id(env, &["scripts", "ls", "--app", app], name)
+}
+
+fn named_id(env: &common::TestEnv, args: &[&str], name: &str) -> String {
+    let ls = common::pic_as(env).args(args).output().expect("scripts ls");
+    let table = String::from_utf8(ls.stdout).unwrap();
+    table
+        .lines()
+        .map(common::cells)
+        .find(|c| c.get(2) == Some(&name))
+        .and_then(|c| c.first().map(|s| (*s).to_string()))
+        .unwrap_or_else(|| panic!("script `{name}` not found:\n{table}"))
+}
+
+fn invoke_body(env: &common::TestEnv, id: &str) -> serde_json::Value {
+    let out = common::pic_as(env)
+        .args(["scripts", "invoke", id])
+        .output()
+        .expect("scripts invoke");
+    assert!(
+        out.status.success(),
+        "invoke failed: {}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    serde_json::from_slice(&out.stdout).expect("invoke body is JSON")
+}

docs/design/groups-and-project-tool.md

@@ -552,9 +552,21 @@ trust inversion). The rule:
 > site; the `PicloudModuleResolver` reads the importing node from Rhai's `_source` (set to each module's
 > owner via `AST::set_source(encode(owner))` before `eval_ast_as_new` — the lexical chaining), and the
 > cache is re-keyed by resolved `ScriptId`. Group modules + group-script imports are now allowed
-> (`group_scripts_api`), and the single-node apply runs the §5.5 dangling-import `plan` check. **Opt-in
+> (`group_scripts_api`), and the single-node apply runs the §5.5 dangling-import `plan` check.
-> extension points** (the dynamic-resolution branch + `[extension_points]` manifest declaration) remain
+
-> the one deferred piece of §5.5 — a clean additive follow-up on top of the now-origin-aware resolver.
+> **Resolved (extension points ✅) — §5.5 is complete.** Opt-in polymorphism shipped: an extension
+> point is a **pure marker** `(owner, name)` (migration 0051 `extension_points`, owner-polymorphic +
+> CASCADE — structurally a `secrets` name), authored declaratively as an `[app]`/`[group]` manifest key
+> `extension_points = [...]` (a *node key*, so TOML can't mis-nest it); the optional **default body is a
+> co-located `kind=module` script**. The resolver's `ModuleSource::resolve_policy(origin, app, name)`
+> applies **nearest-declaration-kind-wins** over the importing node's chain (one query: min EP depth vs
+> min module depth, EP wins a tie): a concrete module → lexical; an EP marker → **dynamic**, resolved
+> against the inheriting app (its override, else the default body up-chain) — `NoProvider` is a hard
+> error. Reconcile mirrors `secrets` (name-only diff/prune/state-token); the single-node apply adds the
+> **no-provider `plan` check** (every EP visible to an app must have a provider); read-only
+> `pic extension-points ls` + `pull` round-trip complete the surface. **Authoring is declarative only**
+> (no imperative `add/rm`). Verified e2e: a group default resolves for an inheriting app, and the app
+> can **override** it — the deliberate inverse of the Phase 4b sealed/lexical import.
 
 ### 5.6 Tree lifecycle: delete, reparent, rename