The meta-gem, and the way a Terret is composed. Bundles ship ordered config rows, profiles stack bundles, patches adjust rows by id, and Terret.boot hands the result to the Hames loader -- so which plugins run, in what order, with what config is a question YAML answers rather than Ruby. Ships terret-base (the log, the harness, the model seam, the execution world sandboxed with the network denied, the standard tool roster, and a policy floor that starts closed), the headless profile template, and trt: boot, dump-config, doctor.

The second interface (plan §9.1): an ACP v1 server so an editor can drive a Terret agent over JSON-RPC 2.0 on stdio. Newline-delimited framing, session/new spawns a durable agent, session/prompt pends the whole turn, session/update notifications projected from the session log. Consumes the same two seams the socket does with no change to core, which is the standing proof that the interface is not privileged. Zero runtime dependencies beyond stdlib json.

ctx[:fs]: workspace-contained file ops (read/write/edit/stat/glob) behind an fs/authorize waterfall, with realpath-based containment that fails closed on traversal and symlink escapes. ctx[:subprocess] spawns and captures under the fiber scheduler with cooperative cancellation; ctx[:shell] keeps a bash per agent alive across calls; ctx[:terminals] holds named long-lived PTYs; ctx[:jobs] runs a command past the turn that started it; and every argv reaches a process through the ctx[:sandbox] seam. Zero runtime dependencies beyond stdlib.

A worked example of the Terret extension story: a third-party gem that ships one tool (`fortune`, one line from a vendored list) and declares itself a bundle in a line of gemspec metadata, so a profile can stack it by name. Stdlib-only beyond terret-core. The running example of docs/cookbook/adding-a-tool.md, kept in lockstep with that page.

Mounts Model Context Protocol servers (stdio and streamable HTTP, via the manceps client) as namespaced tool sources behind ctx.tools, with per-server approval policy, per-call timeouts, and live tool-list reconciliation.

ctx[:summarizer] backed by Morph's Compact API: extractive line-level compression (surviving lines byte-identical), wire mirrored from the deployed agora integration. Zero runtime dependencies beyond stdlib net/http.

The one v1 model adapter for Terret: OpenRouter is OpenAI-compatible, so a single streaming implementation reaches the whole model space behind the provider-neutral ctx.llm seam. SSE streaming with tool calling, usage accounting, and retry with jittered backoff.

ctx[:sandbox] backed by a long-lived container: one patch row swaps this plugin in and every argv the harness spawns — Bash, Grep, the PTY tools — starts running inside it, with no change to any tool. The workspace is bind-mounted at its own realpath, so host-side file ops and in-container processes see one world at one set of paths; the network is denied by default. Shells out to the docker CLI, so there are no runtime dependencies beyond stdlib.

Durable session persistence for Terret: the append-only session log stored one event per row in SQLite (WAL mode), behind the ctx[:session_store] seam, so sessions survive process restarts with byte-identical derived context.

Claude Code's tool names, verbatim wherever it has one: Read, Write, Edit, Glob, Grep, Bash, WebFetch, Task and TodoWrite, plus snake_case terminal_* and job_* for the seams it has no equivalent for — all registered on ctx[:tools] with honest mutating/approval/concurrency metadata. Every handler reaches the world only through a seam, so swapping the sandbox row moves the whole roster into a container untouched. Zero runtime dependencies beyond stdlib; ripgrep is used as a fast path when it is present.

The v1 interface: one connection per agent, durable session events out, five client frames in, exact replay-then-tail reconnect on the append-only log, bounded-queue backpressure, heartbeat, and bearer auth. Ships as a plugin because the primary interface being a plugin is the architecture's point.