Register extension-provided models through the public runtime API

[Haz3-jolt]

Outcome

Give a real provider extension a supported registration and disposal path without granting private kernel or raw managed-credential access.

Current repository evidence

• packages/ai/src/registry.ts: ProviderRegistry supports provider registration, but this is not a capability-scoped executable-extension registration path.
• packages/extensions/api/src/index.ts: The public API is currently terminal presentation oriented.

Acceptance criteria

• Use a working provider-extension consumer to define the minimal public registration surface over the existing provider contract.
• Validate provider and model declarations, capability requests, naming conflicts, and credential references before activation.
• Keep third-party implementations in the isolated extension process host; trusted first-party adapters may use the approved in-process policy.
• Route model calls and authentication through daemon-owned provider and credential boundaries rather than extension access to managed secrets.
• On disable or reload, remove discoverable models and pending background refresh safely; existing requests finish or fail explicitly under operation ownership.
• Record model-visible provider configuration and registration boundaries and test isolation, disposal, collisions, and disabled behavior.

Verification

Add focused public-contract and installed-artifact checks for the supported consumer, including disabled behavior and invalid inputs. Source inspection was performed for this audit; product tests were not run.

Coordination

This is future work tied to a concrete consumer. Posting this issue does not authorize premature scaffolding, publication, dependency additions, or activation before the required security controls.

Source

ROADMAP.md and CODE_STRUCTURE.md, using the references recorded below.

Repository audit

Audited against Axl 88944a2. Phase 6. Source inspection, not an executed behavior test. Roadmap references: L1897.

Tracking key: axl-backlog:audit.extension-providers.

Issue tracking

Axl issue mirror: #375 | GitHub #375

Related issues:

• #10 (Support the complete model provider and catalog surface #10)
• #44 (Implement the capability-scoped runtime extension API with real consumers #44)
• #47 (Activate executable extensions through a capability process host #47)