Epic: Frontend contribution layer — plugins that ship UI

[rickylabs]

Tracking epic for the frontend contribution layer: a NetScript plugin becomes a full-stack unit — the same package that contributes services, workers, schemas, and Aspire wiring gains a frontend/ directory contributing pages, islands, zone components, nav entries, and theme CSS to any NetScript Fresh host app, discovered like every other axis (manifest pointer + generated, type-checked registry) and mounted through upstream Fresh 2.3 primitives.

RFC: #890 (draft PR carrying the full design record — rfc.md + .llm/runs/plan-frontend-contrib--seed/, rev 3, twice-reviewed: Sol·high adversarial 20/20 integrated, Kimi K3 docs-forecast 17/17 integrated).

Unblocks four consumers: dev dashboard panels (#400 — this epic's core lands in the same beta.13 cut as its first consumer), auth UI, ai surfaces, deploy consoles (Refs #427, #432 — both KEEP-and-re-baseline per the RFC's supersession map; no issues closed by this epic's filing).

Pillars

1. Contracts — @netscript/plugin-frontend-core/contracts/v1: envelope + (family, major) versioning, app family (route/island/zone/nav/theme), identity quartet, HostSurfaceDescriptor, request/client context split, budgets.
2. Discovery — pointer axis in @netscript/plugin; transactional generated replace-set in .netscript/generated/ with frontend.check.ts as the install gate.
3. Host runtime — @netscript/fresh/plugins: post-fsRoutes composition mounting, literal route loaders + normalizer, island specifier registration, PluginZone, nav feed, deny-by-default procedure gateway.
4. DX + lifecycle — plugin new --with frontend, netscript plugin dev, doctor taxonomy, quarantine states, AppTarget starters, defineFrontendTestSuite + budgets.
5. Consumers — first-party dogfood panels, auth v1, ai durable chat; dashboard (epic: NetScript Dev Dashboard — the Aspire/Scalar satellite that drives the framework (ships as a plugin, beta.6) #400) and deploy epics consume in their own runs.

Sequencing law: Wave-0 proofs (S1–S5) land before any public contract freezes — the mechanisms they prove were the adversarial review's blocker findings. First pull: the p0s (#923–#931).

Sub-issues

Wave 0 — proofs (beta.13, p0):

• [frontend-contrib S1] P1 proof: mounted sub-app command ordering #923 [S1] P1 proof: mounted sub-app command ordering
• [frontend-contrib S2] P2 proof: literal lazy route loaders + normalizeFreshRouteModule #924 [S2] P2 proof: literal lazy route loaders + normalizeFreshRouteModule
• [frontend-contrib S3] P3 proof: dependency-island build matrix + plugin-vite pin policy #925 [S3] P3 proof: dependency-island build matrix + plugin-vite pin policy
• [frontend-contrib S4] P4 proof: SSR failure-containment fixtures #926 [S4] P4 proof: SSR failure-containment fixtures
• [frontend-contrib S5] P5 proof: gateway threat model + streaming abort #927 [S5] P5 proof: gateway threat model + streaming abort

Wave 1 — contracts + spine (beta.13):

• [frontend-contrib S6] @netscript/plugin-frontend-core contracts/v1 #928 [S6] @netscript/plugin-frontend-core contracts/v1 (p0)
• [frontend-contrib S7] @netscript/plugin pointer axis (.withFrontend) #929 [S7] @netscript/plugin pointer axis (p0)
• [frontend-contrib S8] Frontend registry emissions: transactional replace-set #930 [S8] Frontend registry emissions: transactional replace-set (p0)
• [frontend-contrib S9] @netscript/fresh/plugins host runtime #931 [S9] @netscript/fresh/plugins host runtime (p0)
• [frontend-contrib S10] Scaffold template wiring + HostSurfaceDescriptor + vite feed #932 [S10] Scaffold template wiring + HostSurfaceDescriptor + vite feed (p1)
• [frontend-contrib S11] Workers dogfood: zone panel + console route + island #933 [S11] Workers dogfood: zone panel + console route + island (p1)

Wave 1b — gateway (beta.13):

• [frontend-contrib S12] Generated deny-by-default procedure gateway #934 [S12] Generated deny-by-default procedure gateway (p1)

Wave 2 — DX + lifecycle (beta.13):

• [frontend-contrib S13] plugin new --with frontend #935 [S13] plugin new --with frontend (p2)
• [frontend-contrib S14] netscript plugin dev (frontend watch loop) #936 [S14] netscript plugin dev frontend watch loop (p1)
• [frontend-contrib S15] Doctor frontend check + five-state taxonomy #937 [S15] Doctor frontend check + five-state taxonomy (p2)
• [frontend-contrib S16] Quarantine render states + provenance chrome #938 [S16] Quarantine render states + provenance chrome (p2)
• [frontend-contrib S18] defineFrontendTestSuite + budgets enforcement #940 [S18] defineFrontendTestSuite + budgets enforcement (p1)
• [frontend-contrib S22] Sagas/triggers/streams dashboard-zone panels #944 [S22] Sagas/triggers/streams dashboard-zone panels (p2)

Wave 3 — consumers (beta.15):

• [frontend-contrib S17] AppTarget scaffolder seam + plugin resource add --app #939 [S17] AppTarget scaffolder seam + plugin resource add --app (p1)
• [frontend-contrib S19] generate frontend-wiring adoption verb #941 [S19] generate frontend-wiring adoption verb (p2)
• [frontend-contrib S20] Auth v1 frontend (account + session widget + signin starter) #942 [S20] Auth v1 frontend: account + session widget + signin starter (p1)
• [frontend-contrib S21] AI frontend (durable chat route + assist launcher) #943 [S21] AI frontend: durable chat route + assist launcher (p1)

Completion wave (beta.17):

• [frontend-contrib S23] auth-org backend capability (org-console prerequisite) #945 [S23] auth-org backend capability — org-console prerequisite (p2)
• [frontend-contrib S24] Convention generator (generate frontend) #946 [S24] Convention generator generate frontend (p3)

Acceptance

• gate: all Wave-0 proofs (S1–S5) recorded with pass/fail evidence before contract-freeze slices merge
• gate: extended scaffold.runtime (install → render → hydrate → remove) green with a frontend-contributing plugin
• gate: every sub-issue closed or explicitly re-homed with a pointer

Part of the beta.13 train alongside #400; owner schedules any re-slicing.