# 0.43.0 — 2026-07-28 — "Extension Ecosystem"

## Added

- **Complete extension engine and CLI.** Kandown now discovers global and
  project-local extensions, validates manifests and compatibility, enforces
  permissions and trust, isolates failures, contributes fields, commands, gates
  and sync handlers, and stores extension task data under `plugins.<id>.*`.

- **Web extension runtime.** Managed moves now pass through the authoritative
  Node dependency and extension gates. Both task editors render typed extension
  fields, cards display computed badges, and collapsible web panels run behind
  per-panel error boundaries with persistent quarantine.

- **Community extension store and gallery.** Settings can browse, install,
  enable and disable extensions, including installation from a pasted GitHub
  URL. kandown.dev now provides searchable extension listings and detail pages.

- **Reference extension bundles.** Burndown, Labels and Webhook Sync demonstrate
  fields, badges, panels, gates, commands and sync contributions in Node and
  project-local standalone browser modes.

- **Website presentation components.** The marketing site gained CurvedInput
  newsletter capture, GradualBlur page treatment and refined npm and Reddit
  links.

- **One-command local quality gate.** `pnpm verify` now runs typechecking, the
  complete test suite, production builds, codemap and changelog drift checks,
  plus a scoped whitespace check.

## Fixed

- **Repository-controlled extension trust.** Project source can no longer commit
  trust, enablement or quarantine state that authorizes itself. Node stores that
  state outside the repository, while standalone approval is bound to the local
  project and extension source fingerprint.

- **Extension runtime consistency.** Restricted-mode changes invalidate cached
  hosts, managed moves serialize per project, stale editor responses are
  guarded, nested extension frontmatter round-trips, and failed extension
  contributions remain isolated from the board.

- **Website extension builds and documentation routes.** Registry generation
  prefers the current local source instead of stale CDN data, and missing docs
  routes are restored with route coverage.

- **Post-commit graph refresh race.** Detached Graphify updates now disable
  optional Git locks so an immediate follow-up commit cannot be blocked by a
  stale `.git/index.lock`.

## Changed

- **Agent workflow guidance.** `AGENTS.md` now maps mirrored task editors, store
  actions and local API adapters before agents start editing. Reviewer feedback
  remains subordinate to explicit project-owner decisions and recorded task
  scope.

- **Extension documentation.** The architecture, security model, authoring
  guide, standalone behavior and publishing workflow are documented end to end.