# BRT website extensions

> Authoritative developer contract for building signed, isolated website extensions for Battle Ready Tech.

Protocol version: 1
Manifest schema version: 1

## Start here

- [Developer kit](https://developers.battlereadytech.com/extensions/v1): quickstart, project layout, commands, and contract authority.
- [LLM authoring](https://developers.battlereadytech.com/extensions/v1/docs/llm-authoring): required process, hard constraints, and completion report.
- [Authoring guide](https://developers.battlereadytech.com/extensions/v1/docs/authoring-guide): implementation workflow and failure-state requirements.

## Authoritative references

- [Machine-readable contract](https://developers.battlereadytech.com/extensions/v1/contract.json): limits, file types, capabilities, actions, payloads, and responses.
- [Manifest JSON Schema](https://developers.battlereadytech.com/extensions/v1/manifest.schema.json): closed manifest schema for editor and CI validation.
- [Runtime API](https://developers.battlereadytech.com/extensions/v1/docs/runtime-api): documented `window.BRT` methods.
- [TypeScript declarations](https://developers.battlereadytech.com/extensions/v1/brt-extension.d.ts): static API declarations.
- [Submission and review](https://developers.battlereadytech.com/extensions/v1/docs/submission-and-review): deterministic packaging and Ed25519 signing.
- [Troubleshooting](https://developers.battlereadytech.com/extensions/v1/docs/troubleshooting): validation and runtime errors.
- [Downloadable kit](https://developers.battlereadytech.com/extensions/v1/download): CLI, schemas, documentation, and complete reference source.

## Full context

- [llms-full.txt](https://developers.battlereadytech.com/llms-full.txt): self-contained human and machine documentation plus authoritative schema and type sources.

## Non-negotiable rules

- Use only documented manifest fields, capabilities, actions, and API methods.
- Package every dependency. The runtime has no network access.
- Keep exactly one HTML entrypoint and all JavaScript in external local modules.
- Treat settings and API results as untrusted public data.
- Request the fewest capabilities needed and handle missing grants.
- Never give an LLM a publisher private key.
- Run the developer check before handoff. BRT production validation is final.

Generate a self-contained context file with:

```bash
node tools/web-extensions/brt-extension.mjs context --out ./brt-extension-context.md
```