# Customex community layer

Customex can support a community of view recipes, design profiles, and publisher requests without turning community content into executable code.

## Trust boundaries

| Input | Role | Authority |
|---|---|---|
| Publisher manifest | Declares components, capabilities, values, and protected boundaries | Authoritative for the site |
| User DESIGN.md | Expresses a user's aesthetic preferences | Advisory only |
| Community view recipe | Suggests a reusable intent or patch shape | Advisory only |
| AI response | Proposes a structured patch | Untrusted until locally validated |
| Extension enforcement | Checks every action before applying it | Final local authority |

A recipe MUST NOT contain JavaScript, CSS selectors, arbitrary DOM code, account operations, or credentials. It can name manifest component IDs and requested capability values, but the current page manifest decides whether those names and values are valid.

## View recipe shape

A portable recipe can be represented as:

```json
{
  "schemaVersion": "0.1",
  "id": "quiet-feed",
  "name": "Quiet reading feed",
  "description": "Show editorial and culture items in a calm stacked view.",
  "intentExamples": ["Make this feed calmer", "Show me a quieter reading view"],
  "preferences": {
    "includeTopics": ["editorial", "culture"],
    "theme": "calm",
    "layout": "stacked"
  },
  "target": {
    "siteName": "Example Feed",
    "manifestVersion": "0.1"
  },
  "author": "community-user"
}
```

The extension translates a recipe into actions only after matching its preferences against the live manifest. If a recipe asks for `theme: calm` but the site does not declare that value, the request is rejected or partially previewed as unsupported.

## Publisher requests

Users can submit requests such as:

- Expose a compact list view for the task board.
- Declare topic metadata for feed items so users can filter by topic.
- Add a visibility capability for the optional recommendations panel.

A request is a product/design request, not a permission grant. The publisher may implement it by updating their manifest and site code. Until then, the extension must not infer that capability as publisher-authorized.

## Moderation and versioning

A future community service should verify recipe JSON against a schema, display the target manifest/site, record author and license information, support reporting, and pin versions. Recipes should be previewed before installation and revalidated whenever the publisher manifest changes.

## Functional actions

Recipes for operations such as creating tasks or sending messages require a separate operation declaration in the publisher manifest. Community recipes cannot create those permissions. The site must declare input schemas, confirmation requirements, and undo or compensation behavior before an extension may propose the operation.