docs(website): sync dev docs from 6b7a00e77e

fern/.docs-snapshots.yml

@@ -1,8 +1,8 @@
 snapshots:
   dev:
-    source-ref: 3495c8e92af8947046f4f938f929bfb7057eb455
-    source-sha: 3495c8e92af8947046f4f938f929bfb7057eb455
-    version: 0.1.4.dev26
+    source-ref: 6b7a00e77e6ecc1faf46cd4da602455d54750170
+    source-sha: 6b7a00e77e6ecc1faf46cd4da602455d54750170
+    version: 0.1.4.dev28
   latest:
     source-ref: e1f3c82caa3ed3b65de22889ae7ef32a774878ef
     source-sha: e1f3c82caa3ed3b65de22889ae7ef32a774878ef

fern/pages-dev/extensibility/overview.mdx

@@ -102,6 +102,29 @@ are satisfied. It rejects different major versions, missing metadata, or an
 unmet required capability during startup. Built-in and external service
 extensions follow the same compatibility checks.
 
+Every extension returns protocol `1.0` and lists its family's base capability in
+`supported_capabilities`:
+
+| Family | Base capability | Returned in |
+|---|---|---|
+| Compute driver | `openshell.compute.contract` | `GetCapabilitiesResponse.extension` |
+| Credential driver | `openshell.credentials.contract` | `GetCredentialDriverCapabilitiesResponse.extension` |
+| Gateway interceptor | `openshell.gateway-interceptor.contract` | `InterceptorManifest.extension` |
+| Supervisor middleware | `openshell.supervisor-middleware.contract` | `MiddlewareManifest.extension` |
+
+For example, a supervisor middleware `Describe` response includes:
+
+```json
+{
+  "extension": {
+    "protocol_version": { "major": 1, "minor": 0 },
+    "implementation_name": "example/content-guard",
+    "implementation_version": "0.1.0",
+    "supported_capabilities": ["openshell.supervisor-middleware.contract"]
+  }
+}
+```
+
 Use `openshell gateway info` to inspect the negotiated extension families,
 implementation versions, protocol versions, and capabilities active on a
 gateway.

fern/pages-dev/how-it-works/sandboxes/runtimes.mdx

@@ -28,10 +28,15 @@ the sandbox record and driver-supported persistent storage.
 Set `compute_driver` in the gateway TOML file. A gateway uses one driver at a time.
 
 ```toml
+[openshell]
+version = 2
+
 [openshell.gateway]
 compute_driver = "docker"
 ```
 
+Every gateway TOML file must start with the `[openshell]` table and `version = 2`, or `openshell-gateway config preflight` rejects it with `missing_version`. The remaining examples on this page show only the tables they change.
+
 When `compute_driver` is unset, the gateway auto-detects Kubernetes, then Podman, then Docker. The VM driver is never auto-detected.
 
 Configure driver-specific values, such as images, endpoints, and sizing, under `[openshell.drivers.<name>]`. See the [Gateway Configuration File](/how-it-works/gateways/configuration) reference for every option.