From 62024739d8edbc50980996bcf4968e12d8c2ade4 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 21:57:03 +0000
Subject: [PATCH] docs(website): sync dev docs from
 6b7a00e77e6ecc1faf46cd4da602455d54750170

---
 fern/.docs-snapshots.yml                      |  6 ++---
 fern/pages-dev/extensibility/overview.mdx     | 23 +++++++++++++++++++
 .../how-it-works/sandboxes/runtimes.mdx       |  5 ++++
 3 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/fern/.docs-snapshots.yml b/fern/.docs-snapshots.yml
index 4759d2800..1b25693e5 100644
--- a/fern/.docs-snapshots.yml
+++ b/fern/.docs-snapshots.yml
@@ -1,8 +1,8 @@
 snapshots:
   dev:
-    source-ref: 3495c8e92af8947046f4f938f929bfb7057eb455
-    source-sha: 3495c8e92af8947046f4f938f929bfb7057eb455
-    version: 0.1.4.dev26
+    source-ref: 6b7a00e77e6ecc1faf46cd4da602455d54750170
+    source-sha: 6b7a00e77e6ecc1faf46cd4da602455d54750170
+    version: 0.1.4.dev28
   latest:
     source-ref: e1f3c82caa3ed3b65de22889ae7ef32a774878ef
     source-sha: e1f3c82caa3ed3b65de22889ae7ef32a774878ef
diff --git a/fern/pages-dev/extensibility/overview.mdx b/fern/pages-dev/extensibility/overview.mdx
index 149df13d9..8e551aed0 100644
--- a/fern/pages-dev/extensibility/overview.mdx
+++ b/fern/pages-dev/extensibility/overview.mdx
@@ -102,6 +102,29 @@ are satisfied. It rejects different major versions, missing metadata, or an
 unmet required capability during startup. Built-in and external service
 extensions follow the same compatibility checks.
 
+Every extension returns protocol `1.0` and lists its family's base capability in
+`supported_capabilities`:
+
+| Family | Base capability | Returned in |
+|---|---|---|
+| Compute driver | `openshell.compute.contract` | `GetCapabilitiesResponse.extension` |
+| Credential driver | `openshell.credentials.contract` | `GetCredentialDriverCapabilitiesResponse.extension` |
+| Gateway interceptor | `openshell.gateway-interceptor.contract` | `InterceptorManifest.extension` |
+| Supervisor middleware | `openshell.supervisor-middleware.contract` | `MiddlewareManifest.extension` |
+
+For example, a supervisor middleware `Describe` response includes:
+
+```json
+{
+  "extension": {
+    "protocol_version": { "major": 1, "minor": 0 },
+    "implementation_name": "example/content-guard",
+    "implementation_version": "0.1.0",
+    "supported_capabilities": ["openshell.supervisor-middleware.contract"]
+  }
+}
+```
+
 Use `openshell gateway info` to inspect the negotiated extension families,
 implementation versions, protocol versions, and capabilities active on a
 gateway.
diff --git a/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx b/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx
index 382e800e2..b577497bd 100644
--- a/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx
+++ b/fern/pages-dev/how-it-works/sandboxes/runtimes.mdx
@@ -28,10 +28,15 @@ the sandbox record and driver-supported persistent storage.
 Set `compute_driver` in the gateway TOML file. A gateway uses one driver at a time.
 
 ```toml
+[openshell]
+version = 2
+
 [openshell.gateway]
 compute_driver = "docker"
 ```
 
+Every gateway TOML file must start with the `[openshell]` table and `version = 2`, or `openshell-gateway config preflight` rejects it with `missing_version`. The remaining examples on this page show only the tables they change.
+
 When `compute_driver` is unset, the gateway auto-detects Kubernetes, then Podman, then Docker. The VM driver is never auto-detected.
 
 Configure driver-specific values, such as images, endpoints, and sizing, under `[openshell.drivers.<name>]`. See the [Gateway Configuration File](/how-it-works/gateways/configuration) reference for every option.