0002 Contracts in core, manifest as the only per-type schema

• Status: accepted (2026-10-29)

Decision

• Every cross-package interface lives in @astrolabe/core, which has no runtime dependencies.
• ComponentManifest is the single schema of a component. The sanitiser allow-list, validation of attributes and children, the view allow-list, the player's attribute parsing, the inspector controls and the docs derive from it.
• Hosts inject everything through factories (createEngine, definePlayer, createAuthoring); no registry is global, nothing registers on import.

Consequences

• A new component changes zero files outside its folder; a boundary script enforces the dependency rules.
• Alternative implementations (an engine port in another language, a remote validator) can target the same interfaces.