PyCForge SDK landscape 0.1

Discover the selected installed engine:
  SELECTED_PYTHON -m pycforge --format json sdk-api
or call pycforge.crucible.sdk_api.discover() in that environment.
This endpoint runs in the selected engine environment. No PySide6 import or
SDK installation is required. The returned folder is authoritative for that
engine installation, not the SDK's own Python environment or working directory.

index.json is the entry point. api.xml describes registered public methods,
constructors, signatures, operations, route decisions, scalar representations,
ownership boundaries, bundled packs, capabilities, limits and diagnostics.
api.xsd is the local schema. requirements.txt is the original API requirements.
scalar_template.py is inert authoring guidance; catalogue refresh must not
import it or any extension code. API 0.1 remains provisional.

SDK responsibility: discover on every startup and headless connect, and expose
explicit refresh during a session. Check protocol, schema, engine API, extension
API, required features, all file lengths and SHA256 values, XML structure and
inventory consistency. Read index.json again after copying to detect a mixed
upgrade. Stage a complete snapshot then atomically change the active cache
pointer. On failure keep the last valid snapshot explicitly labeled OFFLINE;
do not authorize operations against a different engine using stale handles.
Re-discover and compare engine identity and manifest hash before an operation.
The future PySide6 application and headless SDK must share this reader/service.
An additive public method needs a new catalogue export, not an SDK UI rewrite.
Unknown required features or incompatible versions block connection. Do not
silently interpret new required semantics. No network is needed or permitted
for refresh. Do not overwrite a developer's extension source or execute a
catalogue-provided method/template during refresh. Hashes detect mixed or
corrupted inventory; they do not establish package publisher authenticity.

The engine exports this data from explicitly registered public interfaces. It
never parses its own XML for conversions. Run tools.export_sdk_landscape --check
in source qualification. tools.sdk_catalogue_client is a separate, stdlib-only
qualification reader demonstrating startup refresh, closed-schema checking,
bounded UTF-8 XML, DTD/entity/XInclude rejection, hash inventory verification,
atomic cache switching and stale-engine rejection. It does not implement the
future SDK GUI, Python entrypoint activation, worker supervision or complete conformance tools.
The accompanying XSD is additionally checked with lxml in release qualification;
the stdlib reader has an explicit structural validator, not an assumed XSD one.

First pack: *import math [as alias], Runtime route only. fabs, sqrt, copysign,
isfinite, isinf, isnan; pi, e, tau, inf, nan. Use direct positional calls.
Functions are not first-class values. Namespace rebinding, shadowing, re-export,
keywords and argument expansion are deliberately rejected. Module constants
may refer to extension constants. Ordinary import math still means an ordinary
source-bundle import. Each consuming module declares its own extension import.
No host Python math module is imported to convert source or run generated C.

Scalar profile: bool/int64/float64 values, binary64 double, C11 math.h, default
round-to-nearest, no fast-math, POSIX libm (-lm); existing Runtime resource and
arena rules apply. Negative sqrt inputs raise ValueError; nonnumeric arguments
raise TypeError. NaNs and infinities are admitted where the operation defines
them; NaN payloads and bitwise cross-platform libm equality are not promised.
Compiler callbacks may repeat; source arguments evaluate once, left to right.
No arbitrary-precision integers, custom __float__, full math or NumPy coverage.

Constructing ScalarExtension/ExtensionRegistry validates a trusted authoring
snapshot. It does not activate a package. ImportRegistrationStore separately
admits data-only .pcfplugin scalar packages and keeps immutable copies. Conversion
uses one snapshot of ready registrations, including the bundled math pack.
Registration reads SDK verification metadata; it never runs the SDK test suite.
The register dialog shows author/date/version and an explicit Cannot use status
with SDK guidance for bad imports. Declaration metadata identifies contracts; its
fingerprint is not an attestation of arbitrary Python code. A future Python
entrypoint package profile, process supervision and stable general resource
contracts remain explicit requirements. See the source registration contract.

SDK candidate testing uses PythonToCConverter(extension_registry=candidate),
where candidate is an immutable ExtensionRegistry. This authoring context does
not read or change registrations and explicitly reports PYC4708: conversion is
not SDK verification. Compile/reference-test that output before package_bytes()
and explicit register_file(). A verified status is never needed just to test
an unregistered candidate. The installed API catalogue includes this constructor.
