feat(web): display Canary relationships with UI protection

README.md

@@ -23,7 +23,7 @@ Console is a Go backend-for-frontend with a React UI compiled into the same bina
 
 - **Identity and access control.** Users, roles and login history stored as Kubernetes CRDs; OAuth2 password login with HS256 tokens; Kubernetes-RBAC-style roles that gate both pages and backend APIs. The seeded administrator is asked to set a password on first login.
 - **Model deployment.** With [Swiss](https://github.com/modelsphere/swiss) on the cluster, browse the model catalog and deploy, upgrade and uninstall models, with a diff before every change and the GPU nodes they run on.
-- **Canary experiments.** When the Canary backend is configured, each experiment arm selects its own v2 model catalog, then a model and variant within it. The catalog selector defaults to `upstreamv2` when available, otherwise the supported environment default or first supported catalog. Changing catalogs clears the arm's previous model, variant, chart pin and YAML overrides; v1 catalogs cannot be selected.
+- **Optional extensions.** The public build contains only built-in modules. Reviewed private distributions can register additional modules and service ownership decorations through the [extension interface](docs/console-design.md#optional-build-time-extensions).
 - **Playground.** Streaming chat with the models deployed in Model Serving, full sampling parameters, per-answer TTFT, tokens/s and cache hit rate, reasoning output, and "view code" for cURL, Python and Node.js.
 - **OpenAI-compatible router.** Programs call `/v1` with API keys that administrators issue — with expiry and optional per-model scope. Keys are stored hashed; usage is exported as Prometheus metrics.
 - **Gateway discovery.** The inference entrypoint, routes and gateway key are read from the cluster (Swiss's site profile or the route ConfigMap) and followed as they change — no URLs or keys copied into configuration.

docs/console-design.md

@@ -697,3 +697,39 @@ requests carry the same headers Global's apiserver sets.
 | P7 | Container management modules, moved over from Rise Global. |
 
 Each phase is independently committable and verifiable.
+
+## Optional build-time extensions
+
+The public frontend registry `web/src/extensions/registry.ts` is empty by default. Distributors can register reviewed modules and service owner decorations in a separate build tree without changing the public source distribution.
+
+| Interface | Behavior |
+|---|---|
+| `ConsoleExtensions.modules` | Existing `ConsoleModule` routes, menus, frames, UI permissions and backend capabilities |
+| `ConsoleExtensions.serviceOwners` | Optional owner UI selected by exact API version and kind; receives owner UID, verification and display flags |
+| Empty registry | No optional routes or code imports; generic owner display and service write protection remain active |
+
+The host keeps login, authenticated fetch, i18n, theme, QueryClient and route guards. Backend capabilities are keyed by backend name; registration does not grant backend permissions. No remote script loader or runtime configuration key is introduced. Extension sources are scanned by the existing Tailwind build and use the host lockfile and React dependencies.
+
+Public builds must remain independent of any private package or checkout. Private build source, images and artifacts belong in private storage; they must not be copied into the public working tree. Removing an extension does not remove service-side ownership or assignment protection.
+
+
+## Referenced model service actions
+
+| Relationship | Upgrade | Uninstall |
+|---|---|---|
+| Independent | Normal form, including separate autoscaling and SLO controls | Allowed |
+| Experiment-owned | Manage through the experiment | Blocked |
+| Verified referenced arm | Adaptive concurrency only | Blocked |
+| Verified referenced production | Model/configuration and scaling changes that preserve chart, release and declared route/Service binding | Blocked until released |
+| Unverifiable reference | Blocked | Blocked |
+
+Production upgrade plans compare the effective values after all stored layers,
+including YAML edits. Historical rollback is blocked while referenced because it
+can restore a different binding. Changing chart templates requires stopping the experiment
+because it can replace routing resources. These UI checks do not replace an
+admission policy for direct API or Kubernetes callers. The optional owner
+extension provides role-specific explanations; Swiss remains the metadata source.
+
+Autoscaling remains independent of SLO requirements. The deployment Resources
+section exposes scaler bounds or a fixed replica count; creating experiment arms
+uses fixed replicas. Turning off SLO does not implicitly disable autoscaling.

web/src/extensions/registry.ts

@@ -0,0 +1,3 @@
+import type { ConsoleExtensions } from "./types";
+
+export const extensions: ConsoleExtensions = { modules: [], serviceOwners: [] };

web/src/extensions/types.ts

@@ -0,0 +1,19 @@
+import type { ComponentType } from "react";
+import type { ConsoleModule } from "@/shell/module";
+
+import type { ServiceOwner } from "@swiss/lib/api";
+
+export interface ServiceOwnerProps {
+  owner: ServiceOwner;
+  compact?: boolean;
+  assigned?: boolean;
+}
+export interface ServiceOwnerExtension {
+  apiVersion: string;
+  kind: string;
+  component: ComponentType<ServiceOwnerProps>;
+}
+export interface ConsoleExtensions {
+  modules: ConsoleModule[];
+  serviceOwners: ServiceOwnerExtension[];
+}