KYE Protocol™ · Partner Widgets™ · v1

Fourteen drop-in widgets, one authority surface.

Each widget below is a real iframe page and a real web component. Every action is purpose-bound, ledger-appended, revocable, and identifies itself to the natural person. Embed shape and postMessage protocol are locked by constitution/19-WIDGETS-EXPANDED.md.

The protocol

Every widget emits one of three message types: kye.widget.ready, kye.widget.action, kye.widget.revoke. The host MAY ACK with kye.widget.ack. See postmessage-protocol.md.
Every widget declares a required Purpose Permission. No widget renders an interactive control without a matching unrevoked grant.
Every widget renders the EU AI Act Art. 50 + GDPR Art. 13 identity strip in first paint. Stripping it is a CI failure.
Every widget targets a specific host origin in postMessage — wildcard targets fail the widget-postmessage-conformance gate.