Extension points

• Custom schemes — a provider we do not ship, in config or in code.
• Swappable contracts — the replay guard, the clock, the registry.
• Events — observe every verification outcome without wrapping the middleware.