Each layer depends only on the layer above it; the protocol itself depends on nothing but mathematics. If the applications, the SDK, and the organization all disappear, a capsule plus these documents plus a beacon signature plus the password still opens.
Wire format, invariants, threat model, governance. Owns nothing runnable — implementable by anyone from the documents alone (RFC-0009 §6). Ten RFCs and three normative wire specifications, currently in public Last Call.
Replaceable: a conforming capsule opens with any conforming opener. Two independent implementations exist today — TypeScript (reference) and Rust (written from the documents alone) — and CI asserts they produce byte-identical containers.
Web app, Windows desktop app, CLI, and a self-contained offline decryptor. No application may be required for opening or verifying a capsule — the decryptor inlines every dependency and carries its own self-test vectors.
A capsule outlives every layer below the protocol. This is not aspiration — it's why the protocol documents, not any of our software, are the object of the Last Call review.