Clean up some network extension assumptions, flesh out private API.

merge soon