[ciaranmn]

The parties to the protocol (in this early form, with a web focus) are: 1) an application which is generating a web page, and 2) a block of functionality which is part of that page.

Or the authors of each.

Where is state?: blocks can have their own local state, but to persist data beyond the session should make use of the operations defined in the spec to pass data back to the application (the standardisation of what these operations are and what they do is a key part of the spec).

Where is the UI code?: I might've misunderstood this question, but - a block should have a package which contains code for rendering its UI and dealing with data to/from the application embedding it. The application can then either pull that code at runtime (e.g. from a CDN) when a user requests to use a certain block, or include it as a library and ship it with the application.