Introduce a composable App Kit for Constructive applications

[yyyyaaa]

Summary

• add six independently installable App Kit capability roots for composing arbitrary Constructive applications: core, data, board, dashboard, calendar, and workflow
• provide server-safe typed resource/query/action definitions, fully partitioned AppScope query keys, schema reconciliation, controlled views, and connected wrappers
• add server-driven collections, record/form/relation surfaces, semantic board moves, TanStack Charts dashboards, localized calendar/agenda views, action dialogs, and a controlled stepper
• add the versioned meta.constructive registry contract, generated documentation/catalog inputs, and independent default/custom-alias install coverage
• add Event Studio as an opt-in reference starter; capability installs never include it by default

Architecture

App Kit is source-installed through the shadcn registry. It adds no @constructive-io/ui, Sheets, Console Kit, Recharts, or global Zustand dependency. Remote state uses TanStack Query; URL/controlled props own shareable state; local reducers own transient interaction state. Event Studio demonstrates one composition but is not an application template selected by default.

Verification

• pnpm check (455 Blocks tests plus workspace checks)
• registry generation: 123 items / 124 JSON artifacts
• real shadcn@latest 4.16.1 installs for all 13 capability/starter cases under default and custom aliases
• packed-consumer checks
• Pages production build and artifact validation: 84 routes, 19 previews, 124 registry files
• independent source review: no findings
• provisioned B2B tenant with seeded botanical-propagation schema, positive member mutations, destructive RLS denial, cross-organization isolation, and invalid-session denial

Fresh Terra-high app-building qualification against the frozen branch head and
live tenant reached discovery in 139,437 ms, root installation in 221,689 ms,
first tenant data in 785,010 ms, first successful action in 826,083 ms, and
negative authorization proof in 843,233 ms. The agent recorded a
production-build milestone at 950,393 ms, but its immutable evidence did not
independently prove the build, so that timing is not counted. The run is
excluded from the accepted-app metric because the
generated consumer stopped before candidacy with incomplete rendered-session
authorization proof, relation persistence/cleanup, overlay dismissal, and edit
coverage. Independent audit found genuine consumer/test gaps rather than an App
Kit product defect, so time-to-accepted-app is not claimed. The next-run prompt
and observer checks now
encode those generic lessons. Per the session delivery constraint, this PR stays
a draft.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	d3-scale@​4.0.2

View full report