System Modules
The machinery behind the Substrate, grouped by state ownership, public interface, lifecycle, and security boundary.
A module does not become a product primitive. It owns a coherent operational responsibility and exposes a bounded contract to the rest of the system.
App Runtime
Packages, manifests, UI/service/job workloads, Capsule containment, and App lifecycle.
External worldConnector Runtime
Trusted packages, Sources, integration lifecycle, scheduling, and the runner broker.
Secret custodyCredential
Desktop identity, external credentials, encrypted storage, and managed auth flows.
Data authorityAuthority & Guard
Principals, capability channels, permission policy, source injection, and atomic audit.
OperationsControl Plane
Core topology, system state, supervision, workspace switching, and failure handling.
Access surfacesInterfaces
Shell, System SDK, CLI, and Lamarck Skills over the same bounded system.
Ownership rule
Each piece of state has one canonical owner. A Connector may request a credential but does not manage the vault. An App may request a mutation but does not own database policy. The Shell may initiate lifecycle operations but does not become the control plane.