innovation register

{
  "id": "P10-I-001",
  "source_ids": [
    "P10-I-R-1",
    "P10-I-R-20",
    "P10-I-R-3",
    "P10-I-R-4"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Settings registry with hierarchy, schema and override provenance",
  "claim": "The one real mechanism P10 should build: a hierarchical settings tree (system to tenant to workspace to user) where every resolved value carries the level and principal that set it, and the schema generates its own UI, validation and API surface from one declaration.",
  "precedent": "No OSS settings-schema library exists; no commercial surface renders third-party settings in host chrome. Frappe DocType is the nearest conceptual relative and is whole-framework-bound. Every surveyed hierarchy has a combination rule and none exposes the resolution trace.",
  "limitations": "Greenfield with no precedent to de-risk it; this is the lane's biggest unknown and should be scoped deliberately rather than promised",
  "rank": 1,
  "disposition": "top10"
}

{
  "id": "P10-I-002",
  "source_ids": [
    "P10-I-R-1",
    "P10-I-R-2",
    "P10-I-R-21"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Navigation registry synthesizing Luigi's node schema with Backstage's contribution model",
  "claim": "Nodes with label, icon, route, ordering, owner and a permission predicate, contributed by modules rather than edited into the shell, resolved at runtime from a manifest rather than at build time.",
  "precedent": "Two proven halves, neither shipped standalone. Luigi documents ~45 node parameters with children typed array-or-function returning a Promise for async resolution, but has no contribution model. Backstage decentralizes contribution via attachTo app/nav and route refs, but a contribution outputs an opaque React element and auto-discovery is welded to its CLI and webpack.",
  "limitations": "Synthesis of two frameworks neither of which exposes its half as a consumable library",
  "rank": 2,
  "disposition": "top10"
}

{
  "id": "P10-I-003",
  "source_ids": [
    "P10-I-R-2"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Route-ref indirection so modules link without knowing paths",
  "claim": "Opaque route targets bound to concrete paths once at startup, letting modules link to each other without knowing any concrete path including their own, with bindings explicitly disableable.",
  "precedent": "Backstage createRouteRef, createExternalRouteRef with defaultTarget, createSubRouteRef, aliasFor, bindRoutes; useRouteRef returns undefined when a route is unavailable",
  "limitations": "Requires every module to adopt the indirection; a single hardcoded path defeats it locally",
  "rank": 3,
  "disposition": "top10"
}

{
  "id": "P10-I-004",
  "source_ids": [
    "P10-I-C-1",
    "P10-I-C-2"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Two-token exchange with sealed host claims as the only guest identity path",
  "claim": "The long-lived credential never leaves the host backend and never appears in a query parameter; a short-lived audience-bound single-use token crosses the boundary carrying entitlement and tenant facts as signed claims, so donors never query a host API and nothing can be forged.",
  "precedent": "Four independent commercial forms (Shopify App Bridge, Superblocks, Salesforce Canvas, monday.com) plus the local Ed25519 contract protocol-proven by executable spike. Wix is the negative control: signed instance as a query parameter with its own docs warning the plain-text instanceId is attacker-manipulable.",
  "limitations": "Requires a donor seam capable of accepting an assertion; a donor with no such seam falls back to absorption or exclusion",
  "rank": 4,
  "disposition": "top10"
}

{
  "id": "P10-I-005",
  "source_ids": [
    "P10-I-R-5",
    "P10-I-C-8"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Nav visibility predicate unified with the authorization check",
  "claim": "A nav node's visibility is the same evaluation as its route guard, so the two can never drift, with a debug view reporting which gate denied.",
  "precedent": "Luigi's visibleForFeatureToggles binds nav visibility to toggles; Backstage gates extensions by an if predicate over featureFlags and permissions. No vendor documents the which-gate-denied diagnostic.",
  "limitations": "Per-node policy evaluation per render needs batching or a decision cache, never divergence",
  "rank": 5,
  "disposition": "top10"
}

{
  "id": "P10-I-006",
  "source_ids": [
    "P10-I-C-7"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Cascading emptiness as a host guarantee",
  "claim": "An entitlement-stripped module takes its nav entry and any now-empty parent group with it, so absorption never leaves empty chrome behind.",
  "precedent": "Salesforce: hide every component in a tab and the tab goes; hide every tab and the Tabs component goes. The only surveyed surface supplying this.",
  "limitations": "Requires the host to own group membership, which conflicts with donor-authored nav sub-trees",
  "rank": 6,
  "disposition": "top10"
}

{
  "id": "P10-I-007",
  "source_ids": [
    "P10-I-C-5"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Explicit per-node settings combination mode",
  "claim": "Make the conflict rule a first-class field on each settings node with the safe mode as default, rather than a global convention.",
  "precedent": "Cerbos offers two selectable modes: OVERRIDE_PARENT versus REQUIRE_PARENTAL_CONSENT_FOR_ALLOWS where a child ALLOW only lands if the parent would also allow and a child DENY always wins. Descope resolves cross-tenant conflict to the most restrictive policy.",
  "limitations": "Per-node modes are more expressive and harder to reason about globally",
  "rank": 7,
  "disposition": "top10"
}

{
  "id": "P10-I-008",
  "source_ids": [
    "P10-I-C-9",
    "P10-I-C-10"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Absorption manifest declaring chrome suppression and route reconciliation",
  "claim": "The manifest names which donor header, sidebar and settings links are hidden, and the host publishes its prefix while the guest acknowledges its route table so deep links are validated before they break.",
  "precedent": "Universal constraint observed everywhere: the host owns the URL space, the guest owns its router, the guest must reconcile. Forge states the sidebar only changes the URL; Shopify's broken TitleBar links on direct URL visits are the same seam failing.",
  "limitations": "Suppression by manifest still requires a donor render tree that can be selectively hidden",
  "rank": 8,
  "disposition": "top10"
}

{
  "id": "P10-I-009",
  "source_ids": [
    "P10-I-C-6"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Structurally narrow-only role delegation",
  "claim": "A tenant-defined role is constrained by construction to a subset of its parent, rather than reviewed into compliance after the fact.",
  "precedent": "Cerbos role policies inherit parentRoles and are permitted only to narrow",
  "limitations": "Tenants wanting a genuinely new capability must escalate to the host, which is the point but also friction",
  "rank": 9,
  "disposition": "top10"
}

{
  "id": "P10-I-010",
  "source_ids": [
    "P10-I-R-22",
    "P10-I-R-6"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "One module declaration feeding both registries",
  "claim": "A settings schema declares which nav node surfaces it, so a new module's settings page appears in the right place with no host edit; the same manifest carries nav contributions and required permissions.",
  "precedent": "Luigi's userSettingsGroup ties a nav node to a named settings group, a rare existing case of navigation and settings sharing one declaration; Module Federation 2.0's Manifest is the metadata seam to extend with host semantics",
  "limitations": "Couples the two registries, so a schema change can move a nav entry unexpectedly",
  "rank": 10,
  "disposition": "top10"
}

{
  "id": "P10-I-011",
  "source_ids": [
    "P10-I-C-4"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Runtime nav registration rather than deploy-time only",
  "claim": "Donors are absorbed continuously, so registration must be possible at runtime.",
  "precedent": "Atlassian Connect is the only surveyed surface offering dynamic registration by REST rather than descriptor-only",
  "limitations": "Runtime registration widens the trust surface; contributions need validation",
  "rank": 11,
  "disposition": "register"
}

{
  "id": "P10-I-012",
  "source_ids": [
    "P10-I-C-3"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Schema-validated nav manifest at write time",
  "claim": "Validate the nav document on write, closing the silent-failure class.",
  "precedent": "ServiceNow stores nav as JSON on a UX Page Property and a String-typed property makes the side menu silently vanish",
  "limitations": "Validation catches shape, not intent",
  "rank": 12,
  "disposition": "register"
}

{
  "id": "P10-I-013",
  "source_ids": [
    "P10-I-C-16"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Absorption-time capability negotiation",
  "claim": "The donor declares which identity lanes it supports and the host selects one, instead of hand-porting every donor to a single lane.",
  "precedent": "SISOCRM ran both lanes a day apart; the five-shape table in the decision ledger formalizes the selection",
  "limitations": "Requires a per-donor capability declaration that does not exist upstream",
  "rank": 13,
  "disposition": "register"
}

{
  "id": "P10-I-014",
  "source_ids": [
    "P10-I-C-17"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Settings provenance exposed in the UI",
  "claim": "Show which scope supplied a value and which rule won, answering why is this value what it is.",
  "precedent": "Every surveyed hierarchy has a combination rule; none exposes the resolution trace",
  "limitations": "Folded into P10-I-001 as a property; listed separately because it is independently testable",
  "rank": 14,
  "disposition": "register"
}

{
  "id": "P10-I-015",
  "source_ids": [
    "P10-I-C-12"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Nested navigation beyond one flat level",
  "claim": "A real gap rather than a nicety: donors with genuine sub-hierarchies cannot be represented flat.",
  "precedent": "Shopify s-app-nav is one flat level with no nesting; Kinde supports two layers with N-layer on the roadmap; Luigi has children and category",
  "limitations": "Deep nesting harms discoverability, which is P08's concern",
  "rank": 15,
  "disposition": "register"
}

{
  "id": "P10-I-016",
  "source_ids": [
    "P10-I-R-13"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Nav and settings registry diffing as an upgrade gate",
  "claim": "A module upgrade surfaces exactly which nav entries and settings keys it adds, removes or renames.",
  "precedent": "No surveyed project does this",
  "limitations": "Requires stable identifiers across versions",
  "rank": 16,
  "disposition": "register"
}

{
  "id": "P10-I-017",
  "source_ids": [
    "P10-I-R-8"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Resolved settings as policy input",
  "claim": "Feed resolved settings into the policy engine as data so configuration and authorization share one evaluation path.",
  "precedent": "OPA and Cerbos both accept external data documents",
  "limitations": "Couples settings latency to authorization latency",
  "rank": 17,
  "disposition": "register"
}

{
  "id": "P10-I-018",
  "source_ids": [
    "P10-I-C-13"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Tenant-scoped identity isolation as an explicit switch",
  "claim": "Whether a user identity is shared across tenants or scoped to one must be a deliberate setting, not an assumed default in either direction.",
  "precedent": "Descope Tenant User Isolation; Stytch org-scoped passwords",
  "limitations": "Changing the setting later is a data migration",
  "rank": 18,
  "disposition": "register"
}

{
  "id": "P10-I-019",
  "source_ids": [
    "P10-I-C-15"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Record ephemeral guest membership",
  "claim": "Embedded guest users holding permissions only for a token's life and never appearing as members is an audit blind spot that must be recorded deliberately.",
  "precedent": "Superblocks embed users hold group permissions for the token life and never appear as members",
  "limitations": "Recording every ephemeral principal has storage cost",
  "rank": 19,
  "disposition": "register"
}

{
  "id": "P10-I-020",
  "source_ids": [
    "P10-I-R-15"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Headless identity with host-owned UI as default posture",
  "claim": "The host never surrenders its design system to an IdP's screens.",
  "precedent": "Ory Kratos leaves every screen to the host; Logto MPL-2.0 is the most absorbable multi-tenant IdP surveyed",
  "limitations": "Headless means building every auth screen, including the unglamorous recovery flows",
  "rank": 20,
  "disposition": "register"
}

{
  "id": "P10-I-021",
  "source_ids": [
    "P10-I-R-14"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Branding and provider inheritance as a settings subtree",
  "claim": "A tenant's theme, auth providers and login surface are one inheritable subtree rather than scattered configuration.",
  "precedent": "Casdoor organizations each own users, applications, providers and branding",
  "limitations": "Theming proper belongs to P07",
  "rank": 21,
  "disposition": "register"
}

{
  "id": "P10-I-022",
  "source_ids": [
    "P10-I-C-14"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Directory reconciliation from an events log with a replayable cursor",
  "claim": "Prefer a replayable event cursor over webhooks for directory sync.",
  "precedent": "WorkOS itself calls the events API more robust than webhooks",
  "limitations": "Requires the host to own cursor state and handle gaps",
  "rank": 22,
  "disposition": "register"
}

{
  "id": "P10-I-023",
  "source_ids": [
    "P10-I-C-11",
    "P10-I-R-11"
  ],
  "evidence_class": "observed",
  "observed": "2026-08-27",
  "title": "Progressive settings depth as a per-module property",
  "claim": "A donor exposes a curated subset by default and its full surface on request, with the schema carrying an audience level.",
  "precedent": "Microsoft 365 Simplified/Dashboard toggle switchable by the user rather than locked by permission",
  "limitations": "Two curated depths means two surfaces to maintain",
  "rank": 23,
  "disposition": "register"
}

{
  "id": "P10-I-024",
  "source_ids": [
    "P10-I-R-9",
    "P10-I-R-12",
    "P10-I-R-10",
    "P10-I-R-7"
  ],
  "evidence_class": "inferred",
  "observed": "2026-08-27",
  "title": "Mounting-layer refinements",
  "claim": "Extension slots as a permission surface rendering only contributions the principal may see; runtime enable/disable of mounted modules for staged rollout; session propagation across the microfrontend boundary as a defined contract; tenant-scoped nav trees driven by the tenancy model rather than branching in module code.",
  "precedent": "Piral slots and rollout capability; every surveyed shell framework conspicuously omits session propagation",
  "limitations": "Depends on the unresolved decision of whether to adopt a shell framework at all",
  "rank": 24,
  "disposition": "register"
}