Current synthesis from the research packet. Exact records and complete source artifacts remain visible below.
Define the host absorption contract and measure the real branding/auth/onboarding/settings/navigation delta on one mature donor.
[private local source withheld]architecture/feature-matrix/ARCHITECTURE.mdresearch/lovable-teardown-2026-08-26.mdA generator has no host contract, so identity and settings are re-invented per app and there is nowhere to stand when a client wants one login across several tools. Owning the host is also what makes absorbing a mature donor product possible at all, which is the move a pure generator has no equivalent for.
33 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | Shopify Admin + App Bridgeembedded-app-host | Shopify admin mounts third-party apps in an App Home iframe; the app declares its own left-sidebar nav via the <s-app-nav> web component with <s-link> children, and identity flows via an App Bridge ID token exchanged server-side for an access token. | observedtop10 | Source ↗ |
| — | Atlassian Forge (Jira/Confluence global page)embedded-app-host | Forge apps extend the host by declaring modules in manifest.yml that bind to named extension points; jira:globalPage places an item in the Apps section of Jira's main nav and can register a whole sidebar of pages or grouped sections. | observedtop10 | Source ↗ |
| — | WorkOSb2b-multi-tenant-idp | Organizations are the top-level tenant primitive; SSO connections and SCIM directories are configured per organization, with role mapping from IdP groups onto organization memberships. | observedtop10 | Source ↗ |
| — | Fronteggb2b-multi-tenant-idp | Ships an embeddable self-service Admin Portal plus a three-level tenancy hierarchy (Environment → Account → Sub-account), with entitlements gating which portal modules a given user can even see. | observedtop10 | Source ↗ |
| — | Cerbos / Cerbos Hubauthorization-service | Scoped policies give a root/platform policy layer plus per-tenant scopes, with an explicit mode that forbids a tenant scope from granting more than its parent allows — the cleanest published model of safe delegated policy authoring. | observedtop10 | Source ↗ |
| — | Superblocks (embedded apps)embedded-portal-platform | Cleanest documented host-to-guest token exchange: the host authenticates the user with its own auth, then mints a Superblocks session token server-side carrying tamper-proof custom claims. | observedtop10 | Source ↗ |
| — | monday.com apps frameworkembedded-app-host | Apps render as iframes inside monday views and get identity through seamless SDK authentication that works only inside the iframe; server-side calls use a signing-secret JWT carrying a 5-minute short-lived token. | observedregister | Source ↗ |
| — | Wix apps (iframe SDK + app instances)embedded-app-host | Wix passes iframes a signed `instance` query parameter identifying which user, which site and what role — and explicitly warns that a plain-text instanceId must not be trusted. | observedregister | Source ↗ |
| — | Salesforce Lightning + Canvasembedded-app-host | Canvas embeds third-party apps as tabs, links and buttons inside Salesforce, POSTing an encrypted signed_request containing user context and an access_token — the oldest mainstream host-absorption pattern still in production. | observedtop10 | Source ↗ |
| — | Clerkb2b-multi-tenant-idp | Application-level roles and permissions applied uniformly across all organizations, with an Active Organization carried in every session as the tenant-scoping key. | observedregister | Source ↗ |
| — | Auth0 / Okta Customer Identity Cloudb2b-multi-tenant-idp | Organizations map 1:1 to customer tenants inside a single Auth0 tenant that remains the root of trust, scaling to ~2 million organizations, with a My Organization API for in-app delegated administration. | observedregister | Source ↗ |
| — | Stytch B2Bb2b-multi-tenant-idp | Organizations and Members are both first-class API entities; email is unique WITHIN an organization, and a cross-org user is literally multiple Member records sharing an email. | observedregister | Source ↗ |
| — | Descopeb2b-multi-tenant-idp | Project → Tenants → Users, where users share ONE identity record across tenants by default but Tenant User Isolation can be switched on to give the same login ID separate credentials and MFA state per tenant. | observedtop10 | Source ↗ |
| — | Kindeb2b-multi-tenant-idp | Organizations within a Kinde business, backed by a single database with a schema per tenant, but explicitly limited to two hierarchy layers (organizations → users) with N-layer on the roadmap. | observedregister | Source ↗ |
| — | FusionAuthb2b-multi-tenant-idp | A Tenant is a discrete namespace for Users, Applications and Groups; uniqueness of email/username is scoped to the tenant, so the same email can exist repeatedly across tenants with different passwords. | observedregister | Source ↗ |
| — | PropelAuthb2b-multi-tenant-idp | B2B-only by design: organizations are first-class with custom roles definable globally OR per organization, plus SAML/OIDC, SCIM and org-scoped end-user API keys. | observedregister | Source ↗ |
| — | Oso Cloudauthorization-service | Authorization as a service that can answer questions using data read directly from the application's own databases, avoiding a separate data-sync pipeline into the authz service. | observedregister | Source ↗ |
| — | Permit.ioauthorization-service | Full-stack permissions as a service aimed at SaaS teams needing multi-tenant access control, role delegation and ADMIN-FACING permission UIs — the last of which is the distinguishing feature for a host layer. | observedregister | Source ↗ |
| — | AuthZed / SpiceDB Cloudauthorization-service | Most mature open-source Zanzibar implementation, used by OpenAI for ChatGPT Enterprise at tens of billions of permissions, with ZedTokens providing consistency guarantees. | observedregister | Source ↗ |
| — | LaunchDarklyfeature-flag-settings-platform | Environments are a top-level concept requiring flags and segments to be managed separately per environment; hierarchy is expressed through PREREQUISITE flags evaluated before any other targeting rule. | observedregister | Source ↗ |
| — | Statsigfeature-flag-settings-platform | Deliberately inverts LaunchDarkly's model — a centralized flag/config where environment-specific behavior lives INSIDE targeting rules rather than in duplicated per-environment flags. | observedregister | Source ↗ |
| — | ConfigCatfeature-flag-settings-platform | Multiple environments out of the box with separate flag configurations per environment; targeting by user attribute, percentage rollout and scheduled release, aimed at non-engineers changing config without a deploy. | observedrejected | Source ↗ |
| — | Retool (External Apps / Embed)embedded-portal-platform | Embeds full-stack portals for users OUTSIDE the organization into an existing application, passing data both ways through React and JavaScript SDKs, with white-labeling as the stated goal. | observedregister | Source ↗ |
| — | Budibaseembedded-portal-platform | A single self-hosted instance serves multiple apps, RBAC roles, SSO, automations and embeds from one builder UI — the cheapest route to a multi-app shell with SSO included. | inferredrejected | Source ↗ |
| — | ServiceNow UI Builder / Next Experienceembedded-portal-platform | Workspace side navigation and menu items are configured as structured data on a UX page property rather than authored as components — navigation as a stored configuration document. | observedtop10 | Source ↗ |
| — | Salesforce Lightning App Builder (composition)navigation-registry-precedent | Page composition with per-tab visibility filters, where emptiness cascades: hiding all components in a tab hides the tab, and hiding all tabs hides the whole Tabs component. | observedregister | Source ↗ |
| — | Atlassian Connect (legacy descriptor model)navigation-registry-precedent | Apps declare modules in a JSON app descriptor OR register some modules DYNAMICALLY via REST API — precedent for runtime nav registration rather than deploy-time-only manifests. | observedregister | Source ↗ |
| — | Microsoft 365 admin centersuite-unification | One console fronting Exchange, SharePoint, Teams and more, with a deliberate two-mode UI — Simplified view for common tasks and Dashboard view for the full surface, switchable from a top-level button. | observedregister | Source ↗ |
| — | Zoho Onesuite-unification | 45+ separately built apps unified behind one directory, one credential and one admin console — the closest commercial analogue to absorbing many donor apps under a single identity and shell. | observedregister | Source ↗ |
| — | HubSpotsuite-unification | Hierarchy is expressed through nested TEAMS rather than a formal org structure, with deliberately asymmetric visibility: parent teams see everything owned below them, but a nested team cannot see everything the parent owns. | observedregister | Source ↗ |
| — | Frontegg Entitlementsfeature-flag-settings-platform | Access requires BOTH the permission and the entitlement — a user holding the permission but lacking the feature is denied, making plan-tier and role two independent gates that must both pass. | observedtop10 | Source ↗ |
| — | Shopify token exchange grantembedded-app-host | Token exchange is available ONLY to embedded apps and removes redirects entirely, making authorization faster and preventing the load flicker that the redirect-based OAuth flow caused. | observedregister | Source ↗ |
| — | WorkOS + Cerbos composition patternauthorization-service | The prevailing commercial architecture is to compose a tenant/identity vendor with a separate policy engine rather than buying one product that does both — WorkOS supplies orgs, roles and directory data while Cerbos decides. | inferredregister | Source ↗ |
35 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | Keycloakself-hosted IdP | Full IAM server: OIDC/SAML, user federation, strong auth, fine-grained authz. 36.4k stars, Java, server distribution (not a library). | observedtop10 | Source ↗ |
| — | ZITADELself-hosted IdP | Identity infrastructure with SSO, MFA, passkeys, OIDC, SAML, SCIM and first-class multi-tenancy. 14.9k stars, Go. | observedregister | Source ↗ |
| — | Ory Kratosself-hosted IdP | Headless, API-first identity and user management in Go; no UI of its own, so the host owns all identity screens. 13.8k stars. | observedtop10 | Source ↗ |
| — | authentikself-hosted IdP | Self-hosted IdP for SSO across SAML, OAuth2/OIDC, LDAP and RADIUS. 25.2k stars, mixed Python/Go/TS. | observedregister | Source ↗ |
| — | Ory Hydraself-hosted IdP | OpenID-certified OAuth2/OIDC server that delegates user management to an external IdP. 17.5k stars, Go. | observedregister | Source ↗ |
| — | Ory Ketoauthorization engine | Zanzibar-model permission server with relation tuples, ACL/RBAC/ReBAC and the Ory Permission Language. 5.4k stars, Go. | observedregister | Source ↗ |
| — | Autheliaself-hosted IdP | SSO and MFA portal designed as a forward-auth companion to reverse proxies (nginx, Traefik, Caddy, Envoy), now also OpenID-certified. 28.7k stars, Go. | observedregister | Source ↗ |
| — | Casdoorself-hosted IdP | Self-hosted IAM with an explicit multi-tenancy model: independent organizations each owning users, applications, providers and branding. 14.3k stars, Go + React. | observedregister | Source ↗ |
| — | Better Authauth library | Framework-agnostic TypeScript auth framework with a plugin ecosystem covering 2FA, SSO and multi-tenancy. 29.7k stars. Auth.js has joined Better Auth and now points new projects here. | observedtop10 | Source ↗ |
| — | Auth.js (NextAuth.js)auth library | Web-standards auth for Next.js, Nuxt, SvelteKit, SolidJS and Remix; works with or without a database. 28.3k stars, TypeScript. | observedregister | Source ↗ |
| — | Luciaauth library | README states verbatim that Lucia was deprecated on March 2025; repositioned as a learning resource pointing at a single-file session implementation plus the maintainer's Auth Book. 10.5k stars. | observedrejected | Source ↗ |
| — | Open Policy Agentauthorization engine | CNCF-graduated (Feb 2021) general-purpose policy engine. Embeddable as a Go library, runnable as a sidecar/daemon, or compiled to WASM. 12.2k stars. | observedtop10 | Source ↗ |
| — | Cerbosauthorization engine | Stateless authorization PDP with YAML policy files; deploys as a Kubernetes service, sidecar, systemd unit or Lambda. 4.6k stars, Go. | observedregister | Source ↗ |
| — | SpiceDBauthorization engine | Most mature OSS Zanzibar implementation; adds caveated relationships combining ABAC with ReBAC. 7.0k stars, Go. Explicitly verified NOT BSL/source-available. | observedtop10 | Source ↗ |
| — | OpenFGAauthorization engine | CNCF project (community Slack under cncf), Zanzibar-inspired, in production behind Auth0 FGA since Dec 2021. Embeddable as a Go library or run as a service. 5.7k stars. | observedregister | Source ↗ |
| — | Casbinauthorization engine | Embedded authorization library (not a server) built on the PERM metamodel — Policy, Effect, Request, Matchers — so swapping ACL/RBAC/ABAC is a config change, not a code change. Includes RBAC with domains/tenants. 20.4k stars. | observedregister | Source ↗ |
| — | single-spamicrofrontend shell | Top-level router for microfrontends. Apps register via registerApplication(name, loadFn, activeWhen) and export bootstrap/mount/unmount lifecycle promises; the router mounts and unmounts on route change. 13.9k stars. | observedtop10 | Source ↗ |
| — | Module Federation 2.0microfrontend shell | Runtime code-sharing across JS applications. 2.0 adds a standalone Federation Runtime, a runtime plugin system, a Manifest describing federated modules, dynamic TypeScript type hinting and a Chrome devtool. Webpack and Rspack. 2.6k stars. | observedtop10 | Source ↗ |
| — | Piralmicrofrontend shell | App-shell framework where 'pilets' are runtime-loaded modules that extend other pilets or expose extension slots, can be rolled out or disabled dynamically, and are transferrable between host applications. 1.9k stars, TypeScript. | observedregister | Source ↗ |
| — | qiankunmicrofrontend shell | Microfrontend solution with a Proxy-membrane JS sandbox isolating window/document/timers/listeners per app, opt-in CSS @scope style isolation, and native ESM support. @qiankunjs/sandbox is publishable standalone to contain any third-party script. 16.7k stars. | observedregister | Source ↗ |
| — | Luigi (SAP)microfrontend shell | SAP's micro-frontend framework for admin UIs, split into Luigi Core (host, owns routing/navigation/authorization config) and Luigi Client (embedded in each MF), communicating over postMessage. 923 stars. | observedregister | Source ↗ |
| — | FrintJSmicrofrontend shell | Modular reactive JS framework for scalable apps. 757 stars. | observedrejected | Source ↗ |
| — | Backstageportal/workspace shell | CNCF Incubation-level developer-portal framework from Spotify, 34.3k stars. Plugin-first: every feature including the catalog is a plugin. Plugins export routable extensions bound via route refs so they link to each other without hardcoded paths. | observedtop10 | Source ↗ |
| — | Appsmithportal/workspace shell | Platform for admin panels, internal tools and dashboards, integrating 25+ databases and any API. 40.8k stars. | observedregister | Source ↗ |
| — | ToolJetportal/workspace shell | Low-code platform for internal tools, dashboards, workflows and AI agents. 40.8k stars, JS/TS. | observedregister | Source ↗ |
| — | Budibaseportal/workspace shell | Low-code platform for internal apps, automations and agents. 28.2k stars, Svelte builder + Koa server. | observedrejected | Source ↗ |
| — | NocoBaseportal/workspace shell | Microkernel no-code platform where everything is a plugin. 23.9k stars. | observedrejected | Source ↗ |
| — | Frappe Frameworkportal/workspace shell | Low-code full-stack framework (Python/MariaDB server, integrated client library) underlying ERPNext, with a built-in admin interface, role-based permissions, auto-generated REST API and customizable forms/views. 10.6k stars. | observedregister | Source ↗ |
| — | GrowthBooksettings/flags | Feature flags with advanced targeting, gradual rollouts and experiments, warehouse-native, 24 SDKs plus REST API and webhooks. 8.2k stars. | observedregister | Source ↗ |
| — | Unleashsettings/flags | Open-source feature management platform. 13.8k stars, TypeScript/Node. | observedregister | Source ↗ |
| — | Flagsmithsettings/flags | Open-source feature flagging and remote config service. 6.5k stars, Django/Python API + React frontend. | observedtop10 | Source ↗ |
| — | SuperTokensself-hosted IdP | Self-hostable auth service positioned as an open-source alternative to Auth0/Firebase Auth/Cognito, with prebuilt and custom UI recipes for email-password, passwordless, social and session management. 15,285 stars, Java core. | observedregister | Source ↗ |
| — | Logtoself-hosted IdP | Auth infrastructure for SaaS and AI apps built on OIDC and OAuth 2.1, with first-class multi-tenancy, prebuilt sign-in experience and a management API. 14,469 stars, TypeScript. | observedtop10 | Source ↗ |
| — | oauth2-proxyauth library | Reverse proxy that terminates authentication in front of an upstream app against Google, Azure, GitHub, generic OIDC and many other providers, injecting identity headers downstream. 14,878 stars, Go. | observedregister | Source ↗ |
| — | jose (panva)auth library | Zero-dependency implementation of JWA, JWS, JWE, JWT, JWK and JWKS running on Node.js, browsers, Cloudflare Workers, Deno and Bun. 7,768 stars, TypeScript. | observedregister | Source ↗ |
24 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| 1 | Settings registry with hierarchy, schema and override provenance— | The one real mechanism P10 should build: a hierarchical settings tree (system to tenant to workspace to user) where every resolved value carries the level and principal that set it, and the schema generates its own UI, validation and API surface from one declaration. | inferredtop10 | — |
| 2 | Navigation registry synthesizing Luigi's node schema with Backstage's contribution model— | Nodes with label, icon, route, ordering, owner and a permission predicate, contributed by modules rather than edited into the shell, resolved at runtime from a manifest rather than at build time. | observedtop10 | — |
| 3 | Route-ref indirection so modules link without knowing paths— | Opaque route targets bound to concrete paths once at startup, letting modules link to each other without knowing any concrete path including their own, with bindings explicitly disableable. | observedtop10 | — |
| 4 | Two-token exchange with sealed host claims as the only guest identity path— | The long-lived credential never leaves the host backend and never appears in a query parameter; a short-lived audience-bound single-use token crosses the boundary carrying entitlement and tenant facts as signed claims, so donors never query a host API and nothing can be forged. | observedtop10 | — |
| 5 | Nav visibility predicate unified with the authorization check— | A nav node's visibility is the same evaluation as its route guard, so the two can never drift, with a debug view reporting which gate denied. | inferredtop10 | — |
| 6 | Cascading emptiness as a host guarantee— | An entitlement-stripped module takes its nav entry and any now-empty parent group with it, so absorption never leaves empty chrome behind. | observedtop10 | — |
| 7 | Explicit per-node settings combination mode— | Make the conflict rule a first-class field on each settings node with the safe mode as default, rather than a global convention. | observedtop10 | — |
| 8 | Absorption manifest declaring chrome suppression and route reconciliation— | The manifest names which donor header, sidebar and settings links are hidden, and the host publishes its prefix while the guest acknowledges its route table so deep links are validated before they break. | inferredtop10 | — |
| 9 | Structurally narrow-only role delegation— | A tenant-defined role is constrained by construction to a subset of its parent, rather than reviewed into compliance after the fact. | observedtop10 | — |
| 10 | One module declaration feeding both registries— | A settings schema declares which nav node surfaces it, so a new module's settings page appears in the right place with no host edit; the same manifest carries nav contributions and required permissions. | observedtop10 | — |
| 11 | Runtime nav registration rather than deploy-time only— | Donors are absorbed continuously, so registration must be possible at runtime. | observedregister | — |
| 12 | Schema-validated nav manifest at write time— | Validate the nav document on write, closing the silent-failure class. | observedregister | — |
| 13 | Absorption-time capability negotiation— | The donor declares which identity lanes it supports and the host selects one, instead of hand-porting every donor to a single lane. | inferredregister | — |
| 14 | Settings provenance exposed in the UI— | Show which scope supplied a value and which rule won, answering why is this value what it is. | observedregister | — |
| 15 | Nested navigation beyond one flat level— | A real gap rather than a nicety: donors with genuine sub-hierarchies cannot be represented flat. | observedregister | — |
| 16 | Nav and settings registry diffing as an upgrade gate— | A module upgrade surfaces exactly which nav entries and settings keys it adds, removes or renames. | inferredregister | — |
| 17 | Resolved settings as policy input— | Feed resolved settings into the policy engine as data so configuration and authorization share one evaluation path. | inferredregister | — |
| 18 | Tenant-scoped identity isolation as an explicit switch— | Whether a user identity is shared across tenants or scoped to one must be a deliberate setting, not an assumed default in either direction. | observedregister | — |
| 19 | Record ephemeral guest membership— | Embedded guest users holding permissions only for a token's life and never appearing as members is an audit blind spot that must be recorded deliberately. | observedregister | — |
| 20 | Headless identity with host-owned UI as default posture— | The host never surrenders its design system to an IdP's screens. | observedregister | — |
| 21 | Branding and provider inheritance as a settings subtree— | A tenant's theme, auth providers and login surface are one inheritable subtree rather than scattered configuration. | observedregister | — |
| 22 | Directory reconciliation from an events log with a replayable cursor— | Prefer a replayable event cursor over webhooks for directory sync. | observedregister | — |
| 23 | Progressive settings depth as a per-module property— | A donor exposes a curated subset by default and its full surface on request, with the schema carrying an audience level. | observedregister | — |
| 24 | Mounting-layer refinements— | Extension slots as a permission surface rendering only contributions the principal may see; runtime enable/disable of mounted modules for staged rollout; session propagation across the microfrontend boundary as a defined contract; tenant-scoped nav trees driven by the tenancy model rather than branching in module code. | inferredregister | — |
9 mined records. Search and inspect the full agent output; nothing is collapsed into a top-ten headline.
| Rank | Identity | What the agent found | Evidence | Source |
|---|---|---|---|---|
| — | P10-S-001local-decision-record | A complete host-to-donor identity handoff contract, protocol-proven by an executable spike: host-signed Ed25519 token, 60-120s max lifetime, audience-bound per module, single-use jti consumed atomically, relative same-origin returnPath with absolute/protocol-relative/backslash/control-character rejection, typed adapter errors that never fall back to an anonymous donor home page, propagated logout with revocation checks for confidential records. Donor seams read from actual source for Twenty (community-side handoff avoiding the EE SSO guard), Documenso (signed sessionId cookie) and Frappe (LoginManager/sid). Context carries canonical user/workspace, module, correlation ID, canonical record IDs and capability hints; adapters keep explicit canonical-to-donor ID mapping because emails and display names are not durable foreign keys. | observedload-bearing | [private local source withheld] |
| — | P10-S-002local-decision-record | Reverses federation for owned-code donors: delete donor auth, substitute one host session, one database. Explicitly kills the Ed25519 launch tokens and six per-donor identity adapters. Plane remains host; infra remains service. | observedload-bearing | [private local source withheld] |
| — | P10-S-003local-decision-record | Federation-era runtime truth, dated: an embedded route is not an integrated product. Papermark, Documenso, Postiz, HRMS all had routes that existed while donor login blocked the experience. Names the real gap as identity, routing, provisioning, canonical record linkage and return navigation across donor boundaries, not more UI. Also records a navigation decision: ten labelled business pages plus global utility icons, with Settings given a full route outside the labelled hierarchy. | observedload-bearing | [private local source withheld] |
| — | P10-S-004local-decision-record | Ready-made host-absorption acceptance shape: donor UI renders inside the host shell with no login prompt, no donor signup/login route reachable, state survives restart, host and donor tables in one database, clean build from documented commands. | observedacceptance-shape | [private local source withheld] |
| — | P10-S-005local-synthesis | Typical donor adaptation enumerated: remove donor branding, replace donor onboarding, inject host identity, relocate settings into the Actionist shell, reconcile navigation, map terminology, bind tenant-aware data, scope CSS/tokens, narrow routes, decide which migrations and background services remain donor-owned. Cosmetic adaptation and boundary adaptation must be distinguished; replacing a logo is trivial, replacing authentication/settings ownership/migration authority is not. | observedgoverning | clients/actionmodel/knowledge/00-MASTER-SYNTHESIS.md |
| — | P10-S-006local-synthesis | A34 'the Actionist host can absorb donor identity/settings/navigation cleanly' is UNKNOWN with a host-contract pilot as its falsifier; A35 adapter-driven settings/onboarding/branding is a hypothesis; A15 the ISSO five-area shell is unproven; A06 most donors need some adaptation is observed/inferred. | observedgoverning | clients/actionmodel/knowledge/02-ASSUMPTION-LEDGER.md |
| — | P10-S-007local-framework | Factory loop from opportunity intake through research swarm, spec constitution, source-graph/template map, shell map, build waves, verification, launch and learning, with the ISSO five-area dashboard shell as default UX base. | observedgap-evidence | [private local source withheld] |
| — | P10-S-008this-run-packet | 33 commercial surfaces, 10 top10. Four named absorption patterns each observed in multiple independent surfaces (iframe+two-token exchange; nav manifest registration in deploy-time/runtime-component/stored-document variants; scoped settings tree with an explicit combination rule; two-gate entitlement-AND-permission visibility with cascading emptiness). Headline negative result: no observed surface renders a third party's settings inside host-owned chrome. | observedthis-run-evidence | clients/actionmodel/research/workstreams/p10-identity-settings-navigation/runs/2026-08-27-sprint-1-fable/top-companies.jsonl |
| — | P10-S-009this-run-packet | 31 OSS projects at first pass (backfill pending). Supply-gap map: authorization heavily oversupplied (five Apache-2.0 engines, four deployment shapes); identity oversupplied and licence-stratified; tenancy partial (org models inside IdPs, nothing for host-composed tenant workspaces); shell/mounting well supplied but semantically empty; navigation registry near-greenfield; settings registry greenfield with no OSS settings-schema library at all. NocoBase's Apache badge is misleading — LICENSE.txt is a custom agreement barring public no-code/low-code/AI SaaS. Auth.js has joined Better Auth and recommends it for new projects; Lucia is deprecated. | observedthis-run-evidence | clients/actionmodel/research/workstreams/p10-identity-settings-navigation/runs/2026-08-27-sprint-1-fable/top-repos.jsonl |
Source: site/system-map/data/parts.json#P10 · preserved research datasets remain inline below their source-backed synthesis.