key designs

The non-obvious, load-bearing design decisions, organized as seven pillar nodes (each a folder with its design pages as children). The through-line: StandMeet is becoming a pluggable platform — a thin kernel (底座) plus plugins — the OS framing of harness-is-the-os-of-the-intent-stack (kernel = constitutive, can't be eaten; plugins = userland). Vocabulary collisions are split in confusables.

The seven pillars

1. corpus — the asset: three-tier vault-isomorphic store, derived-path tree, backlink edge tables, retrieval (Meili lexical + corpus_links, both landed).
2. capabilities — the agent's hands: capreg exposure formula, externalized MCP servers, skills, as-MCP facade, ui:// cards.
3. connector — the credentialed edge: Hub, contracts, openapi/protocol kinds (installable connectors and sync-mode, both landed), egress guards.
4. monitor — call-time telemetry: the thinnest pillar (the system panel shipped 2026-09-04 — a5e1cada9, e3af33a1c, backend/internal/infra/selfstat/selfstat.go).
5. agent-core — the loop: eino, Bridge/Driver (landed), entry-agnostic, eval-as-consumer.
6. access-control — the valves: codes, frozen role snapshots, three-layer pure-AND ACL, BYOAI.
7. structure — the foundation & discipline: layering, one schema, error envelope, sandboxes, guardrails + judgment audit.

The outward face

• service-handle — StandMeet as MCP server (/mcp/*, Sigv1): the facade + UI–MCP parity (landed; the gap it found was 56, paid down to 0). Kept apart from capabilities on purpose — the two planes are the system's easiest confusion (confusables).

Cross-pillar designs

• embed-credential-never-carries-the-code — a per-embed Ed25519 JWT authenticates a widget session so the access code stays server-side (shipped 2026-09-01).
• microsites — owner-written React pages the instance builds and hosts at /p/<slug>/ (the homepage is the reserved home one): pointer-swap live/staging/rollback, a per-page isolated store, SDK widgets, per-page SEO, a code bound to a page (landed 2026-08-23 → 2026-09-07).
• product-owned-upgrade — the owner upgrades from inside the product: one substrate-blind signal file, an updater sidecar that recreates the stack in place, migrations applied at boot, release gates that ask the artifact (shipped 2026-08-28 → 2026-09-07).
• resume-composer-one-renderer — the résumé has one renderer: the Puck config draws the admin canvas and, via a 60 s one-shot print session and gotenberg, the PDF (Typst removed 2026-09-07, 1b1ebed2b).

Synthesis

• eight-controls-applied — StandMeet read as a control apparatus (the 8 controls, cross-pillar).