Publish the Flect product-adoption SDK and reference products

[robinbraemer]

Outcome

Let a product team adopt Flect incrementally through stable public contracts, ship a recommended interface, expose typed product capabilities to the agent, support user-controlled or product-provided inference, and preserve local user customization and protected recovery.

Product-quality coverage

FQ-05.2 through FQ-05.7, FQ-20.3 through FQ-20.5, and FQ-21.1 through FQ-21.8.

Dependencies

Consumes capsule, capability, product-adapter, extension, installation, and native-host contracts from #2, #3, #6, #7, #10, #12, and #26.

Required behavior

• Publish versioned Effect Schema contracts and small host adapters for product description, capabilities, authentication ownership, events, recommended interfaces, policy, compatibility, and inference options.
• Let the same Flect agent discover and use product capabilities through typed, bounded descriptions without exposing orchestration roles to users.
• Keep product policy and backend authorization authoritative after user approval and UI personalization.
• Store personal forks, workspace history, and grants with the user, not the product connection.
• Support browser-direct CORS-compatible products and an explicitly configured authenticated broker for other products without creating an unrestricted proxy.
• Provide migration and compatibility diagnostics across Flect, interface, and product revisions.
• Keep the running-interface, history, recovery, and capability UX identical to standalone Flect.

Acceptance criteria

• At least three structurally different reference products adopt Flect using only public contracts: a local/offline tool, a browser-direct API product, and an authenticated brokered product.
• Each ships a recommended interface, typed product capabilities usable by the same agent, an optional authoring integration, and a user-personalizable fork.
• Tests prove product denial beats user approval, credentials never enter user projects or models, and inference-provider choice does not alter product authorization.
• Product update, user fork, capability change, extension change, incompatible host, and offline states have deterministic UX.
• A person can select and edit the product's running interface through the same workflow as any other Flect project.
• A product can remove Flect integration without taking or corrupting user-owned exported work.
• Documentation starts from the smallest integration and does not require understanding Flect internals.

Non-goals

• Replacing product backends, databases, authorization, or business logic.
• Requiring every product to run inference.
• Granting product code control over the protected shell or agent host.
• Creating a second product-specific editing or review workflow.

[robinbraemer]

Implemented and verified the product-adoption SDK in the PR worktree (no commit, push, publish, release, or issue closure).

Evidence summary:

• @flect/product@0.1.0 with public root/contracts/host exports and exact effect@4.0.0-beta.102 peer.
• Packed clean-consumer artifact: flect-product-0.1.0.tgz, 47,976 bytes, SHA-256 24a7f45bbff90cb78c74a47525478c6c2c2fb285fad5e8cd1c2487a678e2629c.
• Three public-only references: offline board, browser GraphQL/events, and brokered incidents.
• Focused SDK proof: 24/24 across 8 files.
• Final complete gate: 707/707 Vitest (1 skipped), 66/66 production-Chromium, 21/21 Rust, ordinary Tauri app built.
• Installed ordinary app verified as one window with Pi ready and Local control off; source/install binary hashes match.
• Ad-hoc signature truth is explicit: codesign verification passes, Gatekeeper exit 3, stapler exit 65; this is local dogfood, not a public release.

Full frozen evidence: docs/verification/2026-08-03-product-sdk-verification.md.

[robinbraemer]

Pushed verification update — 2026-08-10

The pushed branch produces and verifies the five-export @flect/product package as a 63,559-byte tarball; clean-consumer and reference-product adoption suites pass. Registry publication and reference deployment remain intentionally undone because the current authorization covered the branch push, not publishing packages or deployments.

[robinbraemer]

Status audit: external gate. The issue-specific implemented boundary and exact remaining external authority are recorded in the open-issue audit; implementation evidence is PR #38 and hosted run 31401481772. This issue carries status:external-gate and must remain open until its documented credential, hardware, review, publication, or repository-policy evidence exists.