Phase 8.5 — App Builder Framework and SDKs

[b5463]

Part of Milestone E — Intelligence and Launch. Ref: #27

Implements the developer-facing integration framework defined in SYSTEMS_V4_APP_BUILDER_GUIDE_FIXED.md. Makes every product speak a common operational and commercial protocol without requiring shared databases or frameworks.

---

Alex tasks

Manifest and acceptance levels

• systems.app.json manifest schema definition (schema: systems.app.v4) with server-side validation tooling
• App acceptance level enforcement at deploy time:
  • Level 0 — Static/marketing: build command, static output dir, cacheable assets, health check, safe fallback
  • Level 1 — Managed web: Dockerfile or framework detection, PORT config, health endpoint, graceful shutdown, no root
  • Level 2 — Commercial: product metadata, analytics emission, entitlement-aware access, legal links, safe error states
  • Level 3 — Licensed/subscription: licence/entitlement integration, grace behaviour, offline behaviour, signed validation, local cache
  • Level 4 — External: integration key, heartbeat/release/error/analytics reporting, no admin credentials embedded
  • Level 5 — Fully native: everything above + preview/prod parity, typed events, versioned API contract, automated acceptance tests

Build and runtime enforcement

• Build detection and framework inference (Dockerfile, static output dir, supported frameworks)
• Health/ready/version endpoint contract enforcement at deploy time (GET /api/health, GET /api/ready, GET /api/version)
• Smoke test framework: run scripts/systems-smoke-test.* after deploy, gate release on result
• Runtime requirement enforcement: listen on 0.0.0.0, graceful SIGTERM shutdown, no root privilege, stdout/stderr logs
• Integration testing harness and 41-item acceptance checklist validation

SDKs (server-side)

• @systems/node — entitlement check, event batching, webhook verification, local cache, signature verification
• systems-python — same server-side responsibilities
• systems-cli — manifest validate, acceptance level check, smoke test runner

Compliance

• App-level data export/deletion workflows (GDPR per-app)

---

Tomas tasks

Dashboard

• App acceptance level display and certification status per system
• App monitoring and health aggregation dashboard (per acceptance level)
• Developer-facing integration status and manifest validation results UI

Browser SDK

• @systems/browser — public-client entitlement check (no secret keys), event emission

Documentation

• API reference generation
• Integration contract specification
• Developer guide per app type (hosted web, desktop/download, external, API-only)
• RUNBOOK.md template and requirements
• Common rejection reasons and troubleshooting guide

---

Exit gate

• Static app (Level 0) can be validated and deployed
• Managed web app (Level 1) passes acceptance check
• Commercial product (Level 2) emits analytics and has entitlement-aware access boundary
• Licensed product (Level 3) passes full acceptance checklist
• systems-cli validate correctly reports acceptance level gaps
• Browser SDK can check entitlements without exposing server secrets
• API reference is published and accurate

Rollback

Disable manifest enforcement. Deploy flow falls back to existing detection logic.