Skip to main content
BudsCollab apps are safely composable because they declare what they render, where they appear, what they can read or write, and how they move through preview, review, and registry. That declaration is built from primitives, not private host code. A package combines UI primitives, surface primitives, capability primitives, safety primitives, and distribution primitives into one validated artifact. The same primitive contract is used for widgets, full apps, plugin packages, Eve sandbox projects, and future registry submissions. The default lane is JSON-render UI:
  • the host renders allowlisted components;
  • actions use declared action ids;
  • capabilities are requested by name;
  • review reports record missing safety gates before install.
Custom code can still exist, but it is an escape hatch. It must declare the same primitive contract, then graduate through sandbox preview, isolated renderer boundaries, provenance checks, review evidence, and registry signing before it can become installable. This is the product promise: everything in BudsCollab can be composed because every package starts from the same atomic catalog and every stronger capability adds an explicit safety gate.