Actionist · software assembly operating system · blueprint 2026-09-03

Lovable generates every app from a blank prompt.
Actionist assembles from software that already works.

A client says what outcome they need. The system selects proven open-source capabilities from a curated shelf, composes them on a host that owns identity, data, theme and shell, verifies the whole workflow, and generates only the product-specific remainder. The model interprets and glues. Deterministic machinery owns everything that must be true.

system map · live component catalogue · live prompt → live URL demo · 47.5s mean
15moving parts, 74 declared dependencies
18domains, each with one canonical output contract
3,010sources on the capability shelf
80block slots in the hub, 248 candidate edges
389repos swept across 4 lanes
0of them appear in more than one lane
0blocks admitted to production. This page does not hide that.
01 · the bet

Four assets that compound. One pipeline that plans before it fills.

Actionist is not Lovable with a bigger repository corpus. It is an operating system for assembling software, with four things that get more valuable with every build.

1 · A demand graph

Industries, workflows, recurring solution atoms and product archetypes. 17 industries have been mapped; they compress to roughly ten B2B skeletons. You do not build seventeen stacks.

2 · A capability graph

Reusable systems, what each actually provides, where its seams are, and the correct reuse shape for it. 3,010 sources discovered; the graph is what turns discovery into something a planner can use.

3 · A host and composition framework

Standardises data, identity, connectors, UI and runtime at explicit seams, so a donor application can be absorbed whole and still behave as one product with one login and one theme.

4 · A production learning loop

Which compositions delivered which client outcome at what cost, fed back to the shelf. This is the asset a generator structurally cannot have: its thousandth app starts from the same blank context as its first.

Plan, then fill

interpret demandretrieve candidateseliminate incompatible setschoose among feasible plansgenerate bounded glueverify every binding and the whole workflow
deterministic   model

Who owns what

  1. Deterministic systems

    Identities, dependency graphs, schema validation, namespace conflicts, declared ports, tenant requirements, build and test execution, release manifests. If it must be true, a machine checks it.

  2. Models

    Interpreting ambiguous demand, understanding unfamiliar source architecture, proposing reuse shapes, mapping semantics, writing bounded transforms and glue, comparing trade-offs. Cheap models are an economic hypothesis to test once constraints make the problem small, not the architecture.

  3. Humans

    Product equivalence, reuse-shape calls, data-migration authority, irreversible surgery, admission and release. Five named decisions. Everything else is delegable.

02 · why the ground is empty

Everyone has built one column. Nobody has composed them.

A four-lane GitHub sweep, run to try to kill the thesis, returned 389 unique repositories, 181 of them permissively licensed. The finding is not any single repo. It is the shape of the result.

137

App builders

prompt-to-app, no-code, CRUD and dashboard generators

  • nocobase/nocobase23,841★ · other
  • dyad-sh/dyad21,318★ · other
  • getmaxun/maxun17,290★ · agpl-3.0
  • get-convex/chef4,602★ · apache-2.0
129

Component & template supply

registries, boilerplates, design tokens, multi-tenant starters

  • ixartz/Next-js-Boilerplate13,053★ · mit
  • coreui/coreui-free-react-admin-template4,950★ · mit
  • juicycleff/ultimate-backend2,903★ · mit
  • DesignRevision/shards-dashboard-react1,775★ · none
68

Extraction & deploy machinery

AST codemods, sandboxes, schema introspection, wildcard-subdomain deploy

  • nix-community/nix-init1,456★ · mpl-2.0
  • cycle/database71★ · mit
  • dkpro/dkpro-c4corpus54★ · apache-2.0
  • spiral-modules/database53★ · mit
55

Generative UI

LLM emits structured UI, framework renders from a registry

  • CopilotKit/CopilotKit37,037★ · mit
  • vercel-labs/json-render16,033★ · apache-2.0
  • tambo-ai/tambo11,167★ · mit
  • miurla/morphic9,062★ · apache-2.0
0

repositories appear in more than one lane. Not few. Zero, across 389. The app builders do not have a supply shelf. The supply shelves have no planner. The extraction tooling has never met the host. The generative-UI libraries render from a registry nobody is curating. The composition is unoccupied, and this is the strongest evidence in the programme that the bet is real, because it came from failing to find a counterexample.

Where prompt-to-app breaks, structurally

Each of these is an architectural property of generation-first builders, not a missing feature. Each maps to a part of the machine below.

03 · the machine

Five planes. Eighteen domains. Fifteen parts.

No domain owns another domain's truth. A product spec does not choose a database. A repository does not define requirements. A model does not grant authority or invent compatibility. Qualification evidence does not mutate a semantic interface. The contracts between domains are the framework; models operate inside them.

1

Demand

outcomes, industry ontology, product specification

D01–D03
2

Supply

discovery, capability mining, reuse-shape, extraction, thin contracts, registry

D04–D09
3

Composition

data, identity, connectors, UI, archetypes, planning

D10–D15
4

Runtime

host/isolation, verification and promotion

D16–D17
5

Learning

release, operations, economics, feedback

D18–D18

Eighteen domains, one canonical output each

IDDomainCanonical output
D01Outcome and demandOutcomeSpec
D02Industry / domain ontologyDomainPack
D03Product specificationProductSpec
D04Source intelligenceSourceCandidate
D05Capability miningCapabilityMap
D06Reuse shape and ownershipReuseDecision
D07Extraction and adaptationPackagedAsset
D08Thin capability contractCapabilityContract
D09Registry and resolutionRegistryRecord
D10Data planeDataResourceContract
D11Identity and authorityAuthorityContract
D12ConnectorsConnectorContract
D13UI and tasteDesignSystemContract
D14Archetypes and shellsArchetypeTemplate
D15Composition plannerAssemblyPlan
D16Runtime and hostHostContract
D17Verification and qualificationQualificationDossier
D18Release and learningReleaseManifest

The 15 parts and how they depend on each other

Hover or tap a part. Purple edges are what it depends on; mint edges are what depends on it. Dashed nodes are open; solid nodes are partially built. Every part page, thesis and open question exists on the system map.

DEMANDSUPPLYFOUNDRYEXPERIENCEHOSTASSEMBLYRUNTIMELEARNINGP01Client intelligenceand discoveryP02Outcome and productspecificationP03Curated capabilityshelfP04Autonomousrepo-to-block found…P05Living UI componentlayerP06Design taste andpreference learnerP07Token and themeharmonizerP08Archetypes, shellsand layoutsP09Data and stateplaneP10Identity, settingsand navigation hostP11Connector andexternal-action pla…P12Deterministiccomposition plannerP13Preview, editor andchange loopP14Runtime,verification and re…P15Continuous corpusand production lear…
openpartialdepends ondepended on by
04 · the unit of reuse

A block is not a repo. It is seven linked records and four independent statuses.

The original monolithic Block Contract was too large; it fused what a thing does with how it is proven and how it is shipped. It became seven thin, linked records. The original code stays as intact as its reuse shape permits. Actionist-specific identity, settings, navigation and data come from host contracts and adapters, never from forking the donor.

Seven records

  • capabilitywhat it does: semantic ports, config, compatibility
  • packaginghow it is built and shipped; the adaptation recipe
  • host-requirementswhat the host must provide: identity, data, secrets, routes
  • binding-planhow it is wired into a specific host and tenant
  • qualificationevidence it works, in a named host, with negatives
  • registryidentity, version, lifecycle, dependency graph
  • releaseexact recoverable release, rollback, operations

Eight reuse shapes

  • intact servicerun the donor whole behind the host; bridge identity and data
  • embedded modulemount the donor's UI inside the host shell (the AFFiNE path)
  • transplantlift one subsystem out and re-home it on host contracts
  • extracted packagepull a library-grade piece into a versioned package
  • adapterkeep the donor, write the seam
  • generated patternthe donor is a precedent; regenerate the pattern on host primitives
  • templatestart from the donor's skeleton, replace its guts
  • custom deltanothing reusable fits; write only the product-specific remainder

Default is absorb-and-own. Running a donor as an intact service behind an iframe is debt that needs written justification, not a shortcut.

A block is never simply "done". It has four ladders.

The decision unit is the tuple (source repository, capability, target context, host contract, reuse shape). Each axis advances independently, so "the source is reusable" and "it is proven in a named host" can never be confused again.

source reusability
  1. discovered
  2. source read
  3. reusable candidate
  4. rejected for capability
adaptation status
  1. unplanned
  2. surgery planned
  3. adapted
  4. upstream sync declared
proof status
  1. unexecuted
  2. partial local proof
  3. locally proven
  4. qualified for host
admission status
  1. not considered
  2. held for decision
  3. admitted for scope
  4. retired

The foundry: 11 stages from repository to production learning

  1. S0intake identitySourceRecord
  2. S1product bar capability mapCapabilityMap
  3. S2target contextTargetContext
  4. S3reuse shape decisionReuseDecision
  5. S4normalization surgery predictionSurgeryPlan
  6. S5linked module recordsSevenRecordModuleFamily
  7. S6deterministic compatibilityComposerVerdict
  8. S7bounded adaptationAdaptedBinding
  9. S8qualificationQualificationDossier
  10. S9scoped admission releaseReleaseManifest
  11. S10production learningAttributedLearningReceipt

The composer returns one of FEASIBLE, INFEASIBLE, UNDERDETERMINED. Only these five decisions are reserved for a human:

product equivalencereuse shapedata migration authorityirreversible surgeryadmission release
05 · the host socket, learned by doing

Three injections. The donor mounts whole. Blocks never talk to each other.

This is not theory. It was worked out by assimilating a 70-module knowledge workspace into a host shell and recording every commit that had to exist. The contract that fell out is small.

// everything the host injects — nothing is stripped from the donor
interface HostContext {
  identity: SignedIdentity;        // fails closed: client mismatch, expired, missing workspace, empty capabilities
  database: DataAdapter;           // host-owned authority, namespaced per block
  tokens:   Record<string,string>; // colours, fonts, request context
}
mount(div, ctx: HostContext, donorApp)  // the complete donor app, providers and router included

// data authority: one owner per table and migration, never two
{ postgresSchema: "knowledge", redisNamespace: "knowledge", blobs: "knowledge" }

The host owns four things, once

Shell and routes, one signed identity, the token map, the data plane. Blocks bring none of these. That is why donor login screens and marketing chrome come out.

Every block plugs into the same socket

Each nav item is a block. Each block gets a route, a schema namespace and the same identity. They sit side by side and never touch. Ten donors have run this way before.

Blocks talk through the host, never directly

A CRM row opening its documents goes as an intent to the host bus, which routes it to the other block's mount. Direct coupling is how you end up with four incompatible bridges.

The five seams every donor has to cross

A donor single-page app assumes it owns the page. Assimilation is removing that assumption five times. A manifest schema is bookkeeping; these are the actual problems.

1

Asset base

The donor assumes it owns /. Mounted under a host prefix, every lazy chunk 404s.

Post-process the donor's built output: rewrite the public path to a host-set global, re-resolve chunk URLs. Never patch donor source — a source patch is owed upstream forever; an artifact rewrite survives a version bump.

2

Network

The donor fetches /api and /graphql at its own origin.

A narrow request bridge wraps fetch, rewrites root-relative API calls to the host backend, attaches host request context, forces credentials. Everything else passes through untouched.

3

Workers

A web worker has its own global scope. Patching window.fetch does nothing there.

Inject a prelude into the worker bundle and rewrite its base URL directly. Any donor with worker-based sync or search will appear to work and silently fail its realtime path. Nobody predicts this one.

4

Routing

Two routers, one URL bar.

The manifest declares the split: host owns the global rail and the route, donor owns contextual navigation beneath it. Base path is configurable, defaulting to the capability's name.

5

Cold start

A heavy donor bundle behind a host route paints late.

Prewarm: fetch the donor's assets without executing the donor app, so the cost is paid before the user navigates.

Every terminal state, rendered.

Seventeen chrome guards were written from what people noticed while using the workspace. Nobody had rendered the error path embedded — and the error path has its own marketing nav, download button and sign-in fallback. It was found by clicking, after 44 commits. Now it is a mechanical step: grep the donor for chrome signatures, then render every terminal state (error, auth fallback, empty, offline) embedded, with screenshots proving zero donor chrome.

06 · demand and the hub

17 industries. Roughly ten skeletons. 80 block slots.

Industries differ in entities, vocabulary, authority and obligations. Their products mostly share skeletons: case and workflow management, client portals, CRM, finance operations, scheduling, inventory, support, field operations, learning and content. The counter-intuitive supply finding: generic dashboards and admin starters are abundant, so a dashboard is an easy demo and a weak test. Case-workflow and portal systems appear constantly in demand and have thin, clean supply. That is where the thesis is actually tested.

Industries mapped

accounting firmsconstructioncourse creatorsecommerceeducation traininghealthcare medical practiceshospitalityinsurance agenciesit services mspslaw firmslogistics freightmarketing social media agenciesmortgage brokersproperty managementreal estaterecruiting staffingsaas

The block hub: 80 capability slots, five layers by nine lifecycle stages

Each slot names a capability a business needs (workspace identity, roles, audit, files, workflow engine, connector catalogue, and so on), the layer it lives in, and the stage of a company's life it serves. 68 of the 80 slots already have ranked source candidates, 248 candidate edges in total. Recipes (Digital Business OS, SaaS OS, Ecommerce OS, Marketing Agency OS, Course Creator OS) compose slots into a whole operating system for a business type.

governoperateacquireactivateselldeliversupportretainmeasuretotal
platform415
engine313310
capability12126315
product438125638
surface6122112
total51092132359480
07 · honest state, 2026-09-03

The pipeline has never completed end to end. Here is exactly where it stops.

Every number on this page is re-derived from the estate's own machine-readable records at build time. A cynical reader should start here.

Discovered3,010start
Triaged69523% kept
Rated10315% kept
Forked22% kept
Built2100% kept
Qualified00% kept
Admitted0start

Real and measured

  • Prompt to clarifying questions to themed app to a live public URL: 5 distinct runs, mean 47.5s, range 37.7–66.5s, every URL still serving.
  • Host shell test suite green. Component catalogue live with full preview coverage. System map live with every published figure independently re-verified.
  • Two prototype blocks exist with all seven records authored: a knowledge workspace and a data grid. The workspace is embedded same-document with a 21-file build-artifact patch series.

Not real yet

  • Zero blocks qualified in a named host, zero admitted. Both prototype gates currently fail their own validators.
  • The host provides none of the 19 mechanisms the two blocks demand: no session broker, no tenant authority, no same-origin proxy, no secrets or database binding. It is a conformance fixture, not a host.
  • Of 16 foundry steps, 14 have no tool behind them yet. After the shape decision, the "factory" is an agent hand-writing the artifacts that decide whether a block is safe.
  • The demo loop is not connected to the blocks, the host, or a real database.

The diagnosis

  • The library thesis is right. The sequencing is wrong: the programme has been optimising the library before one database-connected app exists.
  • A knowledge workspace was the wrong first block for the commercial ask; it proves host handoff while dodging the database-backed operational requirement.
  • Governance has outrun product: the machinery proves, very carefully, that nothing is proven yet. That is worth something. It is not worth more than one working slice.
08 · the plan

Build the four host mechanisms, ship one real slice, then let the factory finish itself.

The critical path is not "qualify the workspace block". It is: give the data-grid block the host it needs, put one tenant-scoped dashboard on top using the demo loop that already works, and qualify the block against that host as the first admitted block. That single slice retires more risk than the whole shelf.

Phase 0Decideone sitting

Nine decisions, nothing else blocking them

  • Wedge: a partner dashboard on the client's own data, users and domain, not a hypothetical agency.
  • First composition: owned shell + data grid + typed host-data adapter + one real write action. The workspace block moves to wave 2.
  • Selection rule: rank by product and code quality; licence is metadata, zero weight at selection, resolved before release.
  • Component corpus: stays private; no bulk reconstruction (13 of 30 assembly-usable; bulk economics do not close).
  • Manifest v2: approve; the data-grid block fills its service evidence rather than waiving it.
  • Wave 1: data grid, then customer support, then knowledge workspace. Three, not thirty-five. The hub is a reference, not a queue.
  • Front door: regenerated only from the allowlist at the current source tip, with a commit-bound browser receipt, before any publication.
  • Model policy: keep "cheap, MiniMax-class inference" as the product hypothesis, separate from how the build agents are routed.
Phase 1Truthful gates2–3 days

Make every gate exit for the right reason

  • Restore the missing evidence-index row so the workspace block's smoke and validate pass; fix its tamper test so a modified README is refused.
  • Add the data grid's service evidence. All three block gates green before any other block work.
  • Correct the four stale surfaces that still say "no block implemented", "iframe", and the wrong agent-routing policy.
  • Merge the framework branch with semantic checks opt-in; record both blocks' semantic failures as open holds, not merge blockers.
Phase 2Four host mechanisms1–2 weeks · the real product work

What the data-grid block needs and the host does not have

  • Session broker (L): host session record plus a single-use assertion table keyed by jti with subject, tenant, workspace, audience, client, capabilities, expiry, revocation. Issue, exchange, read-back, revoke. Six negatives fail closed.
  • Tenant and workspace authority (M): role ∩ entitlement capability check; a host switcher that reissues context.
  • Same-origin proxy and session controller (L) in the data-grid fork. The signed-assertion verifier already exists; only the endpoint and live wiring are missing.
  • Secret references and Postgres/Redis binding (M) for the donor sidecar, behind the existing tunnel for the demo.
  • Defer the settings/nav registry, event bus and full deploy ops until Phase 3. The recipe shell is enough for one dashboard.
Phase 3The slice the client pays against3–5 days on top

One tenant-scoped dashboard, end to end, with a cost line

  • Reuse the demo spike (clarification loop, six-slot config, theme packs, publish), the subdomain deploy (Pages alias plus cold-curl gate) and the model eval (schema grading plus repair cap).
  • New: the model call goes through a real cheap-inference endpoint with a USD cost ledger; the rendered dashboard binds to a tenant-scoped database through the data grid via the Phase 2 broker; one real write action with a receipt; two-tenant denial and revoke replay proven in the browser.
  • Output: a phone-scannable URL and a cost per successful build. Not claimed: production DNS, a real client database, multi-tenant scale, cost at scale.
Phase 4Qualify by using the factoryongoing

Finish the foundry by pushing real donors through it

  • Data grid through its nine-step qualification list against the Phase 3 host as the named host. First admitted block.
  • Customer support as the service-shaped third proof. Every foundry step with no tool gets its tool written because this donor needed it. That is how the factory gets finished: by use, not by specification.
  • Knowledge workspace re-enters as wave 2 with the token bridge and two-identity browser probes.

Stop spending compute on

  • Shelf breadth. 3,010 is enough.
  • Value-matrix calibration and framework-registry maturity.
  • Fleet-execution, runtime-pack and control-plane lanes.
  • Any lane whose deliverable is a receipt about another receipt.

The only metrics that count from here

  • Host mechanisms provided: 0 → 4.
  • Block families passing: 3 → 9 on the data grid.
  • Time to first render on the real slice.
  • USD per successful build.
  • Admitted blocks: 0 → 1.
09 · why this is bigger than one client

Once the framework exists, compute converts repositories into product.

Action Model is the use case that justifies the build. The asset is the machine. Every stage of the foundry that is tooled is a stage an agent can run unattended; every admitted block is a capability any future product gets for free; every client engagement adds blocks, recipes and production evidence back to the shelf.

Discover

Agents sweep the open-source world against the demand graph. 3,010 sources are already shelved; millions are indexable.

Convert

The foundry reads architecture, picks a reuse shape, crosses the five seams, and emits the seven records. Human judgement only at the five named decisions.

Qualify

Every block is proven in a named host with negatives, or it is not a block. Admission stays separate from source status, forever.

Compose

A client outcome becomes a ProductSpec; the planner eliminates incompatible sets and picks a feasible plan; glue is bounded and verified.

Learn

Outcome, adaptation cost and incidents flow back to the shelf, so the next composition starts from evidence instead of a blank prompt.

The practical consequence: any business's stack becomes assemblable from qualified parts, industry by industry, on a shelf that gets sharper with use. A generator's moat is its model. This system's moat is everything the model is not allowed to decide.

10 · vocabulary

Four words that were used interchangeably, and are not the same thing.

source / repository
A container of code on the shelf. It has been discovered, maybe read. It is not yet anything Actionist can use.
capability
One thing a business needs done: roles and permissions, a workflow engine, a connector catalogue. A repository can yield several capabilities or none.
block
A capability packaged for the host: seven linked records, a chosen reuse shape, four status axes. A block is qualified when proven in a named host and admitted when released for a scope.
component
A UI building piece from the visual corpus. Selected, themed by the token harmoniser, never the unit of composition.
archetype / shell
An application-level workflow skeleton with industry variation points. Supplies structure so the model does not rederive it per build.
recipe
A composition of block slots into a whole operating system for one business type.
host
The thing that owns shell, identity, tokens and the data plane, and into which every block mounts through one socket.
reuse shape
The decision of how a source is reused: intact service, embedded module, transplant, extracted package, adapter, generated pattern, template or custom delta.
qualified vs admitted
Qualified: works in the exact tested host, with negatives. Admitted: released for a named scope. Source inspection, schemas, screenshots and prototypes qualify nothing.