App Hub Architecture

App Hub incubators stay inside @prox-os/os-apps/platform for the app UI. The Shell only receives manifest entries and renderer mappings; it does not hardcode Hub UI.

Runtime Integration

• Manifest source: packages/apps/system-apps/src/apps/platform-suite/platform/manifests.ts
• Shell app id type: apps/os-shell/src/apps/types.ts
• Renderer map: apps/os-shell/src/apps/localAppComponents.tsx
• Icon map: packages/ui/os-ui/src/shell/ShellAppIcon.tsx
• Store catalog: packages/apps/system-apps/src/apps/core/app-store/data/appStoreCatalog.ts

Package Strategy

Phase 1 keeps the existing core packages:

• @prox-os/app-contract
• @prox-os/app-registry
• @prox-os/os-ui
• @prox-os/design-tokens
• @prox-os/os-apps

Phase 2 adds only two lightweight aggregation packages:

• @prox-os/connectors at packages/connectors
• @prox-os/embed-runtime at packages/embed-runtime

These packages intentionally contain types, mock data, and safe helper functions only. They do not own credentials, OAuth, provider SDKs, sync queues, backend APIs, iframe proxying, screenshot services, or user storage.

Live Center currently does not create a package. The future @prox-os/live-runtime boundary is documented in docs/platform/architecture/runtime/live-runtime.md, but the runtime should wait until real presence, room, multiplayer, collaboration, and visitor retention needs justify shared code.

Do not split these packages yet into:

• packages/permissions
• packages/url-intelligence
• packages/sync-engine
• packages/component-registry
• packages/app-manifest-tools

Splitting becomes reasonable only after at least two or three real connectors reuse the same permission model, a real sync engine exists, multiple apps share URL intelligence, a real component registry schema exists, or CI/docs/Storybook metadata needs a shared package.

Security Boundary

Connectors Hub must not store API keys or OAuth secrets. Launcher Hub must not proxy around CSP or X-Frame-Options. Design System Hub must not imply that mock recipes can automatically generate production apps. Live Center must not imply that realtime rooms, visitor tracking, raw IP collection, precise location, fingerprinting, or persisted activity logs are running.

Hub UIs should label early capabilities as Mocked, Planned, Read-only future, Write-back future, Privacy-first, or No real tracking when capability boundaries matter.