PowerCat-CodeAppsCompact 2.7 (lean)

Reuse working infrastructure; author domain rules, fixtures, views and independent assertions. Do not copy a previous benchmark app or hide repairs. Browser-local persistence is synthetic-demo storage, not production authorization.

Portable distribution with unchanged 2.7.0 runtime APIs. Keep this folder complete; scaffolding resolves bundled assets relative to the skill, with no repository checkout or runtime rebuild. Development sources, standalone examples, maintainer tests, generated API snapshots and benchmark-only tooling are omitted. API lookup reads the shipped declarations directly. The runtime package remains private; sharing this skill does not publish an app.

Choose once, then scaffold

For nested records, approvals, ledgers or atomic multi-record commands use --profile aggregate. Its neutral example already wires typed nested drafts, accessible fields/dialogs, errors, discard confirmation, duplicate-submit protection, stale revisions, cross-tab refresh, tables and CSV. Replace the neutral domain and tests, not that infrastructure. Read only aggregate authoring and api-reference.mjs aggregate-ui; consult the aggregate signature only for tables/storage/CSV. Do not rebuild form or persistence lifecycle in every app.

For flat CRUD use --definition <typed-folder> / the integrated workspace; read authoring. --profile minimal is a custom-shell escape hatch, not the default for a multi-module aggregate app. Use the catalog for other capabilities; do not dump all sources, signatures or maintainer tests into model context.

node "<skill>\scripts\create-app.mjs" "<new-app>" --name "Workspace" --local-only --profile aggregate --port 5173 --dry-run

Review, then omit --dry-run. For authorized authenticated hosting, replace --local-only with --environment <authorized-guid>. Never supply both or fabricate a tenant ID. Local-only scaffolds have an empty environment, no host/SDK-context request, and local verify/finalize defaults. The official SDK/plugin remain available for an explicitly authorized hosted scaffold. No command deploys.

Scaffolding never overwrites, installs, executes definitions or changes existing processes. Keep vendor assets and lockfiles project-local. Restore only after a manifest change or missing-dependency failure with approved npm and --install-links --ignore-scripts --strict-peer-deps --legacy-peer-deps=false --force=false --no-audit --no-fund. No denial or registry-policy bypass.

Verify without serial repair churn

Freeze the user's acceptance criteria before implementation. Use withBrowserScenarios with independent cases: fresh synthetic storage per scenario, one test-owned server, all independent failures returned together. Share one context only inside a multi-tab scenario. Assert meaningful persisted/domain outcomes; starter checks are not a business-app acceptance contract. Use visible labels, exact field names and a narrow dialog/table scope. Do not change criteria or discard legitimate failures to make a run pass.

After authorized startup confirm responsiveness. Run npm run verify:local -- --out <new-run>; repair the collected failures together, then --resume <run>. Under the bundled build contract, a browser-entry-only edit reuses a matching build; lint, unit and browser coverage remain conservative. Source/configuration/dependency changes invalidate relevant evidence. Never rerun toolkit-maintainer tests per app. Do not repeatedly restore dependencies or read entire logs when a scoped failure report is sufficient.

Authenticated scope requires the actually authorized Mesh/CDP route and fresh scoped host evidence; see host verification only then. Localhost is never authenticated Local Play. Permission denials are final, not fallback triggers.

Meter and finish once

When costs are requested, retain the original start and repair-inclusive phase markers as explicit-zone ISO timestamps. Use observed per-call usage, not source size or estimated tokens. Finalize once with npm run finalize:local -- --resume <run> --events <authorized-stream> --phases <original-markers> --usd-per-credit <explicit-rate>; hosted scope uses finalize and its fresh receipt. Missing usage/pricing is unavailable, not zero. Use the finalizer's outcome, cutoff and table directly; no reporting-only accounting loops. Later calls/replies are outside the stated completed-call cutoff.

Report passed, failed and unverified scope honestly. Savings require matched repeated builds; a smaller source tree, repaired infrastructure or different cache mix does not prove a USD reduction. This 2.7 lean distribution is not an upstream release. Skill installation, dependency installation and publishing require their own authorization.

2.7 aggregate view defaults

Reuse DetailTable, MetricGrid and Calendar before authoring equivalent related-record tables, metric cards or UTC schedules. They ship with phone layout, labelled tables and correct heading levels. Use FormSelect for identity/persona controls, not a bespoke label wrapped around options. Keep shipped aggregate hover/active colors together. DataTable resets on schema/drill-down changes without remounting parent drafts. Read aggregate.md for these contracts; business rules and independent acceptance remain app-owned. These general-purpose views contain no application-specific fixtures or workflows.