What the SDK Adds on Top of Core

Core describes. The SDK operationalizes.

Core is the grammar for modular business apps: modules, artifacts and their metadata, declared in PHP. The SDK is the runtime that makes those declarations run like enterprise software — authorized, personalized, multi-tenant ready, and able to compose with other vendors' modules. Your work stays on your domain, not on the platform beneath it.

Seven pillars

Pillar	What you get	Stability
Identity, security & platform	Time-aware authorization from #[Access], #[Act], #[Read] and #[Role]: who may open an app, see a control, run an action or read a data set is resolved from grants at request time. Every grant resolves to a business partner, never to a bare user account.	Stable
Runtime & data	ui5:sync projects your declared metadata into a database catalog. OData reads come back scoped to the caller. Settings resolve along a scope ladder down to the individual user, and actors can hold their own values for the parameters your artifacts declare.	Stable
Interaction & dispatch	One typed, transactional write path — the action; OData stays read-only. Intents for navigation and dialogs. Impersonation that keeps the acting and the authenticated partner apart.	Stable
Shell & UI composition	The LeanShell around every app: navigation, search, dialogs and help. LUX Weave, through which modules from different vendors link into each other. Bases for dialogs and value helps. The Launchpad as every user's home.	Stable
Integration points	Where your app meets the outside world — login, tenancy, address validation, data export and code lists. You bind your own provider to the SDK's contract; no third-party dependency is forced on you.	Stable
Content & tooling	UUID-keyed, multi-locale help with full-text search, compiled at build time. Twelve ui5:* commands to sync, compile, inspect and explain.	Stable
Testing	A scenario DSL that proves your authorization model against a real database. No mocks.	Open by design

Stable means soft-freeze: validated in our own production applications, with every change additive and announced. Open by design means public, but deliberately reserved to evolve.

Apps that ship with the SDK

Three, and they are the fastest way to see what the rest of this page means. Every one of them runs on the same contracts your own apps use — there is nothing in them you could not have built.

Launchpad — the home every user lands on after signing in. It shows only what that user may open.

A host that ships two apps. The tiles an actor cannot open are not greyed out — they are absent.

Partners — organisations, persons and departments, their roles and relationships, and delegations for impersonation.

Master–detail over `sdk_partners`, with the object page's tab counts resolved per partner.

Settings — the console for scoped configuration.

The registry's own catalog, grouped by declaring artifact. **Editable** narrows it to what this actor may change.

And around all three, the same shell:

One navigation, one command palette, one help surface — which is what makes three apps read as one product.

Planned, not yet built

Arriving across 1.x, as customers need them: a SQL query layer, a reporting API, and an analytics API with live tiles and cards.

The split, in one sentence

Core gives you reflection-based metadata and stateless execution. The SDK gives you a database, a security engine, a shell, and the tooling to operate them in production.