The app framework built for the second change. And the fiftieth.
MAXSTACK describes your app as a typed source of truth — then derives the code, database, admin UI, forms, API, and MCP tools from it. AI proposes typed changes; you review; regeneration never clobbers what you own.
Start with one command.
The entrypoint is a single line. Node ≥ 22.7 and pnpm are the only prerequisites — no account, no vendor runtime. Run it, and you have a typed project with a live admin.
maxstack init ~/prj/app --desc "your app"
Scaffolds spec.json, config, a generated app/, and a durable runtime dir — anywhere on disk.
-
init
Scaffold the project
A typed
spec.jsonbecomes your one source of truth. Nothing to configure to get running. -
dev
Run it locally
The Sprout runtime serves
/admin, the review/workbench, and aPOST /mcpendpoint any agent can drive. -
evolve
Change it, safely
Add a field over the CLI or an agent, accept it in the workbench — it's live on the next request, and regeneration never clobbers what you own.
For the maintainer, not the prototyper.
Change-safety only has value to someone who keeps and evolves an app. The whole platform is built for the person making the 2nd, 10th, and 50th change — who needs each one to be safe.
"I want to give some high-level requirements and get an actual production-level app." — the original rant, generation 10
- 01A typed source of truth
Code, DB, admin UI, forms, docs, and tests all derive from validated, typed artifacts — Payload CMS, generalized to whole applications.
- 02AI at the framework level
Every project ships an MCP server and skills, so any agent already knows how to extend it — no bespoke integration.
- 03A living human-interaction model
Structured decisions, review-first, provenance on every artifact, safe change — not a chat that silently overwrites your code.
- 04Harnesses and evals
An instrumented factory measures how fast and correctly AI builds and changes apps, so improvement is evidence-driven, not vibes.
Prototype tools (v0 · Bolt · Lovable)
- Optimize first-generation wall-clock — a throwaway demo, fast
- A chat that regenerates and overwrites, black-box output
- The 10th change is a fresh prompt and a prayer
- Vendor runtime you can't fully own or eject from
MAXSTACK
- Optimizes the second change onward — the app you keep
- Typed spec-ops land suggested; nothing grounds until you accept
- Provenance + never-clobber make the 50th change as safe as the 1st
- Plain code on a standard stack — eject any file, own it forever
A single turborepo on the committed 2026 stack.
The stack is settled capital, carried across ten generations. Changing one piece is a decision record with a migration plan — never a fresh repo.
withMeta), and the page/UX layer (a typed template registry). Provenance flags, an append-only decision ledger, and typed spec-ops are in the base types from day one.withMeta table → get admin CRUD, forms, data tables, REST, validation, RBAC, and MCP tools. The app composes at runtime; ownership is a ladder of escape hatches so regeneration is safe by construction and most change never touches generated code.POST /mcp endpoint.forge eval runs spec → generate → change → validate headlessly and records the numbers that gate decisions — above all the change-expressibility ratio and regeneration-safety. Evidence, not assertion.Declare one table. Grow a whole admin surface.
A Drizzle column wrapped in withMeta is the seed. Sprout reads the metadata and derives the entire CRUD surface at runtime — no per-entity code, no scaffolding to maintain.
import { boolean, pgEnum, pgTable, text, uuid } from 'drizzle-orm/pg-core' import { withMeta } from '@maxstack/core' export const priorityEnum = pgEnum('priority', ['low', 'medium', 'high']) export const task = pgTable('task', { id: uuid('id').primaryKey().defaultRandom(), title: withMeta(text('title'), { label: 'Title', placeholder: 'What needs doing?', minLength: 1, maxLength: 200, required: true, }).notNull(), done: withMeta(boolean('done'), { label: 'Done' }) .notNull().default(false), priority: withMeta(priorityEnum('priority'), { label: 'Priority' }) .notNull().default('medium'), }) // that's the whole definition — no controllers, no forms.
Sprout derives, at runtime, from that one declaration ↓
List / detail / create / edit at /admin, no per-entity code.
Labels, placeholders, and constraints straight from the metadata.
Sortable, filterable columns derived from filterable flags.
Zod 4 schemas from min/max/required — client & server.
Resource endpoints with the same rules the forms enforce.
RBAC-gated per-resource CRUD tools — agents get them for free.
Add a field to the spec and it's writable on the very next request — no restart, no migration ceremony. Additive-only DDL means a change can't strand your data.
You don't wait for codegen to have a real app.
The /admin surface is grounded in your project's accepted spec. Accept a field in the workbench queue and it appears in the form on the next request — rows persist in on-disk Postgres. Generators land the route code later, on your schedule.
Always reach for the lowest rung that expresses the change.
Every change goes up an explicit ladder — cheaper rungs absorb more, and regeneration stays safe by construction. The weight is what the maintainer paid; the platform's job is to keep changes on the low rungs.
Spec-op most changes · zero hand-written code
Tell the agent "add a renewsOn date field to Subscription." It applies data.addField over MCP; the field appears in your review queue; you Accept; the admin form has it on the next request and every regeneration derives it everywhere.
Regen-as-diff spec touches generated files
regenerateAsDiff re-derives and returns a reviewable unified diff instead of overwriting. Protected files are surfaced, never proposed. The batch lands only if the validate gate passes.
Slot-fill custom UI inside a generated page
Generated pages render <Slot name="…"/> wired to a stable, user-owned *.slots.tsx file. The generator wrote the stub once and never touches it again — edit it freely. The generated file keeps regenerating; your slot survives byte-identical.
Eject you own the whole file, forever
Eject copies the generated file, strips the banner, and flips its ownership to ejected in the manifest. From then on regeneration never overwrites it — it's yours, plain code on a standard stack, including the responsibility to keep it current.
The invariants that make it safe: additive-only spec-ops + additive DDL · manual rows survive regeneration · generators ground only on accepted entities · the manifest-checked never-clobber writer. Every change ends with maxstack validate.
One typed spec, a handful of verbs.
A project is its own directory and lives anywhere on disk. The authoring verbs are standalone; dev borrows the runtime, build vendors it in.
Scaffold a project — spec.json, config, generated app/, durable runtime dir. --desc, --backend pglite.
Apply a typed, additive spec-op from the CLI — the same vocabulary agents use over MCP.
Regenerate the app tree from the accepted spec. Never-clobber: unchanged spec ⇒ all-unchanged output.
Install a feature bundle (auth, billing, …) through the validated spec-op path, with prerequisites.
Take whole-file ownership of a generated file. Ownership flips to ejected in the manifest.
The standalone gate: spec valid · manifest intact · regeneration safe. Trust nothing that hasn't passed it.
Run the app — /admin, /workbench, and POST /mcp on localhost:5173.
Structurally clone the workspace into .maxstack/runtime/ — a self-contained, vendored runtime.
Ship it — docker run or Fly, the owned slots executing in the built runtime.
Apply a bundle's versioned upgrade codemods to move to a newer release safely.
Run spec → generate → change → validate headlessly; record the metrics that gate decisions.
The Phase-0 scaffolder for a standalone repo — web-app | api | cli | library, agent skills included.
Standard features as tested, upgradeable bundles.
A bundle bundles runtime, its own eval artifacts, and prerequisites — installed through the exact validated spec-op path an agent uses. Versioned, with upgrade codemods. No copy-paste starter rot.
Auth
Sessions, sign-in, and the RBAC substrate every Sprout resource gates against — on better-auth + Postgres.
Billing
Tiers, subscriptions, and the pricing layer wired into the spec — pricing.addTier as a typed op.
Transactional email on React Email / Resend, templated from the same typed artifacts.
Members
Teams, invitations, and multi-tenant membership on top of the auth substrate.
Audit
An append-only audit_log — user, action, resource, metadata. Provenance as durable and diffable as the spec.
Admin metrics
A metrics dashboard over auth + audit. Entitlement-gated at runtime; prerequisites resolved topologically.
The north star is change-safety — and it's measured.
Time-to-Nth-safe-change: the effort and success rate of landing a change to an already-live app with the regeneration-safety suite still 100% green. This is the one number the whole platform exists to move.
| Change kind | Weight | What the maintainer did |
|---|---|---|
| spec op · apply-op | 1 | Expressed it as a typed op; platform generated it |
| spec op · regen-diff | 2 | Reviewed an agent-produced diff |
| slot fill | 3 | Wrote code into a cross-file extension slot |
| eject | 5 | Took whole-file ownership; pays the eject tax |
Cheaper = more absorbed. The ordering op < diff < slot < eject is the invariant — the moat, in cost terms.
weightPerSafeChange · taskly
─────────────────────────────
5 safe changes = 2.4
Two non-negotiable gates run every forge eval: determinism (same spec ⇒ byte-identical generation) and regeneration-safety (never-clobber + ownership-preserved, zero violations). A safety violation exits the nightly eval non-zero.
Built start-to-finish through the platform's own surfaces.
technews is a Hacker-News-shaped app assembled entirely through agent spec-ops, human review ops, and generators — then run standalone via maxstack build and deployed. An owned submit slot and a ranked front page execute in the built runtime. The full loop, reproducible:
Read the framework, not just the pitch.
Everything the maintainer needs — setup, the change ladder, the workbench, the metrics protocol, the deploy runbook.
User guide
Setup, first project, and making the 2nd → 50th change safely.
The ownership ladder
Spec-op → regen-diff → slot → eject, and the never-clobber invariants.
The Sprout engine
How withMeta derives admin, forms, REST, RBAC, and MCP tools.
Harness metrics
time-to-Nth-safe-change, change weights, and the determinism baseline.
Architecture
The five layers and the committed 2026 stack, top to bottom.
Command reference
Every verb — init, op, gen, add, eject, validate, dev, build, deploy.
Feature bundles
Auth, billing, email, members, audit, admin — install & upgrade.
The masterplan
The thesis, the ICP, the north star, and the standing bets.
Give high-level requirements.
Get a production-level app you keep.
Node ≥ 22.7 and pnpm. Scaffold a project anywhere on disk, evolve the spec with the CLI or any MCP agent, review in the workbench, and ship.
Framework before AI · Config first · No black boxes · No vendor lock-in