Loft
A layered mini-app platform with a built-in runtime and creator studio
Loft is a full-stack mini-app ecosystem — a web creator studio, a mobile host shell, and an SDK that gives makers one command to build, scan, and ship. Each version of the platform is produced by running the next layer spec: v0.1 laid foundation identity and design tokens; v0.5 shipped Backing, Feed, Discovery, and Notifications on top of a live AI copilot, a 5-step Ship ritual, and a fully isolated capability-brokered JS runtime.
Challenge
Mini-apps need real system trust — access to storage, location, and the network — without handing the vendor key to every maker or exposing users to silent capability creep.
Solution
A default-deny capability broker runs every mini-app in isolated JS with plain-language consent UX. The real key never reaches the app; undeclared capabilities are structurally impossible. An AI copilot in the studio surfaces capability requirements as you type and flags policy violations before the scan gate.