Architecture: the nine Vendo blocks and how they compose

Block	One job
`@vendoai/core`	shared shapes and seams
`@vendoai/store`	Postgres persistence
`@vendoai/agent`	conversation loop
`@vendoai/actions`	host and connector tools
`@vendoai/guard`	policy, approvals, grants, and audit
`@vendoai/apps`	user-owned app generation and runtime
`@vendoai/automations`	triggers and away runs
`@vendoai/ui`	headless hooks and optional chrome
`@vendoai/telemetry`	build and development telemetry

@vendoai/vendo composes the blocks and owns the public wire and CLI.

Dependency rule

core -> apps -> automations
store, agent, actions, guard, ui -> core only
vendo -> every block

Cross-block communication uses the seams in core: Guard, StoreAdapter, ActAs, SecretsProvider, AgentRunner, and ToolRegistry. The umbrella is the only package allowed to wire sibling implementations together. Every tool registry handed to agent, apps, and automations is guard-bound. The browser speaks only the umbrella’s HTTP wire. App machines speak back through the guarded tool proxy.

​Dependency rule

Dependency rule