feat(standards): codify codegen, ship generic Tier-B infra, add get_app_template + prompts; fix docs:// regressions

P0: fix doc:// -> docs:// across standards src/server/registry and regenerate stale mongo-ops bundle. P1: build recipe + spec-first routing now document the openapi-first codegen fast path (models/routes with --inject-request/--package). P4: CRUD template documents the model-vs-document id rule (BaseDocument owns id). P5: authless guidance (omit security keys). P6: template gains generic infra (http_cache, keyed SSE bus, KV port+in-memory+Redis), interfaces/openapi.py + .dockerignore + generic build test registered as components, and a get_app_template tool; genericity matrix marks LLM pool + human-in-loop as reference-app patterns. P7: intake/build/start_app/trial prompts. P8: template ships tests/integration/test_openapi_app_builds.py. Rebuilt standards + openapi-first bundles and re-collected.

standards/src/wiki/03_start_an_app.md

@@ -7,7 +7,7 @@ copying Tier B template components.
 
 > **Doc model:** this page is the human entry point. The deterministic,
 > machine-facing checklist lives in the reference page
-> [Build Recipe](../lib/01_build_recipe/), served as `doc://modules/build_recipe`.
+> [Build Recipe](../lib/01_build_recipe/), served as `docs://modules/build_recipe`.
 
 ---
 
@@ -20,7 +20,9 @@ Gather these before starting — the `start_app` MCP prompt asks for them:
    `openapi.yaml` if you already have it.
 3. **Axis 2 — pipelines.** Only if an input needs a multi-step transformation:
    the families and their input formats (or "none").
-4. **Auth needed now?** Default no; auth is deferred (`py-jwt` only).
+4. **Auth needed now?** Default **no**. Auth is deferred (`py-jwt` primitives
+   only), and an authless app is just a spec with no `security` keys — see
+   [Spec-First Routing → Authless apps](../lib/04_spec_first_routing/#authless-apps).
 5. **Integrations.** Mongo, ingestion formats, email, LLM provider.
 
 If you can state axes 1 and 2, the rest is mechanical.
@@ -31,13 +33,18 @@ If you can state axes 1 and 2, the rest is mechanical.
 
 From an MCP client connected to the `standards` server:
 
-1. Invoke the **`start_app`** prompt with no arguments to get the intake
-   questions.
-2. Answer them, then invoke
-   `start_app(app_name=..., resources=..., pipelines=..., auth=...)`.
-3. The prompt hands off to `doc://modules/build_recipe`; the agent pulls exact
-   files with `get_app_component(kind, resource=..., family=...)` and authors
-   only the app-specific parts.
+1. Invoke the **`intake`** prompt (or `start_app` with no arguments) to get the
+   intake questions.
+2. Answer them, then invoke **`build`**
+   (`build(app_name=..., resources=..., pipelines=..., auth=...)`), or use
+   **`start_app`** to intake-and-build in one call.
+3. The prompt hands off to `docs://modules/build_recipe`; the agent scaffolds
+   with `get_app_template()` and pulls exact files with
+   `get_app_component(kind, resource=..., family=...)`, authoring only the
+   app-specific parts.
+4. To validate the standard without touching a real app, invoke **`trial`**
+   (`trial(app_name=..., build_path=...)`) to build into a scratch directory,
+   prove it builds, and report findings.
 
 Manual alternative — copy the skeleton and follow the reference recipe:
 

standards/src/wiki/index.md

@@ -55,8 +55,8 @@ Registry](../lib/13_library_registry/).
 
 ## 🔗 Related Resources
 
-- **MCP bundle** — `standards` server on `:8009`: read `doc://index`,
-  `doc://nav`, `doc://modules/{module}`; call `find_library(capability)`
+- **MCP bundle** — `standards` server on `:8009`: read `docs://index`,
+  `docs://nav`, `docs://modules/{module}`; call `find_library(capability)`
 - **Library registry** — the catalog of internal libraries behind every app
   (`libraries.json`, served as `registry://libraries`)
 - **Template** — the runnable skeleton at `standards/src/templates/app/`