Start with a capabilities based operating system, unlike phones and tablets with "permission management". This allows the user to decide exactly what resources

Start with a capabilities based operating system, unlike phones and tablets with "permission management". This allows the user to decide exactly what resources the "app" gets at runtime, and it doesn't get any others. At that point, it really can be whatever model you like, open source, or shareware, or closed source. If the operating system is doing it's job, then you can just run anything, and still be reasonably safe. At that point, an "app store" is really just a catalog with ratings, etc.