{"schemaVersion":"pre.page.v1","id":"security","route":"/security","meta":{"title":"Security","description":"Account isolation, authority boundaries, protocol safety, content safety, and procedural respect.","navLabel":"Security","order":40,"nav":false,"navGroup":"Explore","discoverable":true,"eyebrow":"Trust boundaries","status":"canonical","theme":"main","visibility":"public"},"source":{"kind":"filesystem","ref":"SECURITY.md","digest":"0dec3531b4cf841cc629e4b4b85d11475781baa08ee021966b79509ba0b6058f"},"navigation":{"items":[{"route":"/","label":"Main","order":0,"placement":"primary","group":""},{"route":"/context","label":"Context","order":10,"placement":"primary","group":""},{"route":"/vision","label":"Vision","order":15,"placement":"secondary","group":"Explore"},{"route":"/principles","label":"Principles","order":20,"placement":"primary","group":""},{"route":"/architecture","label":"Architecture","order":30,"placement":"primary","group":""},{"route":"/ontology","label":"Ontology","order":32,"placement":"secondary","group":"Explore"},{"route":"/protocol","label":"Protocol","order":35,"placement":"secondary","group":"Explore"},{"route":"/security","label":"Security","order":40,"placement":"secondary","group":"Explore"},{"route":"/roadmap","label":"Roadmap","order":45,"placement":"primary","group":""},{"route":"/status","label":"Status","order":50,"placement":"primary","group":""},{"route":"/projects","label":"Projects","order":60,"placement":"secondary","group":"Reference"},{"route":"/decisions","label":"Decisions","order":65,"placement":"secondary","group":"Reference"},{"route":"/learnings","label":"Learnings","order":68,"placement":"secondary","group":"Reference"},{"route":"/glossary","label":"Glossary","order":70,"placement":"secondary","group":"Reference"},{"route":"/sources","label":"Sources","order":90,"placement":"secondary","group":"Reference"}],"outline":[{"id":"primary-rule","label":"Primary rule","level":2},{"id":"account-resolution-and-isolation","label":"Account resolution and isolation","level":2},{"id":"identity-and-authority","label":"Identity and authority","level":2},{"id":"immutable-grants-and-revocation","label":"Immutable grants and revocation","level":2},{"id":"delegation-only-attenuates","label":"Delegation only attenuates","level":2},{"id":"risk-and-field-boundaries","label":"Risk and field boundaries","level":2},{"id":"idempotency-and-incomplete-execution","label":"Idempotency and incomplete execution","level":2},{"id":"evidence-and-verification","label":"Evidence and verification","level":2},{"id":"external-systems-and-succession","label":"External systems and succession","level":2},{"id":"billing-and-entitlement-boundaries","label":"Billing and entitlement boundaries","level":2},{"id":"content-is-untrusted-input","label":"Content is untrusted input","level":2},{"id":"public-and-private-projections","label":"Public and private projections","level":2},{"id":"local-capability-boundary","label":"Local capability boundary","level":2},{"id":"preservation-without-surveillance","label":"Preservation without surveillance","level":2},{"id":"procedural-respect","label":"Procedural respect","level":2}]},"presentation":{"theme":"main","classes":{"page":"min-h-screen bg-[#f6f4ee] text-[#20251f]","header":"sticky top-0 z-20 border-b border-[#d8d6cd] bg-[#f6f4ee]/95 backdrop-blur","headerInner":"mx-auto flex w-full max-w-6xl items-center justify-between gap-6 px-5 py-4 sm:px-8 lg:px-10","brand":"flex shrink-0 items-baseline gap-2 text-sm font-semibold tracking-[-0.02em] text-[#20251f]","brandMark":"font-mono text-[0.66rem] font-medium uppercase tracking-[0.22em] text-[#737c72]","nav":"flex max-w-full gap-1 overflow-x-auto pb-1 text-sm [scrollbar-width:none] [&::-webkit-scrollbar]:hidden","navLink":"whitespace-nowrap rounded-full px-3 py-1.5 text-[#667066] transition-colors hover:bg-[#e9e7df] hover:text-[#20251f] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[#556255]","navLinkActive":"bg-[#20251f] text-[#f6f4ee] hover:bg-[#20251f] hover:text-[#f6f4ee]","shell":"mx-auto w-full max-w-6xl px-5 sm:px-8 lg:px-10","main":"grid gap-10 py-12 lg:grid-cols-[minmax(0,1fr)_14rem] lg:py-16","article":"min-w-0","aside":"hidden lg:block","eyebrow":"font-mono text-xs font-medium uppercase tracking-[0.2em] text-[#768075]","title":"mt-4 max-w-4xl text-balance text-4xl font-medium leading-[1.04] tracking-[-0.045em] text-[#172018] sm:text-6xl","description":"mt-5 max-w-3xl text-pretty text-lg leading-8 text-[#586157] sm:text-xl","statusRow":"mt-7 flex flex-wrap gap-2","badge":"rounded-full border border-[#cfd2c9] bg-[#ebece6] px-3 py-1 font-mono text-[0.68rem] uppercase tracking-[0.12em] text-[#5d665c]","body":"mt-12 max-w-3xl","heading1":"mt-12 scroll-mt-28 text-3xl font-medium leading-tight tracking-[-0.035em] text-[#20251f]","heading2":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]","heading3":"mt-9 scroll-mt-28 text-xl font-semibold leading-tight tracking-[-0.015em] text-[#293229]","heading4":"mt-8 scroll-mt-28 text-lg font-semibold text-[#293229]","heading5":"mt-8 scroll-mt-28 text-base font-semibold uppercase tracking-[0.08em] text-[#4d574d]","heading6":"mt-8 scroll-mt-28 text-sm font-semibold uppercase tracking-[0.12em] text-[#5d675c]","paragraph":"mt-5 text-[1.04rem] leading-8 text-[#404940]","unorderedList":"mt-5 list-disc space-y-2 pl-6 text-[1.02rem] leading-7 text-[#404940] marker:text-[#879184]","orderedList":"mt-5 list-decimal space-y-2 pl-6 text-[1.02rem] leading-7 text-[#404940] marker:font-mono marker:text-[#737c72]","quote":"my-8 border-l-2 border-[#879184] pl-5 text-xl leading-8 text-[#2e382f]","code":"my-7 overflow-x-auto rounded-2xl border border-[#303a31] bg-[#20251f] p-5 font-mono text-sm leading-6 text-[#eef1e9] shadow-sm","divider":"my-10 border-0 border-t border-[#d8d6cd]","inlineLink":"font-medium text-[#284f36] underline decoration-[#9dab9a] decoration-1 underline-offset-4 transition-colors hover:text-[#173421] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[#556255]","inlineCode":"rounded bg-[#e8e7df] px-1.5 py-0.5 font-mono text-[0.88em] text-[#2d372e]","inlineStrong":"font-semibold text-[#263027]","inlineEmphasis":"italic","tocTitle":"font-mono text-[0.68rem] font-semibold uppercase tracking-[0.16em] text-[#788078]","tocList":"mt-4 space-y-2 border-l border-[#d8d6cd] pl-4","tocLink":"block text-sm leading-5 text-[#697269] transition-colors hover:text-[#20251f] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[#556255]","tocSticky":"sticky top-28","tocChild":"pl-3","secondaryNav":"mt-16 grid gap-8 border-t border-[#d8d6cd] pt-7 sm:grid-cols-2","secondaryNavGroup":"min-w-0","secondaryNavTitle":"font-mono text-[0.68rem] font-semibold uppercase tracking-[0.16em] text-[#788078]","secondaryNavList":"mt-3 flex flex-wrap gap-x-4 gap-y-2","secondaryNavLink":"text-sm leading-5 text-[#697269] transition-colors hover:text-[#20251f] focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-[#556255]","footer":"mt-10 border-t border-[#d8d6cd] pt-5 text-xs leading-5 text-[#737c72]","footerCode":"font-mono text-[0.68rem] text-[#5e675e]"}},"blocks":[{"id":"block-1","type":"heading","level":2,"anchor":"primary-rule","content":[{"type":"text","value":"Primary rule"}],"plainText":"Primary rule","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-2","type":"paragraph","content":[{"type":"text","value":"Everything may be addressable. Only explicit resolved authority permits a consequential transition."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-3","type":"heading","level":2,"anchor":"account-resolution-and-isolation","content":[{"type":"text","value":"Account resolution and isolation"}],"plainText":"Account resolution and isolation","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-4","type":"paragraph","content":[{"type":"text","value":"A Pre Account is a custody and authorization boundary. Every customer, family, or organization read or mutation must resolve account scope before account-owned repository access."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-5","type":"paragraph","content":[{"type":"text","value":"A trusted account request boundary follows this order:"}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-6","type":"code","language":"text","value":"normalize host or explicit account reference\n  -> resolve an admitted external binding\n  -> authenticate the acting identity\n  -> resolve account membership, context grants, and capabilities\n  -> classify action and field risk\n  -> query or mutate only the resolved account scope","className":"my-7 overflow-x-auto rounded-2xl border border-[#303a31] bg-[#20251f] p-5 font-mono text-sm leading-6 text-[#eef1e9] shadow-sm"},{"id":"block-7","type":"paragraph","content":[{"type":"text","value":"Security rules:"}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-8","type":"list","ordered":false,"items":[[{"type":"text","value":"A "},{"type":"code","value":"*.pre.bi"},{"type":"text","value":" hostname, custom domain, slug, path, query parameter, cookie field, or request header is not authority."}],[{"type":"text","value":"Client-supplied account IDs and account headers are untrusted lookup hints and must not override trusted host and session resolution."}],[{"type":"text","value":"Every storage query, cache key, background job, protocol query, export, and artifact retrieval must carry an admitted account scope once multi-account operation begins."}],[{"type":"text","value":"Unknown, missing, conflicting, suspended, or unauthorized account bindings fail closed."}],[{"type":"text","value":"Cross-account reads and actions require explicit bounded grants or capabilities; shared people and relationships do not merge custody boundaries."}],[{"type":"text","value":"Public projections are field allowlists from one resolved account, not a weaker authentication mode for the whole store."}],[{"type":"text","value":"Account export, restore, deletion, domain change, and succession are consequential operations with explicit evidence and receipts."}],[{"type":"text","value":"A shared wildcard application is not acceptable until tenant isolation, normalized persistence, account-scoped queries, backup, and restore are tested."}]],"className":"mt-5 list-disc space-y-2 pl-6 text-[1.02rem] leading-7 text-[#404940] marker:text-[#879184]"},{"id":"block-9","type":"paragraph","content":[{"type":"text","value":"During early manual provisioning, unrelated real accounts should use isolated stores or data boundaries rather than share HARnest's inherited whole-ledger checkpoint."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-10","type":"heading","level":2,"anchor":"identity-and-authority","content":[{"type":"text","value":"Identity and authority"}],"plainText":"Identity and authority","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-11","type":"list","ordered":false,"items":[[{"type":"text","value":"Identity is resolved by trusted server or controller boundaries."}],[{"type":"text","value":"Client-supplied participant IDs, account IDs, roles, permissions, approval states, evidence verdicts, completion states, risk labels, context references, and "},{"type":"code","value":"claimedAuthority"},{"type":"text","value":" references are not authoritative."}],[{"type":"text","value":"A Pre address identifies or names a referent; its kind or namespace segments grant nothing."}],[{"type":"text","value":"A role grants nothing unless an admitted capability explicitly names its membership or participant subject."}],[{"type":"text","value":"Schema-valid authority objects supplied by clients are not admitted authority records."}],[{"type":"text","value":"The resolver trusts only records already held by an authenticated authority store."}],[{"type":"code","value":"resolvedAuthority"},{"type":"text","value":" may be emitted only by a trusted action boundary."}]],"className":"mt-5 list-disc space-y-2 pl-6 text-[1.02rem] leading-7 text-[#404940] marker:text-[#879184]"},{"id":"block-12","type":"heading","level":2,"anchor":"immutable-grants-and-revocation","content":[{"type":"text","value":"Immutable grants and revocation"}],"plainText":"Immutable grants and revocation","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-13","type":"paragraph","content":[{"type":"text","value":"Identity bindings, memberships, context grants, and capabilities are immutable records."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-14","type":"paragraph","content":[{"type":"text","value":"Revocation is a separate immutable record. This preserves what was granted, who granted it, when it applied, who withdrew it, and why."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-15","type":"paragraph","content":[{"type":"text","value":"Revoking an ancestor invalidates its delegated descendants. A replacement record does not silently erase historical authority."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-16","type":"heading","level":2,"anchor":"delegation-only-attenuates","content":[{"type":"text","value":"Delegation only attenuates"}],"plainText":"Delegation only attenuates","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-17","type":"paragraph","content":[{"type":"text","value":"A child capability or context grant may narrow:"}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-18","type":"code","language":"text","value":"subject\naccount\nactions\ntargets\nfields\nrisk ceiling\ntime window\ndelegability","className":"my-7 overflow-x-auto rounded-2xl border border-[#303a31] bg-[#20251f] p-5 font-mono text-sm leading-6 text-[#eef1e9] shadow-sm"},{"id":"block-19","type":"paragraph","content":[{"type":"text","value":"It may not widen any parent dimension. Delegation depth and issuer and subject linkage are validated through the complete chain. Cycles, missing parents, expired ancestors, revoked ancestors, and cross-account widening fail closed."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-20","type":"heading","level":2,"anchor":"risk-and-field-boundaries","content":[{"type":"text","value":"Risk and field boundaries"}],"plainText":"Risk and field boundaries","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-21","type":"paragraph","content":[{"type":"text","value":"The trusted boundary classifies risk independently of the caller. A caller cannot rename deletion, payment, publication, disclosure, domain reassignment, export, or another consequential operation as "},{"type":"code","value":"read"},{"type":"text","value":"."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-22","type":"paragraph","content":[{"type":"text","value":"Fields are part of authority. Permission to read a title does not expose private notes. Permission for Linear to update status does not grant Linear authority over owners, approvals, evidence, account bindings, or capabilities."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-23","type":"heading","level":2,"anchor":"idempotency-and-incomplete-execution","content":[{"type":"text","value":"Idempotency and incomplete execution"}],"plainText":"Idempotency and incomplete execution","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-24","type":"paragraph","content":[{"type":"text","value":"Idempotency is durable request state, not a best-effort HTTP header."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-25","type":"list","ordered":false,"items":[[{"type":"text","value":"exact finalized retry returns the original result and receipt;"}],[{"type":"text","value":"changed input under the same participant and key scope is denied;"}],[{"type":"text","value":"an admitted request without a final receipt is surfaced as incomplete;"}],[{"type":"text","value":"incomplete work is not silently executed again;"}],[{"type":"text","value":"ordered events preserve partial progress and failure;"}],[{"type":"text","value":"an idempotency scope must not accidentally collide across accounts."}]],"className":"mt-5 list-disc space-y-2 pl-6 text-[1.02rem] leading-7 text-[#404940] marker:text-[#879184]"},{"id":"block-26","type":"heading","level":2,"anchor":"evidence-and-verification","content":[{"type":"text","value":"Evidence and verification"}],"plainText":"Evidence and verification","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-27","type":"paragraph","content":[{"type":"text","value":"Evidence producers do not automatically become objective evaluators."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-28","type":"paragraph","content":[{"type":"text","value":"A successful executor may report "},{"type":"code","value":"execution: succeeded"},{"type":"text","value":" while the objective remains "},{"type":"code","value":"unverified"},{"type":"text","value":". A verified objective requires a durable verdict from an explicit evaluator with authority and evidence references."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-29","type":"paragraph","content":[{"type":"text","value":"Conflicting active verdicts remain visible and project as disagreement."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-30","type":"heading","level":2,"anchor":"external-systems-and-succession","content":[{"type":"text","value":"External systems and succession"}],"plainText":"External systems and succession","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-31","type":"paragraph","content":[{"type":"text","value":"External adapters receive only field-level authority declared by their binding. Unknown fields are denied. External deletion does not imply canonical deletion."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-32","type":"paragraph","content":[{"type":"text","value":"Brevo, Gmail, Microsoft, GitHub, Vercel, Instant, object storage, payment services, and model providers do not own canonical account identity, messages, relationships, tasks, evidence, or history. Provider IDs are external bindings."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-33","type":"paragraph","content":[{"type":"text","value":"Succession records always state "},{"type":"code","value":"authorityTransferred: false"},{"type":"text","value":". Replacement agents, models, devices, account stewards, domains, or custodians require new identity and authority records. Continuity is not a privilege-escalation mechanism."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-34","type":"heading","level":2,"anchor":"billing-and-entitlement-boundaries","content":[{"type":"text","value":"Billing and entitlement boundaries"}],"plainText":"Billing and entitlement boundaries","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-35","type":"paragraph","content":[{"type":"text","value":"An engagement, invoice binding, payment receipt, subscription, quota, or entitlement does not automatically grant access to all account records or actions."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-36","type":"paragraph","content":[{"type":"text","value":"Payment may be executed by an external provider while Pre preserves the obligation, authorized amount, deliverables, acceptance, payment binding, and receipt. Payment and account administration remain consequential actions."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-37","type":"heading","level":2,"anchor":"content-is-untrusted-input","content":[{"type":"text","value":"Content is untrusted input"}],"plainText":"Content is untrusted input","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-38","type":"paragraph","content":[{"type":"text","value":"Markdown may describe code, commands, links, people, actions, policies, accounts, or hostnames. It cannot execute any of them."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-39","type":"paragraph","content":[{"type":"text","value":"The content compiler:"}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-40","type":"list","ordered":false,"items":[[{"type":"text","value":"supports a bounded Markdown subset;"}],[{"type":"text","value":"produces structured inline tokens rather than raw HTML;"}],[{"type":"text","value":"rejects unsafe link schemes;"}],[{"type":"text","value":"never evaluates embedded JSX, HTML, JavaScript, or event handlers;"}],[{"type":"text","value":"maps trusted theme names to a code-owned design registry;"}],[{"type":"text","value":"does not accept arbitrary Tailwind strings from stored content."}]],"className":"mt-5 list-disc space-y-2 pl-6 text-[1.02rem] leading-7 text-[#404940] marker:text-[#879184]"},{"id":"block-41","type":"paragraph","content":[{"type":"text","value":"A schema-valid "},{"type":"code","value":"PageDocument"},{"type":"text","value":" is not inherently trusted. Render-authoritative presentation and future capability references must be produced or re-resolved by a trusted server projection boundary."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-42","type":"heading","level":2,"anchor":"public-and-private-projections","content":[{"type":"text","value":"Public and private projections"}],"plainText":"Public and private projections","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-43","type":"paragraph","content":[{"type":"text","value":"Publication fails closed. A page is public only when canonical metadata contains the exact value "},{"type":"code","value":"visibility: \"public\""},{"type":"text","value":" and the resolved account projection permits those fields."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-44","type":"paragraph","content":[{"type":"text","value":"Private or invalid documents must not disclose document-specific body content, metadata, navigation entries, Markdown, JSON projections, or the existence of a private account through public routes."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-45","type":"paragraph","content":[{"type":"text","value":"Public pages must never expose:"}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-46","type":"list","ordered":false,"items":[[{"type":"text","value":"credentials or environment variables;"}],[{"type":"text","value":"capability or authentication tokens;"}],[{"type":"text","value":"private prompts or chain-of-thought;"}],[{"type":"text","value":"unsanitized filesystem paths;"}],[{"type":"text","value":"private repository content;"}],[{"type":"text","value":"unpublished security findings;"}],[{"type":"text","value":"personal information without authority;"}],[{"type":"text","value":"private room messages or context grants;"}],[{"type":"text","value":"billing, payment, or entitlement details without explicit authorization;"}],[{"type":"text","value":"records from another account because of a cache, query, or hostname-resolution error."}]],"className":"mt-5 list-disc space-y-2 pl-6 text-[1.02rem] leading-7 text-[#404940] marker:text-[#879184]"},{"id":"block-47","type":"heading","level":2,"anchor":"local-capability-boundary","content":[{"type":"text","value":"Local capability boundary"}],"plainText":"Local capability boundary","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-48","type":"paragraph","content":[{"type":"text","value":"The web application must not receive ambient shell, filesystem, browser-profile, repository, or device authority."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-49","type":"paragraph","content":[{"type":"text","value":"A local controller or Stow client performs a bounded action only after resolving a capability that binds participant, account, target, action, fields, risk, expiry, and receipt behavior."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-50","type":"heading","level":2,"anchor":"preservation-without-surveillance","content":[{"type":"text","value":"Preservation without surveillance"}],"plainText":"Preservation without surveillance","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-51","type":"paragraph","content":[{"type":"code","value":"encounter"},{"type":"text","value":" is not equivalent to "},{"type":"code","value":"preserve everything"},{"type":"text","value":"."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-52","type":"paragraph","content":[{"type":"text","value":"Stow should support graduated capture:"}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-53","type":"code","language":"text","value":"ephemeral encounter\nreference\npreserved snapshot\nextracted assertion\nexplicit evidence\nbounded action","className":"my-7 overflow-x-auto rounded-2xl border border-[#303a31] bg-[#20251f] p-5 font-mono text-sm leading-6 text-[#eef1e9] shadow-sm"},{"id":"block-54","type":"paragraph","content":[{"type":"text","value":"The user or authorized community governs which level becomes durable, which account receives it, and who may see it."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"},{"id":"block-55","type":"heading","level":2,"anchor":"procedural-respect","content":[{"type":"text","value":"Procedural respect"}],"plainText":"Procedural respect","className":"mt-12 scroll-mt-28 text-2xl font-medium leading-tight tracking-[-0.025em] text-[#20251f]"},{"id":"block-56","type":"paragraph","content":[{"type":"text","value":"Persistent participant or account identity does not imply unlimited autonomy or permanent control. Model migration, domain change, account stewardship, constitution change, override, refusal, correction, disagreement, export, and succession remain explicit events."}],"className":"mt-5 text-[1.04rem] leading-8 text-[#404940]"}]}