ACCOUNT
Public Identity
Request-linked commercial profiles stay on the website boundary. Product execution stays in the app.
NILLOW TRUST
The public membrane for account, entitlement, and release trust.
This website can identify users, display subscription-facing access, publish release metadata, and hand off to Portal Host. Product execution, customer content, and internal structures stay outside the website.
Allowed Public Surface
Pass 0 exposes the trust map as public website content and static metadata only.
available
REQUEST
Project Requests
A bounded project brief can enter review without implying checkout, enrollment, or runtime access.
DOWNLOAD
Signed Installer Metadata
The website may publish signed-release facts, checksums, and update metadata without shipping product authority.
DISCOVERY
Profile Discovery
Consultant and public profile discovery can exist here as public metadata and identity-only requests.
MARKETPLACE
Cognitive Marketplace
Marketplace discovery can list public catalog shells without exposing cognitive IP or private customer material.
Bridge Audit Rules
Audit events are allowed only as coarse bridge evidence. They do not carry customer content.
- Record route, event type, actor id, target id, and coarse metadata only.
- Never record customer content, files, prompts, private work materials, internal product topology, or product traces.
- Treat Portal Host enrollment as a handoff until a dedicated owner contract exists.
Release Metadata Floor
Installer publication waits for a signed artifact. The website can expose the unavailable contract shape.
