@ziprack/sdk 0.1.2 → 0.2.1

package/dist/docs/extending.md

@@ -0,0 +1,261 @@
+# Writing a Capability
+
+- [When to Add One](#when-to-add-one)
+- [The Capability Interface](#the-capability-interface)
+- [Registering It](#registering-it)
+- [Manifest Rules](#manifest-rules)
+- [Message Handlers](#message-handlers)
+- [Launch Payload](#launch-payload)
+- [Install Hooks](#install-hooks)
+- [Conformance and Status](#conformance-and-status)
+- [The SDK Side](#the-sdk-side)
+
+<a name="when-to-add-one"></a>
+## When to Add One
+
+A capability is one applet-facing surface: a set of message types, a manifest section, a slice of the
+launch payload, and the server-side service behind them. `ziprack/db` and `ziprack/ai` are both
+exactly this shape.
+
+Before adding one, apply the framework's own test:
+
+> If a capability requires an applet author to reason about device identity, transport, or
+> deployment topology, it does not belong in zipRACK.
+
+And check it is not already expressible. A great many ideas reduce to `db@1` with a different
+collection, or to `broadcast@1` with a different event name. The value of seven surfaces is that
+there are seven.
+
+<a name="the-capability-interface"></a>
+## The Capability Interface
+
+One package, one `Capability`. Extend `AbstractCapability` and override only what you need — every
+method has a sensible no-op default.
+
+```php
+namespace ZipRack\Survey;
+
+use ZipRack\Core\Capabilities\AbstractCapability;
+
+class SurveyCapability extends AbstractCapability
+{
+    public function id(): string
+    {
+        return 'survey';                    // ^[a-z][a-z0-9_]*$
+    }
+
+    public function versions(): array
+    {
+        return [1];                         // may implement several at once: [1, 2]
+    }
+}
+```
+
+| Method | Purpose |
+|---|---|
+| `id()` | The name in manifests and message types: `survey`, `survey:submit`. |
+| `versions()` | Capability versions this package implements. Metadata, independent of package semver. |
+| `manifestSections()` | Top-level manifest keys this capability owns. |
+| `manifestRules()` | Laravel rules for those sections. |
+| `validateManifest()` | Cross-field checks; add errors to the validator. |
+| `messageHandlers()` | `type => handler class`. |
+| `launchPayload()` | What to merge into `rack:launch` under this capability's id. |
+| `onInstall()` / `onPromote()` / `onRetire()` | Version lifecycle hooks. `onInstall()` runs inside the install transaction, so row changes only. |
+| `adminRoutes()` | Headless admin routes, registered only when `ziprack/admin` is installed. |
+| `conformanceTests()` | Checks contributed to the conformance suite. |
+| `statusChecks()` | Warnings for `ziprack:status` and `/ziprack/health`. |
+
+<a name="registering-it"></a>
+## Registering It
+
+```php
+class SurveyServiceProvider extends ServiceProvider
+{
+    public function register(): void
+    {
+        $this->mergeConfigFrom(__DIR__.'/../config/ziprack-survey.php', 'ziprack-survey');
+    }
+
+    public function boot(): void
+    {
+        $this->loadMigrationsFrom(__DIR__.'/../database/migrations');
+
+        ZipRack::register($this->app->make(SurveyCapability::class));
+
+        if ($this->app->runningInConsole()) {
+            $this->publishes([
+                __DIR__.'/../config/ziprack-survey.php' => config_path('ziprack-survey.php'),
+            ], 'ziprack-config');
+        }
+    }
+}
+```
+
+Migrations load; they are never published. Config publishes; it is meant to diverge. That split is
+[not negotiable](installation.md#publishable-and-non-publishable) — it is what keeps the fleet
+uniform.
+
+The registry is built from installed providers, so installing the package *is* declaring the
+capability. There is no separate list to fall out of sync.
+
+<a name="manifest-rules"></a>
+## Manifest Rules
+
+```php
+public function manifestSections(): array
+{
+    return ['surveys'];
+}
+
+public function manifestRules(): array
+{
+    return [
+        'surveys' => ['required', 'array', 'min:1'],
+        'surveys.*.id' => ['required', 'string', 'max:100', 'regex:/^[a-z][a-z0-9_.-]*$/'],
+        'surveys.*.questions' => ['required', 'array', 'min:1'],
+    ];
+}
+
+public function validateManifest(array $data, Validator $validator): void
+{
+    $ids = [];
+    foreach ($data['surveys'] ?? [] as $index => $survey) {
+        if (isset($ids[$survey['id'] ?? null])) {
+            $validator->errors()->add("surveys.{$index}.id", "Duplicate survey id [{$survey['id']}].");
+        }
+        $ids[$survey['id'] ?? ''] = true;
+    }
+}
+```
+
+The core validator enforces the section/capability relationship for you: a manifest containing
+`surveys` without declaring `survey@1` fails, and so does one declaring a section no installed
+capability owns.
+
+Three conventions worth keeping: uniqueness errors name the duplicate, a section that depends on
+another capability says so explicitly (`"A room-scoped X requires the [broadcast] capability"`), and
+anything with a quota takes its ceiling from config rather than hard-coding it.
+
+<a name="message-handlers"></a>
+## Message Handlers
+
+```php
+public function messageHandlers(): array
+{
+    return ['survey:submit' => SubmitSurvey::class];
+}
+```
+
+```php
+class SubmitSurvey implements MessageHandler
+{
+    public function rules(MessageContext $context): array
+    {
+        return [
+            'survey' => ['required', 'string', 'max:100'],
+            'answers' => ['required', 'array'],
+        ];
+    }
+
+    public function handle(MessageContext $context, array $payload): Ack
+    {
+        $survey = SurveyManifest::of($context->manifest())->find($payload['survey'])
+            ?? throw MessageException::notFound("Survey [{$payload['survey']}] is not declared.");
+
+        // $context->participant, $context->version, $context->attribute('attempt_id'|'room_id')
+
+        return Ack::ok(['id' => $id]);
+    }
+}
+```
+
+The dispatcher has already checked that the manifest declares your capability at a version this Rack
+implements, and has already validated the payload against `rules()` — a handler never sees an
+invalid payload or an undeclared call.
+
+Throw `MessageException::forbidden() / notFound() / quota() / completed() / conflict()` for expected
+failures; anything else is reported and acks `persist_failed`. Never leak an internal message into
+an ack.
+
+Message types must match `^[a-z][a-z0-9_]*:[a-z][a-z0-9_.]*$` and are namespaced by your capability
+id. Everything the applet may influence about scope comes from `MessageContext`, never from the
+payload — that is how a room-scoped write cannot address another room.
+
+<a name="launch-payload"></a>
+## Launch Payload
+
+```php
+public function launchPayload(LaunchContext $context): ?array
+{
+    return ['surveys' => SurveyManifest::of($context->manifest())->summaries()];
+}
+```
+
+Merged under your capability id, so the applet reads `launch.survey.surveys`. Return `null` to
+contribute nothing. Use `$context->remember(key, fn)` to share a resolved model with your message
+handlers rather than querying twice.
+
+Send what the applet needs to render its first frame, and nothing more. Launch data crosses into an
+untrusted frame: it is the one place where over-sharing is silent.
+
+<a name="install-hooks"></a>
+## Install Hooks
+
+```php
+public function onInstall(AppletVersion $version, ?AppletVersion $previous): void
+{
+    $this->installer->install($version, $previous);   // row changes only; no DDL
+}
+```
+
+`onInstall()` runs inside the install transaction, with the previous current version for comparison
+— which is what lets `db@1` register, update and orphan collections as they change between
+versions. If it throws, the whole installation rolls back and extracted files are removed.
+
+Keep it to row changes. `CREATE`, `ALTER` and `DROP` commit any open transaction on MySQL and
+MariaDB, which breaks the install and lets the conformance suite's data escape its rollback. If a
+capability needs tables, ship them as migrations; the conformance suite fails any check that commits
+its transaction.
+
+<a name="conformance-and-status"></a>
+## Conformance and Status
+
+```php
+public function conformanceTests(): array
+{
+    return [SurveyAnswersAreImmutable::class];
+}
+
+public function statusChecks(): array
+{
+    return $this->configured() ? [] : [[
+        'level' => 'warning',
+        'message' => 'survey@1 has no store configured; submissions are discarded.',
+    ]];
+}
+```
+
+A conformance check is a class with `name()` and `run(Fixture $fixture)`, failing by throwing. Write
+one per invariant the capability promises an applet author — not one per method.
+
+<a name="the-sdk-side"></a>
+## The SDK Side
+
+A capability is only half-built until `@ziprack/sdk` can call it. Add a module under
+`sdk/src/{capability}/`, take a `Link` in the constructor, and expose it on `RackClient`:
+
+```ts
+export class SurveyApi {
+    public constructor(private readonly link: Link) {}
+
+    public submit(survey: string, answers: JsonObject): Promise<AckResult<{ id: string }>> {
+        return this.link.send('survey:submit', { survey, answers });
+    }
+}
+```
+
+Then implement it in `MockRack` as well. **A capability with no mock is a capability applet authors
+cannot develop against**, and standalone development is the property the framework most depends on —
+losing it costs more than the capability is worth.
+
+Bump the capability version only when this surface changes. Refactors below it are free.

package/dist/docs/installation.md

@@ -0,0 +1,186 @@
+# Installation
+
+- [Composing a Rack](#composing-a-rack)
+- [The Deployment Skeleton](#the-deployment-skeleton)
+- [Configuration](#configuration)
+- [Routes](#routes)
+- [Participants and Guests](#participants-and-guests)
+- [Publishable and Non-Publishable](#publishable-and-non-publishable)
+- [Console Commands](#console-commands)
+
+<a name="composing-a-rack"></a>
+## Composing a Rack
+
+**A deployment's `composer.json` is its capability declaration.** The capability registry is built
+by iterating installed service providers, so it cannot disagree with what is actually installed.
+
+```json
+"require": {
+    "ziprack/core": "^1.0",
+    "ziprack/auth": "^1.0",
+    "ziprack/attempt": "^1.0",
+    "ziprack/activity": "^1.0",
+    "ziprack/db": "^1.0",
+    "ziprack/ai": "^1.0",
+    "ziprack/broadcast": "^1.0",
+    "ziprack/storage": "^1.0",
+    "ziprack/admin": "^1.0"
+},
+"require-dev": {
+    "ziprack/conformance": "^1.0"
+}
+```
+
+Remove `ziprack/db` and an applet requesting `db@1` is refused at upload with a message naming what
+this Rack does implement. Drop `ziprack/broadcast` and there is no Reverb dependency, no WebSocket
+port and no room tables — a smaller attack surface, not just a smaller install.
+
+`ziprack/core` is mandatory; every capability package requires it. `ziprack/admin` is optional and
+headless: it ships JSON endpoints and export services, never pages. `ziprack/conformance` is a dev
+dependency that belongs in CI.
+
+Packages resolve from private VCS repositories:
+
+```json
+"repositories": [
+    { "type": "vcs", "url": "git@github.com:Collective-Next/ziprack-core.git" },
+    { "type": "vcs", "url": "git@github.com:Collective-Next/ziprack-attempt.git" }
+]
+```
+
+Inside the monorepo they resolve from `../packages/*` path repositories instead, so changes are
+testable without tagging.
+
+<a name="the-deployment-skeleton"></a>
+## The Deployment Skeleton
+
+`skeleton/` is a Laravel application template cloned once per engagement and then owned by that
+engagement. It holds what is *meant* to diverge: branding, environment, the deployment pipeline, the
+admin UI, and the capability list.
+
+```sh
+cp .env.example .env && php artisan key:generate
+php artisan migrate --seed
+npm install && npm run build
+php artisan ziprack:install path/to/applet-1.0.0.zip --activate
+php artisan ziprack:conformance
+```
+
+Migrations ship inside the packages and load through `loadMigrationsFrom()`; they are never
+published, because schema must be identical on every Rack.
+
+<a name="configuration"></a>
+## Configuration
+
+Each package publishes one config file. The defaults are production-safe; the values below are the
+ones you will actually touch.
+
+### `config/ziprack.php`
+
+| Key | Default | Notes |
+|---|---|---|
+| `disk` | `local` | Where packages are extracted. Must not be publicly served. |
+| `max_upload_mb` | `50` | Package size cap. |
+| `allowed_extensions` | static list | Anything else rejects the whole upload. |
+| `asset_token_ttl_hours` | `6` | Lifetime of the signed package-asset token. |
+| `session_ttl_hours` | `6` | Lifetime of a launch session. |
+| `csp.img_hosts`, `csp.media_hosts` | `[]` | Per-deployment allowlist. A bare scheme is rejected. |
+| `player.frame_allow` | `[]` | Features added to the applet iframe's `allow` list, e.g. `microphone`. Bare names from a fixed set only. |
+| `media.providers` | `['vimeo','youtube']` | Drives `frame-src` and manifest validation. |
+| `publishing.require_sbom` | `true` | Refuse packages with no SBOM. |
+| `publishing.require_review_for_new_capabilities` | `true` | Block promotion until a widened `requires` is approved. |
+| `publishing.osv_lookup` | `true` | Batch the SBOM's purls against OSV.dev after install. |
+| `audit.enabled` | `true` | Per-applet audit log of capability calls. |
+| `health_token` | `null` | Bearer token for `/ziprack/health`. |
+
+### Capability configs
+
+| File | Notable keys |
+|---|---|
+| `ziprack-auth.php` | `releasable` — the single place a deployment answers "what can applets see about our people"; `claim_map` |
+| `ziprack-attempt.php` | `max_state_bytes` (64 KB), `max_segment_keys` (20) |
+| `ziprack-db.php` | `max_records_per_scope` (5000), `max_record_bytes` (64 KB), `max_indexed_paths` (8), `list_limit` (100) |
+| `ziprack-storage.php` | `disk`, `max_bytes_cap` (50 MB), `url_ttl_minutes` (10), `scanner` (`null` \| `clamav`) |
+| `ziprack-ai.php` | `provider`, `models.analysis`, `models.chat`, `allowed_models`, the whole `budget` block |
+| `ziprack-broadcast.php` | `join_prefix`, `facilitator_grace_seconds` (60), `presence_window_seconds` (45), `max_event_bytes` |
+| `ziprack-admin.php` | `prefix` (`ziprack/admin`), `middleware` (`web`, `auth`, `can:ziprack.use-admin`) |
+
+Ceilings in these files are **hard**: a manifest asking for a larger quota or budget fails
+validation. Defaults apply when a manifest declares nothing.
+
+<a name="routes"></a>
+## Routes
+
+| Route | Purpose |
+|---|---|
+| `GET /a/{applet}` | The player: chrome plus the sandboxed iframe. Middleware from `ziprack.routes.middleware.player`, default `['web','auth']`. |
+| `GET /ziprack/pkg/{token}/{path}` | Package assets, streamed with the contract's headers and CSP. Token-authenticated, stateless. |
+| `GET /ziprack/assets/{file}` | The shell bundles (`shell.js`, `shell-broadcast.js`, `sdk.js`). |
+| `POST /ziprack/s/{session}/messages` | The one door every capability call goes through. Batched, max 50 per request. |
+| `GET /ziprack/s/{session}/stream/{requestId}` | Server-sent events for streamed acks (`ai:chat`). |
+| `POST /ziprack/s/{session}/files` | Multipart upload target for `storage:put` (`storage`). |
+| `GET /ziprack/f/{file}` | Signed, short-lived download of a stored file (`storage`). |
+| `POST /ziprack/s/{session}/broadcast/auth` | Rack-side WebSocket channel authentication (`broadcast`). |
+| `GET /ziprack/health` | Fleet visibility: format, core version, capabilities, warnings. |
+| `GET /r/{code}` | Join a room by code (`broadcast`). |
+| `*` `/ziprack/admin/*` | The headless admin API (`ziprack/admin`). |
+
+Session routes are deliberately stateless: token in the path, no session cookie, no CSRF, rate
+limited by `ziprack.routes.session_rate_limit`.
+
+<a name="participants-and-guests"></a>
+## Participants and Guests
+
+By default the player sits behind `auth` and each authenticated user maps to a `Participant`.
+Light group activities often have no identity source, so a Rack may enable guests:
+
+```
+ZIPRACK_GUESTS=true
+```
+
+and drop `auth` from the player middleware. An unauthenticated visitor then gets a cookie-keyed
+participant, which is enough for `opt_in` and `first_in` rooms. `roster` rooms and any applet
+declaring `auth@1` still need real users.
+
+To resolve participants differently — SSO subject, an LTI launch, an external roster — bind
+`ZipRack\Core\Contracts\ParticipantResolver` in a service provider.
+
+<a name="publishable-and-non-publishable"></a>
+## Publishable and Non-Publishable
+
+Every publishable file is a place the fleet can drift, so the split is deliberate.
+
+**Publishable — meant to diverge:** config files, the player chrome and holding views
+(`resources/views/vendor/ziprack`), translations, notification templates.
+
+**Never publishable — these are the contract:**
+
+| Artifact | Why |
+|---|---|
+| Migrations | Schema must be identical everywhere. |
+| `ManifestValidator` | An applet must validate the same way on every Rack, or portability is fiction. |
+| `PackageInstaller` file rules | Traversal, symlink and extension checks are security code. |
+| Bridge and envelope handling | The `event.source` trust check is the whole boundary. |
+| `ContentSecurityPolicy` | Directives are fixed; only the host allowlist is configurable. |
+| `CapabilityRegistry` and dispatch | The runtime rejection of undeclared calls. |
+
+Where deployments genuinely need to vary, the variation is configuration the core reads — not code
+the deployment owns. A Rack can add an approved image host; it cannot reintroduce `https:`.
+
+<a name="console-commands"></a>
+## Console Commands
+
+| Command | Does |
+|---|---|
+| `ziprack:install {zip} [--applet=] [--activate]` | Install a package as a new version. |
+| `ziprack:promote {slug} {version} [--force]` | Make a version current. `--force` also approves a pending capability review. |
+| `ziprack:retire {slug} {version}` | Kill switch: the version can no longer be launched. |
+| `ziprack:status [--json]` | Format, core version, installed capabilities, warnings. |
+| `ziprack:conformance [--json]` | Verify this Rack honours `ziprack/1`. |
+| `ziprack:conformance:install` | Publish a test that runs the suite inside the deployment's own Pest run. |
+| `ziprack:profile:set {email} {key} {value}` | Set one profile attribute. |
+| `ziprack:roster:import {csv}` | Import profile attributes by email. |
+| `ziprack:room:create {slug} [--name=] [--mode=] [--roster=]` | Create a room and print its join code. |
+| `ziprack:rooms:tick` | Vacate and reassign dropped facilitators. **Schedule every minute.** |
+| `ziprack:db:prune [--force]` | Drop tables of collections no current manifest declares. |
+| `ziprack:response-analysis [--applet=] [--force]` | Regenerate admin AI summaries. **Schedule every few hours.** |

package/dist/docs/introduction.md

@@ -0,0 +1,124 @@
+# Introduction
+
+- [The Shape of a Rack](#the-shape-of-a-rack)
+- [The Trust Boundary](#the-trust-boundary)
+- [Objects](#objects)
+- [Capabilities](#capabilities)
+- [What zipRACK Is Not](#what-ziprack-is-not)
+
+<a name="the-shape-of-a-rack"></a>
+## The Shape of a Rack
+
+A **Rack** is one deployed Laravel application. It authenticates people, stores every byte an
+applet produces, makes every outbound call, holds the WebSocket, and renders the admin reporting.
+
+An **applet** is a zip containing a static web app. It is uploaded, validated, extracted and served
+inside a sandboxed iframe at `/a/{slug}`. It owns layout, branding, media, navigation and
+interaction — the entire participant-facing experience — and nothing else.
+
+```
+┌─ Rack (Laravel) ───────────────────────────────────────────┐
+│  auth · attempts · records · files · prompts · rooms       │
+│  ┌─ chrome ────────────────────────────────────────────┐   │
+│  │ ┌─ iframe (opaque origin, no allow-same-origin) ──┐ │   │
+│  │ │  applet: index.html + assets                    │ │   │
+│  │ │  @ziprack/sdk  ⇄  postMessage  ⇄  shell         │ │   │
+│  │ └─────────────────────────────────────────────────┘ │   │
+│  └─────────────────────────────────────────────────────┘   │
+└────────────────────────────────────────────────────────────┘
+```
+
+Every deployment is standalone: its own database, its own domain, its own capability set. There is
+no shared multi-tenant monolith. What unites deployments is the format string `ziprack/1` and the
+set of capability versions each Rack implements — which is why an applet built against one Rack runs
+on another.
+
+<a name="the-trust-boundary"></a>
+## The Trust Boundary
+
+The iframe is rendered with:
+
+```html
+<iframe sandbox="allow-scripts allow-forms allow-popups allow-popups-to-escape-sandbox"
+        allow="autoplay; fullscreen; picture-in-picture; encrypted-media">
+```
+
+Note the absence of `allow-same-origin`. The applet document has an **opaque origin**: no cookies,
+no `localStorage`, no `IndexedDB`, no credentialed requests, no way to call the Rack over HTTP.
+Everything an applet needs, it asks for over `postMessage`:
+
+```ts
+await Rack.activity.answer('intro.connection', 5);
+```
+
+That call becomes a `ziprack` envelope posted to the parent window, which the shell batches into a
+`POST /ziprack/s/{session}/messages`, which `MessageDispatcher` checks against the applet's manifest
+before handing to the capability's handler. The applet asks; the Rack decides, enforces and persists.
+
+Trust runs on `event.source`, never `event.origin` — the applet's origin is opaque by design, so
+origin comparison is meaningless. A nested frame (a Vimeo player, say) that tries to talk to the
+Rack is ignored, because its window is not the applet's `contentWindow`.
+
+**This is why new capabilities are cheap.** Adding an LLM surface does not loosen the CSP, because
+the call never leaves the frame as HTTP — it leaves as a `postMessage` the Rack fulfils server-side.
+An applet can never obtain an API key, a channel token or a database handle, because none of those
+ever cross the boundary.
+
+<a name="objects"></a>
+## Objects
+
+| Object | What it is | Capability |
+|---|---|---|
+| **Applet** | One experience or app, identified by an immutable `slug`. Has many versions. | core |
+| **Version** | One uploaded zip. Immutable. Exactly one is current. | core |
+| **Participant** | The person in front of the applet, resolved from the Rack's own users (or a guest cookie). | core |
+| **Attempt** | One participant's run. Holds `status`, `state`, `segment`. Pinned to the version it started on. | `attempt@1` |
+| **Statement** | Append-only record: actor did verb on activity with result. The audit trail and the uniform export. | `activity@1` |
+| **Record** | A mutable row in a declared collection, at a declared scope. Working state. | `db@1` |
+| **Stored file** | A participant upload, addressable only once scanned clean. | `storage@1` |
+| **Room** | A shared session: an applet version plus its members, each `participant` or `facilitator`. | `broadcast@1` |
+| **Profile attribute** | A Rack-owned fact about the participant, released only if requested and permitted. | `auth@1` |
+
+Statements and records coexist because they answer different questions. A statement is *what
+happened*; a record is *what is currently true*. Statements are append-only and uniformly shaped, so
+they export to one CSV per applet. Records are mutable and arbitrarily shaped, which is why `db@1`
+requires a JSON Schema — the schema is what buys back the column headers.
+
+<a name="capabilities"></a>
+## Capabilities
+
+Seven surfaces. An applet declares the ones it uses in its manifest, and the Rack refuses at runtime
+any call the manifest did not declare.
+
+| Capability | Covers | Entry point |
+|---|---|---|
+| [`auth@1`](auth.md) | Who the participant is; released profile attributes | `Rack.auth.user()` |
+| [`attempt@1`](attempts.md) | Lifecycle, resume state, completion, version pinning | `Rack.attempt.complete()` |
+| [`activity@1`](activity.md) | Append-only statements and the CSV export | `Rack.activity.answer(id, value)` |
+| [`db@1`](database.md) | CRUD records in declared collections | `Rack.db.collection('ideas').create({…})` |
+| [`storage@1`](storage.md) | Participant file uploads | `Rack.storage.put('photos', file)` |
+| [`ai@1`](ai.md) | Declared prompt templates: analysis and chat | `Rack.ai.ask('summarize', vars)` |
+| [`broadcast@1`](broadcast.md) | Rooms, presence, facilitator control, shared state | `Rack.broadcast.join('main')` |
+
+Capability versions are independent of the format string and of the Composer package version. See
+[Versioning](versioning.md).
+
+Two things need no capability: [declared media](media.md) (`Rack.media.embedUrl(id)`) and
+`Rack.eject()`, which asks the Rack to leave the applet.
+
+<a name="what-ziprack-is-not"></a>
+## What zipRACK Is Not
+
+These were considered and settled. Reopening them needs new information, not a fresh opinion.
+
+- **Not multi-tenant.** Standalone Racks per engagement. Isolation is infrastructure, not
+  application code. Say *deployment*, *Rack* or *fleet* — never *tenant*.
+- **Not two standards.** There is no "experience profile" and "app profile". An experience is an
+  applet declaring `attempt@1` and `activity@1`; an app is one declaring `db@1` and not `attempt@1`.
+- **No CRDTs in v1.** Shared room state is server-authoritative, last write wins per key.
+- **No static analysis of applet JS.** Minified bundles defeat it (`window["ev"+"al"]`); the CSP
+  does that work at runtime where it cannot be evaded.
+- **No display or kiosk role.** Rooms have participants and facilitators. Multi-screen AV work stays
+  bespoke. The general test: *if a capability requires an applet author to reason about device
+  identity, transport or deployment topology, it does not belong in zipRACK.*
+- **No offline mode.** Participants are in offices with reliable connectivity.