Trust and authority
The package knows the domain; the host owns identity, time, persistence, devices, and recovery.
- Rules and activity state
- Measurements and progression
- Manual player and overlay
- Story, coordination, narration policy
- Identity and authorization
- Clocks and persistence
- Devices, Station, OBS and media
- Routing, retries and recovery
Portable package boundary
A package may own deterministic rules, package state, Measurements, progression definitions, portable presentation, Story Event vocabulary, coordination policy, narration policy, and correction interpretation.
It does not receive direct account, database, credential, provider-secret, filesystem, network, native API, OBS, or media-storage authority. Portable UI runs in an opaque iframe or WebView and communicates through one bounded typed bridge.
Host boundary
The host supplies authenticated actor identity, active run routing, trusted timestamps, expected revisions, idempotency keys, package-release pins, source bindings, persistence, recovery, and capability grants. It validates every package output before committing it.
Connector boundary
A Station connector is native code, so it travels through a stricter lane. The default sidecar begins with no ambient authority. Station grants only reviewed capabilities such as a narrow private-LAN connection, a specific file read, or a supervised process interaction. Revocation terminates the authority.
The connector emits exact observations. It cannot decide which member, Practice Mode, Attempt, or Sprint receives them.
Derived consumers
Overlays, narration, recording, media anchoring, editorial processing, and Content Studio are downstream of a committed activity transition. Their failure must never roll back or delay the Attempt.
activity transition
↓ validate
commit Attempt + Measurements
↓ publish semantic effects
overlay / narration / capture / editorial consumersThis is both a security rule and a product reliability rule.