01 / Receipts
Checkable
Evidence you can check
A receipt records the input hashes, the renderer lane, the output
hashes, the warnings and the gate results. Verify the identity, the
artifact, the duration, the hash and the quality result — never the
exit code.
A final render returns its receipt inline and writes it beside the
delivered file; a preview writes one next to the frame; automation
that produces a package puts it inside that package. Validation is
honest about itself too — it reports in the envelope and writes no
receipt at all, rather than leaving a reassuring file that attests
to nothing.
→ render.final h264 · 1920x1080
inputs sha256 · 4 assets
gates representative frames pass
output sha256 · written to --out
receipt> beside the artifact
02 / Tiers
A ceiling
The grant binds
Six tiers, ranked. The host sets one at launch and a request can drop
below it but never climb above. Read-only is the default, and every
tier above it takes a deliberate opt-in flag — a package, a prompt or
an agent cannot raise its own ceiling.
The ranking has a trap worth knowing before it costs you a session:
creating a new package outranks editing an existing one, because
creating writes outside a package. Start the server too low and the
create call is refused — correctly. Remote push sits at the top, is
never automatic, and needs a second explicit opt-in on top of the
grant.
→ read < draft < render
< edit < write_local < push
granted render_motion
requested write_local
refused> above the ceiling
03 / Code
Say it plainly
Some layers run code
Shapes, text, keyframes, environments, particles and fixed 3D scenes
are pure data — they declare what to draw and cannot execute
anything. A web, html or canvas layer is the deliberate exception: it
names an HTML file inside the package and Motion loads it in Chromium
with JavaScript enabled. That is what makes design-to-video
work, and it means rendering a package a stranger sent you runs their
script. The fence is real — network denied by default, service
workers blocked, secondary pages refused, reads confined to the
package — but it bounds what the code can reach, not whether it runs.
→ shape · text · particles · 3d
executes no
→ web · html · canvas
executes yes, in Chromium
network denied by default
import> <script> stripped
