{
  "title": "What rig.rest can and cannot see",
  "claims": [
    {
      "id": "no-our-side",
      "heading": "Your work stays on your machine",
      "body": "Every answer, file, picture, effect, and model key remains on the machine running Sovereign. The portal has no route that accepts or forwards work content."
    },
    {
      "id": "four-fields",
      "heading": "What the portal keeps",
      "body": "The account email, the address of the owner's machine, when it was paired, and the label the owner chose. The portal also keeps short-lived hashes needed for sign-in and audit records for authority changes."
    },
    {
      "id": "direct-path",
      "heading": "Your browser talks straight to your machine",
      "body": "The work path is browser to Sovereign. rig.rest is not a relay. Every portal request body is capped at 4 KB."
    },
    {
      "id": "fabric-boundary",
      "heading": "Fabric sees commitments, not work",
      "body": "Fabric may hold identity, pairing, receipt metadata, public commitments, and checkpoints. It rejects bodies carrying work-content keys before routing."
    },
    {
      "id": "vendor-boundary",
      "heading": "Prompts go to the model vendor",
      "body": "A model call necessarily sends the selected prompt to the selected model vendor. The vendor boundary is recorded; rig.rest does not claim the model runs locally."
    },
    {
      "id": "v7-status",
      "heading": "Deployment is not ratification",
      "body": "The machine implementation survives its refutation suite, while all 13 phases remain blocked by authentic owner, provenance, human, and external records. The capsule event spelling remains unselected."
    },
    {
      "id": "receipts",
      "heading": "Destructive operations return receipts",
      "body": "Unpairing, revocation, purging, and local effects name what changed and what was preserved. A receipt's assurance level states what it can actually prove."
    },
    {
      "id": "revocation",
      "heading": "Revocation never deletes the owner's files",
      "body": "Revocation removes portal and entitlement access. It cannot reach into a machine the service does not own, and it never deletes the owner's work."
    },
    {
      "id": "signin",
      "heading": "Passwordless sign-in",
      "body": "The emailed six-digit code works once and expires in 10 minutes. A session and an agent entitlement last at most 24 hours."
    },
    {
      "id": "limits",
      "heading": "Known limits are first-class states",
      "body": "An unreachable dependency is amber, not a claim that the owner did something wrong. Public witnessing, the owner records, and the capsule ruling remain unavailable until authentic evidence closes them."
    }
  ],
  "stored_fields": [
    "account",
    "agent_url",
    "paired_at",
    "label"
  ],
  "token_ttl_human": "24 hours",
  "honest_sentence": "The control plane is live; V7 remains BLOCKED_REQUIRED_RECORDS and makes no release claim."
}