From e6fdc69e99a8288c1aa98f9bc6ca2a9fc12f6341 Mon Sep 17 00:00:00 2001 From: "ren.ji" Date: Fri, 16 Oct 2026 01:04:13 +0800 Subject: [PATCH] Document commercial entitlement boundary --- AGENTS.md | 17 +++++++++++++++++ CHANGELOG.md | 3 +++ README.md | 10 ++++++++++ README.zh-CN.md | 7 +++++++ docs/architecture.md | 9 +++++++++ 5 files changed, 46 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index 5ab6a680..7d869d8c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -13,6 +13,23 @@ transport, or mix distribution/system services into the embedding lifecycle. Mobile support must be described by its actual maturity: a portable runtime or typed companion foundation is not yet a generated, packaged application flow. +### Commercial entitlement boundary + +Rivet owns application runtime, native UI, general secure storage, +distribution, and update integrity. It does not own product entitlements, +trials, activations, seats, subscriptions, payments, or accounts. Commercial +products may depend on Rivet and +[Permit](https://github.com/turinglambdaai/permit) independently, but Rivet +must not depend on Permit or grow a built-in licensing subsystem. + +A product may store Permit credentials, local-trial state, or an +`installation_id` through Rivet's general secure-storage API. That does not +move their semantics into Rivet. Rivet update-signing keys, platform publisher +credentials, and Permit credential-signing keys are separate trust domains and +must use separate keys and rotation procedures. The shared integration +contract lives at +[`Permit/docs/framework-integration.md`](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md). + Before roadmap, desktop-closeout, or mobile-delivery work, read `docs/desktop-closeout-mobile-plan.md`. It records the current decision, sequencing, exit criteria, evidence, and handoff state. diff --git a/CHANGELOG.md b/CHANGELOG.md index 113e527b..ec3169d1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,9 @@ ## Unreleased +- Document the product-level Permit composition boundary: Rivet remains a + framework with general secure storage and update integrity, not a built-in + entitlement, trial, activation, payment, or account system. - Give the installers a commercial first-run experience. The macOS DMG switches to the branded drag-to-install layout when the project declares `dmg-background`: the volume stages the bundle next to an `/Applications` diff --git a/README.md b/README.md index 4267beb4..9c210852 100644 --- a/README.md +++ b/README.md @@ -194,6 +194,16 @@ For publisher-signed output, use `raco rivet package --production` with the plat `release` adds the formal installer, independently signed update manifest, SBOM, and third-party notices. The shared updater covers authenticated check/download plus native macOS bundle swap, Windows MSI handoff, and Linux AppImage replacement, so products provide policy and UI instead of reimplementing security-critical plumbing. See [Release and updates](docs/release-and-updates.md); update signing keys are separate from Authenticode/Developer ID credentials. +### Product entitlements + +Commercial entitlements are deliberately outside Rivet's framework boundary. +Products that need offline-verifiable rights can compose Rivet with +[Permit](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md) +or another independent entitlement library; Rivet does not depend on it. +Products may use Rivet's general secure storage for credential state, while +product-rights signing, update signing, and platform code signing keep separate +keys and trust policies. + ## RPC, Event, State, Cancel ### Typed RPC diff --git a/README.zh-CN.md b/README.zh-CN.md index bd05afab..7dd6d239 100644 --- a/README.zh-CN.md +++ b/README.zh-CN.md @@ -192,6 +192,13 @@ raco rivet release `release` 会继续生成正式 installer、独立 Ed25519 签名的更新 manifest、SBOM 与第三方许可声明。共用 updater 负责可信检查与下载，并覆盖 macOS bundle 换装、Windows MSI 交接和 Linux AppImage 原子替换；产品只需要提供策略与本地化 UI，不再重复实现安全关键流程。更新私钥和平台发布证书彼此独立，详见[发布与更新](docs/release-and-updates.md)。 +### 产品权益授权 + +商业权益有意放在 Rivet 框架边界之外。需要离线可验证权益的产品可以将 Rivet 与 +[Permit](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md) +或其他独立权益库组合使用；Rivet 本身不依赖它。产品可以使用 Rivet 的通用安全存储 +保存凭证状态，但产品权益签名、更新签名和平台代码签名必须保持独立密钥与信任策略。 + ## RPC、Event、State、Cancel ### Typed RPC diff --git a/docs/architecture.md b/docs/architecture.md index 6bf7c655..14537740 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -256,6 +256,15 @@ RVT1 remains limited to typed application RPC, Event, State, Cancel, and lifecyc The Racket-facing modules are `rivet/distribution` and `rivet/system`. Native adapters live beside the existing WinUI and Swift runtime code and use platform-first APIs. This separation prevents distribution policy from changing the embedded runtime contract and keeps UI-thread objects under WinUI/AppKit ownership. +Commercial product rights stay outside that application-services boundary. A +product may compose Rivet with +[Permit](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md), +but Rivet does not depend on Permit and does not define entitlement, trial, +activation, seat, subscription, payment, or account policy. Rivet secure +storage remains general-purpose even when a product uses it for Permit state. +Update-manifest signing, OS publisher credentials, and Permit credential +signing are separate trust domains with separate keys and rotation procedures. + Cross-device communication is a second, explicit trust boundary. `RivetDevice` associates every Codable request with its response type, routes bounded/versioned envelopes, and can use WatchConnectivity through `RivetWatchConnectivityTransport`. The default watchOS architecture is therefore watch UI + typed companion channel + phone-hosted backend. The desktop-hosted companion direction reuses RVT1 framing only behind an authenticated device gateway that enforces a generated API subset; it does not expose the embedded backend socket. Its transport-independent authorization, session, pairing, authentication, revocation, secure Apple credential storage, byte-exact session preface, Apple TLS/SPKI stream adapter, per-install identity, disabled-by-default macOS listener, privacy-bounded Bonjour advertisement, macOS preface-session host, and explicit iOS Bonjour browser are implemented. The Apple client-session coordinator, product coordinator/gateway binding, native UI, and Windows secure storage/transport/discovery remain planned. See [typed device communication](device-communication.md) and the active [network device channel design](network-device-channel.md). An update crosses explicit trust boundaries: verify signed manifest, select policy-compatible artifact, download with a bound, verify signed size and SHA-256, invoke the platform installer, then either restart or execute the signed rollback policy. See [Release and updates](release-and-updates.md).