turinglambdaai · Oct 15, 2026 · Oct 15, 2026
diff --git a/AGENTS.md b/AGENTS.md
@@ -13,6 +13,23 @@ transport, or mix distribution/system services into the embedding lifecycle.
 Mobile support must be described by its actual maturity: a portable runtime or
 typed companion foundation is not yet a generated, packaged application flow.
 
+### Commercial entitlement boundary
+
+Rivet owns application runtime, native UI, general secure storage,
+distribution, and update integrity. It does not own product entitlements,
+trials, activations, seats, subscriptions, payments, or accounts. Commercial
+products may depend on Rivet and
+[Permit](https://github.com/turinglambdaai/permit) independently, but Rivet
+must not depend on Permit or grow a built-in licensing subsystem.
+
+A product may store Permit credentials, local-trial state, or an
+`installation_id` through Rivet's general secure-storage API. That does not
+move their semantics into Rivet. Rivet update-signing keys, platform publisher
+credentials, and Permit credential-signing keys are separate trust domains and
+must use separate keys and rotation procedures. The shared integration
+contract lives at
+[`Permit/docs/framework-integration.md`](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md).
+
 Before roadmap, desktop-closeout, or mobile-delivery work, read
 `docs/desktop-closeout-mobile-plan.md`. It records the current decision,
 sequencing, exit criteria, evidence, and handoff state.

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 ## Unreleased
 
+- Document the product-level Permit composition boundary: Rivet remains a
+  framework with general secure storage and update integrity, not a built-in
+  entitlement, trial, activation, payment, or account system.
 - Give the installers a commercial first-run experience. The macOS DMG
   switches to the branded drag-to-install layout when the project declares
   `dmg-background`: the volume stages the bundle next to an `/Applications`

diff --git a/README.md b/README.md
@@ -194,6 +194,16 @@ For publisher-signed output, use `raco rivet package --production` with the plat
 
 `release` adds the formal installer, independently signed update manifest, SBOM, and third-party notices. The shared updater covers authenticated check/download plus native macOS bundle swap, Windows MSI handoff, and Linux AppImage replacement, so products provide policy and UI instead of reimplementing security-critical plumbing. See [Release and updates](docs/release-and-updates.md); update signing keys are separate from Authenticode/Developer ID credentials.
 
+### Product entitlements
+
+Commercial entitlements are deliberately outside Rivet's framework boundary.
+Products that need offline-verifiable rights can compose Rivet with
+[Permit](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md)
+or another independent entitlement library; Rivet does not depend on it.
+Products may use Rivet's general secure storage for credential state, while
+product-rights signing, update signing, and platform code signing keep separate
+keys and trust policies.
+
 ## RPC, Event, State, Cancel
 
 ### Typed RPC

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -192,6 +192,13 @@ raco rivet release
 
 `release` 会继续生成正式 installer、独立 Ed25519 签名的更新 manifest、SBOM 与第三方许可声明。共用 updater 负责可信检查与下载，并覆盖 macOS bundle 换装、Windows MSI 交接和 Linux AppImage 原子替换；产品只需要提供策略与本地化 UI，不再重复实现安全关键流程。更新私钥和平台发布证书彼此独立，详见[发布与更新](docs/release-and-updates.md)。
 
+### 产品权益授权
+
+商业权益有意放在 Rivet 框架边界之外。需要离线可验证权益的产品可以将 Rivet 与
+[Permit](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md)
+或其他独立权益库组合使用；Rivet 本身不依赖它。产品可以使用 Rivet 的通用安全存储
+保存凭证状态，但产品权益签名、更新签名和平台代码签名必须保持独立密钥与信任策略。
+
 ## RPC、Event、State、Cancel
 
 ### Typed RPC

diff --git a/docs/architecture.md b/docs/architecture.md
@@ -256,6 +256,15 @@ RVT1 remains limited to typed application RPC, Event, State, Cancel, and lifecyc
 
 The Racket-facing modules are `rivet/distribution` and `rivet/system`. Native adapters live beside the existing WinUI and Swift runtime code and use platform-first APIs. This separation prevents distribution policy from changing the embedded runtime contract and keeps UI-thread objects under WinUI/AppKit ownership.
 
+Commercial product rights stay outside that application-services boundary. A
+product may compose Rivet with
+[Permit](https://github.com/turinglambdaai/permit/blob/main/docs/framework-integration.md),
+but Rivet does not depend on Permit and does not define entitlement, trial,
+activation, seat, subscription, payment, or account policy. Rivet secure
+storage remains general-purpose even when a product uses it for Permit state.
+Update-manifest signing, OS publisher credentials, and Permit credential
+signing are separate trust domains with separate keys and rotation procedures.
+
 Cross-device communication is a second, explicit trust boundary. `RivetDevice` associates every Codable request with its response type, routes bounded/versioned envelopes, and can use WatchConnectivity through `RivetWatchConnectivityTransport`. The default watchOS architecture is therefore watch UI + typed companion channel + phone-hosted backend. The desktop-hosted companion direction reuses RVT1 framing only behind an authenticated device gateway that enforces a generated API subset; it does not expose the embedded backend socket. Its transport-independent authorization, session, pairing, authentication, revocation, secure Apple credential storage, byte-exact session preface, Apple TLS/SPKI stream adapter, per-install identity, disabled-by-default macOS listener, privacy-bounded Bonjour advertisement, macOS preface-session host, and explicit iOS Bonjour browser are implemented. The Apple client-session coordinator, product coordinator/gateway binding, native UI, and Windows secure storage/transport/discovery remain planned. See [typed device communication](device-communication.md) and the active [network device channel design](network-device-channel.md).
 
 An update crosses explicit trust boundaries: verify signed manifest, select policy-compatible artifact, download with a bound, verify signed size and SHA-256, invoke the platform installer, then either restart or execute the signed rollback policy. See [Release and updates](release-and-updates.md).