Ship

Platform rules

Invariants. Code that violates them is broken even if it runs.

These are the lines Villow will not cross for a publisher, including when the user picked decide for me.

1. No raw OAuth tokens or credentials on the publisher side. Grants only.
2. Writes, sends, and deletes stage first. The user approves. Always.
3. Capture never exceeds the authorized hold.
4. Every clarification includes decide_for_me. Caps: 3 before execute, 2 during, 5 total. Idle input auto-cancels after 24 hours.
5. Active execution is capped at 30 minutes per priced unit.
6. Requests are mutually signed. Idempotency keys on every state change.
7. One agent per priced unit in V1. The classifier never plans multi-agent workflows.

If a log line, artifact, or callback body contains an access_token, refresh_token, or password, the review fails. Strip it in the SDK layer, not in a later ‘cleanup’ job.