Conversation
Chaptered messages, safe activity summaries, tool state, and context.
Working canvas
Drafts, media, evidence, plans, comparisons, and persisted artifacts.
Approval dock
Server-owned controls bound to durable job and action identities.
Trusted rendering pipeline
Unknown components, wrong-job or invented entity references, duplicate references, component/reference mismatches, authoritative titles, non-HTTP citations, and preview URLs outside authenticated routes fail validation.ApprovalReview is valid only in the approval slot for exactly one action that the supplied context marks pending. Loading, empty, unresolved, and failure components are host-owned and cannot be selected by Maya. Hydration supplies actual draft text, transcript excerpts, policy state, costs, asset routes, and receipts from authenticated records; the model never supplies those authoritative values.
Durable streaming
POST /api/chat/stream creates a tenant-scoped Firestore run. Each schema-validated NDJSON record receives a monotonic sequence number and is persisted before delivery. A disconnected client resumes with:
Upload boundary
Cloud uploads use a tenant-scoped resumable Cloud Storage URL. The server downloads the completed object, verifies size, declared type, and magic bytes, then keeps it quarantined until the configured private malware scanner returns a complete clean verdict for every byte. Infected objects and content mismatches are deleted; scanner outages remain quarantined and unavailable. Local development follows the same fail-closed scanner boundary with the local artifact store.
See Operator Interfaces for surface behavior and Approvals & Audit for authority.