{
  "$id": "https://docs.pipelinexlab.com/contracts/standalone-local-session.v1.json",
  "title": "Standalone local session contract",
  "contractVersion": "1.3.0",
  "decidedOn": "2026-09-02",
  "appliesTo": {
    "composition": "desktop-local",
    "starter": "the pipelinexlab Python SDK RuntimeManager",
    "doesNotApplyTo": "any composition whose authenticated context arrives from an identity service or launcher session"
  },
  "principal": {
    "form": "principal:standalone-local:<random-hex>",
    "minting": "generated by the RuntimeManager on first use and persisted in the user configuration directory (standalone-principal.json)",
    "identityRule": "the product principal is never derived from and never equal to an operating system account name; the two are different names that live on one machine",
    "stability": "stable across restarts through the persisted record; a machine whose configuration directory is unwritable gets a working session whose principal is not stable"
  },
  "membershipMembers": {
    "why": "the runtime lifecycle validates a closed five-member authenticatedCommandContext; the members exist to satisfy that closed shape",
    "organizationMembershipState": "the constant active, meaning only that this standalone session is not suspended or revoked locally; it asserts no cloud or organization membership",
    "workspaceMembershipState": "the constant active, with the same standalone meaning",
    "principalKind": "human"
  },
  "managedProfileBoundary": {
    "rule": "in a managed or organization profile the SDK never starts the runtime and never supplies an authenticated context: the authenticated launcher or session starts the supervisor itself with its own complete five-member context in the protected start envelope, and the SDK only attaches to the already-accepting endpoint (setting PXL_SDK_NO_AUTOSTART=1 makes a dead managed runtime an error instead of a standalone restart)",
    "principalOverrideScope": "PIPELINEXLAB_PRINCIPAL overrides only the principal reference of a standalone session; it cannot make a managed context, because the membership members and the principal kind stay the standalone constants whenever this SDK writes the envelope",
    "extensionRefusal": "this contract must not be read as an authorization model; extending the standalone constants into an organization permission decision is a contract violation, not a default"
  },
  "authority": {
    "lifecycleMembers": "pipelineXlab_pxflow/crates/pxflow-runtime/src/lifecycle.rs AUTHENTICATED_CONTEXT_MEMBERS",
    "minting": "pipelineXlab_pxflow/sdk/python/src/pipelinexlab/_runtime_manager.py _local_principal_ref"
  },
  "documentAuthority": {
    "enablement": "explicit-standaloneLocalSession-true-on-protected-inherited-start-channel-only",
    "owner": "private-authority-database-bound-once-to-standalone-principal-with-stable-random-authority-ref",
    "scope": "unmanaged-local-document-content-only-no-Organization-membership-or-AccessGrant-created",
    "restart": "Host-must-enable-mode-again-same-owner-and-authority-ref-required",
    "managedCustody": "any-managed-catalog-item-or-AccessGrant-refuses-binding-and-every-local-content-operation",
    "startupOrder": "validate-local-owner-before-ledger-startup-reconciliation",
    "admission": "active-human-standalone-context-and-current-database-owner-each-operation",
    "portableData": "no-local-authority-token-or-owner-record-in-Report-or-export-bytes",
    "availability": "public-retention-and-selected-derived-portability-on-explicit-stable-standalone-desktop-local",
    "ephemeralPrincipal": "existing-authoring-remains-available-but-durable-document-authority-is-not-enabled-without-a-persisted-or-explicitly-configured-principal"
  }
}