Conversation
Chaptered messages, safe activity summaries, tool state, and context.
Working canvas
Typed content artifacts, media, evidence, plans, comparisons, and receipts.
Approval dock
Server-owned controls bound to durable job and action identities.
Trusted rendering pipeline
Unknown components, wrong-job or invented entity references, duplicate references, component/reference mismatches, authoritative titles, non-HTTP citations, and preview URLs outside authenticated routes fail validation.ApprovalReview is valid only in the approval slot for exactly one action that the supplied context marks pending. Loading, empty, unresolved, and failure components are host-owned and cannot be selected by Maya. Hydration supplies exact content-artifact payloads, transcript excerpts, policy state, costs, asset routes, and receipts from authenticated records; the model never supplies those authoritative values.
Durable streaming
POST /api/chat/stream creates a tenant-scoped DynamoDB run and returns the official AI SDK UI message SSE protocol. Each validated chunk derives from a monotonic durable event persisted before delivery. @ai-sdk/react uses a custom ChatTransport to reconnect through:
UIMessageChunk is stored directly with its own monotonic chunk sequence before delivery. The stable assistant message and data-part IDs make replay replace the in-flight message without duplicating text or surfaces. Persisted UI message history is validated with validateUIMessages plus Harmonia’s strict surface schema before use. This is durable transport streaming. It does not claim direct provider-token streaming when the bounded provider invocation returns a complete result.
Upload boundary
Cloud uploads use a tenant-scoped presigned S3 request. The server verifies the completed object size, declared type, and magic bytes, then keeps it in the S3 quarantine prefix until the private malware scanner returns a complete clean verdict for every byte. Infected objects and content mismatches are deleted; scanner outages remain quarantined and unavailable. Local development follows the same fail-closed boundary with versioned MinIO.
See Operator Interfaces for surface behavior and Approvals & Audit for authority.