System architecture

One product. Two planes. One explicit boundary.

Private work belongs to the desktop runtime. Discovery, identity, and commerce belong to the web control plane. A Living Surface is the creator-submitted product boundary between them, never a copy of the creator's working vault.

Desktop runtime firstRaw owner data local by defaultExplicit marketplace publicationCreator as legal seller

Architecture

Private work runs locally. Discovery and commerce run on the web.

Lorevik separates the runtime from the marketplace. Your vault, raw inputs, owner Data JSON, agent sessions, and routines stay on your machine by default. The web handles accounts, listings, submitted listing metadata, transactions, and explicit package delivery.

Desktop runtime

Private work happens here

Local by default

Local vault

Plain files you can inspect, move, and back up.

Local bridge

Connects the visible Surface to the desktop runtime.

Your agent

Claude Code, Codex, or another compatible local runtime.

Living Surface

An interface filled with owner data on the owner's machine.

Routine closes the local loop

Refresh a Surface or reopen a saved board without turning the owner's workspace into a cloud job.

Explicit submit

Creator chooses the distribution package

Web control plane

Discovery, identity, and commerce

Accounts

Identity and creator profiles

Listings

Public descriptions and submitted listing metadata

Consent and audit

Records and hashes, not raw owner files

Commerce

Launch-gated transactions and bundle delivery

For the live workspace, cloud services receive submitted listing metadata, not raw owner vault contents. Marketplace publication is a separate, explicit path for a creator-submitted distribution bundle.

Buyer installs into a different local vault

Implemented

Local vault, bridge, Living Surface runtime, and routines

Launch-gated

Paid marketplace delivery and real-money direct charges

Not final

The full capability matrix and purchaser licence schedule

Living Surface package

The creator ships the method. The owner supplies the private data.

One folder can begin with a single instruction file, then grow into an interactive product. Missing optional layers degrade honestly instead of inventing data or showing a blank screen.

Required
Human-readable skill
The instruction layer explains what the Surface does and how a local agent should maintain it.
Optional
Self-contained interface
The creator can include the view, or the owner can generate it locally from the skill.
Local
Owner data
Private Data JSON is added after installation and remains separate from the marketplace package.

Marketplace money flow

The buyer pays the creator, not a platform wallet.

Creator product sales use Stripe Connect Standard direct charges. The creator is the merchant and legal seller of record. Lorevik receives the disclosed application fee and does not first collect creator revenue to distribute later.

Buyer

Purchases a creator product

Direct charge

Merchant of Record

Creator connected account

Revenue, Stripe fees, reserves, payout schedule, and seller obligations remain with the creator and Stripe.

App fee

Lorevik

Standard application fee: 10%. Promotional rates may apply; the hard cap is 15%.

Lorevik Creator membership is a separate platform subscription.Real-money checkout remains launch-gated

Removal boundary

Removing a listing is not the same as disabling a purchase.

Normal removal

Stop new distribution

Unpublishing stops new sales and distribution. It does not by itself terminate existing purchaser licences, revoke ordinary access, or disable installed copies.

Extreme removal

Narrow emergency containment

Reserved for malicious code, a serious security vulnerability, a binding legal order, or confirmed infringement. Affected content may be quarantined or limited only where necessary and proportionate.

The current quarantine path is narrow and launch-gated. It is not a general-purpose remote kill switch, and ordinary refunds do not use it.

Honest boundaries

What Lorevik does not claim yet.

Product architecture is real only when its permissions and legal promises match. These schedules remain deliberately open rather than being guessed into the website.

Capability schedule: The final rules for shell commands, owner API keys, connectors, plugins, and MCP access are not yet published.
Purchaser licence: Modification, derivative works, workplace sharing, package sharing, and device limits are not yet final.
Disputes: Chargeback allocation and its effect on access, creator balances, and platform fees still require legal and operational approval.

Read the operating terms behind the architecture.

Lorevik Pty Ltd remains proposed, and qualified legal review is still required before commercial launch.

Open legal documents