Status: proposal, pending ratification — with one graduated part: the friction ladder below was ratified separately by decision 0017 and has its own page; the rest of this section remains proposal.

principle. a posture nobody can see is a posture nobody can trust. the suite’s verified habits — local files, no accounts, no phone-home — are only half the work; the other half is a face that lets a user check the claims instead of believing them.

rule (proposed).

• trust strip. every surface and the about page carry the same fixed component: who made this, where the official download lives, how to verify it, how to report a vulnerability. claims must be checkable; no trust theatre, no padlock clip-art.
• the “never does” list is measured, not asserted. each line (network: none; data collected: none) is backed by the verified build artefact, presented in nutrition-label shape: the claim and its measurement, side by side.
• permissions just-in-time. ask only when the user’s act obviously needs it; pre-explain in glaze’s own words; prefer limited scope over broad access. denial is a normal, degraded-but-working state, never a nag loop.
• capabilities card. before a connected surface pairs, it states in plain words exactly what it may and may not do, with per-capability toggles and a revoke-all. scopes, not trust: a remote surface may apply and undo, and may not open settings or edit the library; the default view of the user’s data, to anything new, is empty.
• masking. bystander-visible surfaces — ambient, lock-adjacent, shared-screen — show neutral state, never user-named content; a user’s names for their things are user data. reveal is deliberate; dismissal re-masks.
• update integrity, presented. the about page shows version, channel, “signature: verified”, and a checksum; an update shows its size and its verification result before install; a failed verification is a hard stop with one plain sentence and no override in the normal interface.
• locked states are designed states: locked, another session, a secure desktop — each states what shows and what waits, as design, not as accident.

---

Canonical text: §10, security presentation, in the design language document. The friction ladder graduated under decision 0017.