Checklist
- Product-building request and runtime-agent task are written separately.
- API key is server-side only.
- Browser sends feature key and input, not arbitrary harness IDs.
- Every run has an
Idempotency-Key. - The stream parser dispatches on
data.type. - Response and session IDs are saved from
response.created. - Continue, cancel, preview, and download verify product ownership first.
- Generated HTML and code are isolated before preview.
- A representative end-user task was tested through the product UI.