Read-only onboarding
No external writes.
Meta, TikTok, Google and checkout — read-only onboarding and contextual credentials.
Integrating real accounts must not, by itself, grant power to change them.
Read before any write.
Per-account isolation proof.
Encrypted credential, minimal scope.
No external writes.
Never a global token.
Breaker and health per provider.
New sources without touching the core.
Read-only lock on by default; per-account handshake.
Start in shadow mode: everything is simulated, nothing is published. You promote real execution when you decide.