Architecture · Published 26 August 2026
Designing a creator operating system around a domain the creator owns
How the Name anchors identity, connected rooms, approvals, receipts, and a portable exit path.
The domain is the deed
A profile on a rented platform is a routing surface, not durable identity. cerilo begins with a Name whose registrant is the creator and uses it to anchor public identity, mail, publishing, deals, and handback.
Rooms share a workspace record but keep explicit schemas and permissions.
Publishing is a state machine
A draft becomes approved, scheduled, claimed, attempted, delivered or failed through durable transitions. Retry-with-jitter is recorded, not hidden inside a process timer.
Every adapter result produces a receipt tied to channel, revision, attempt, and workspace.
AI work spends a reserved budget
Before generation, the workspace transactionally reserves the allowed budget. Failure releases or settles the reservation according to one explicit state transition.
Prompts use creator-authorized source material and provider tokens remain inside the server boundary.
Pre-launch truth is part of design
Emulator evidence proves local journeys, not public scale or configured providers. Capability states distinguish live, local-only, preview, and external blocker.
The public site must preserve those states instead of manufacturing social proof.
Production checklist
- Verify Domain-first ownership against the deployed environment, not a screenshot.
- Verify Receipts for effects against the deployed environment, not a screenshot.
- Verify Transactional AI budget against the deployed environment, not a screenshot.
- Verify Truthful capability state against the deployed environment, not a screenshot.