TITIP-001 Product principles

Purpose

Make the five product principles binding on every repository, screen, job, prompt, and integration.

The prose lives in product/principles.md. This spec is the requirement form.

Every user-visible flow and every API that persists owner data must be classifiable under principle 1: it records guidance, or it refuses the write. A field whose purpose is to store a secret must not be added to a schema in contracts/schemas/.
No component must treat elapsed silence, a missed webhook, or last_seen alone as release eligibility (principle 2).
Authorization checks must be vault-and-recipient scoped (principle 3). An authenticated recipient session must not imply access to unassigned vaults.
A transition to ELIGIBLE, RELEASED, or a simulated equivalent must cite evidence codes and a policy_version (principle 4). See TITIP-010.
Any model, prompt, or agent must not output a death, inactivity, or release-eligibility decision (principle 5). See TITIP-012.
Copy must not describe Titip as a password manager, notary, lawyer, or estate executor.

A reviewer can point at these five requirements when rejecting a pull request in any sibling repository.
The prototype demo script in plans/prototype.md illustrates all five without performing a real release.