Protected runtime: primitive execution, auth, receipts, verification posture, metering, carbon accounting, and internal route guards remain enforced by the cloud service. This portal is a public entry shell over the protected runtime.