← Models

# Text→mesh→voxel — commercial safety

## Promise to paying customers

**Paying never makes your model free for others to download.**

| | |
|--|--|
| **You get** | Private export (`.nbt` + stills) via a secret `access_token` |
| **Others get** | Nothing from your job — no public nbt, no open job links |
| **Cubit may** | **Retain every successful model** privately (mesh + `.nbt` + stills + catalog) for ops, quality, curation, and later outreach — **not** a free public download store |
| **Public gallery** | Only if you **opt in** (`public_opt_in`) — off by default, never forced by payment |

## What is public vs private

| Surface | Public? |
|---------|---------|
| `/api/catalog/stats` | Aggregate counts only (no prompts, no job ids) |
| `/api/catalog` | Redacted: no `job_id`, no paths, no full prompt for private/paid |
| `/api/jobs/{id}/export.nbt` | **Token required** (unless explicit public opt-in) |
| `/api/jobs/{id}/render/*` | **Token required** same as nbt |
| `/api/jobs/{id}/result` | **Token required** |
| Internal `builds.jsonl` | Server-local; do not ship in client bundles |

## License (customer-facing)

1. **Export ownership:** The generated `.nbt` (and stills) delivered to you are licensed for your personal and commercial Minecraft use (maps, servers, videos), subject to Mojang/Microsoft game terms.
2. **No resale of the raw generation service output as a competing AI model library** without a separate deal — you can use builds in your worlds/content freely.
3. **Privacy default:** Paid and unpaid generations are **private**. We do not list your model in a free download gallery because you paid.
4. **Internal retention:** Cubit **stores all successful models** server-side (including private paid builds) for support, quality, curation, and possible future outreach. Retention ≠ publication: files stay private unless you opt in. Telemetry (tier, backend, voxel counts, prompt hashes) may also be kept.
5. **Opt-in gallery only:** Explicit consent required to mark a build `public_opt_in` for marketing samples.
6. **Third-party mesh APIs:** Remote mesh steps may use commercial generation APIs under their terms. Do not generate illegal/harmful content; we may refuse or log abuse.
7. **No trademark bait:** Do not prompt for others’ protected IP as if Cubit grants those rights (characters, brands). Customer is responsible for prompt legality.
8. **Refunds:** Follow site refund policy for failed generations (no mesh / server error). Successful private delivery is final unless we cannot deliver the file.
9. **Bring-your-own-mesh (BYOM):** Validation is always free. Credits/USD are charged **only after** a successful `.nbt` export. Rejected formats (`.fbx`, `.blend`, corrupt GLB, oversize, too many faces, etc.) never debit the customer. See `/api/byom/constraints` and `/byom`.

## Engineering rules (do not regress)

1. Never put `job_id` of paid builds in a public catalog response.
2. Never serve `export.nbt` without `access_token` (except opt-in public).
3. Never set `public_gallery=true` automatically because `paid=true`.
4. `find_by_prompt` for “prior matches” returns counts only to clients, not download links.
5. Stripe metadata may store prompt snippet for support — not for public SEO pages.

## Ops

- Job ACL files: `data/jobs/<id>/acl.json` (contains secret token — protect disk backups).
- Catalog: `data/catalog/builds.jsonl` — private ops data (every success).
- **Vault:** `data/vault/entries/<job_id>/` — permanent private copies of mesh/nbt/renders; index `data/vault/index.jsonl`.
- Ops list: `GET /api/ops/vault` (requires `CUBIT_OPS_TOKEN` when set; lab default `ALLOW_OPS=1`).
- Backfill: `POST /api/ops/vault/backfill` or `python -m primitives.model_vault`.
- Rotate tokens: not implemented; treat token like a download password.
- **Do not auto-delete** vault entries or successful job dirs without an explicit purge policy.