Workspace visibility
A workspace is born public or born private, and which one is not a choice you make on the form: it follows the account the workspace is created in. Every workspace under your openproduct account is born public; every workspace under a standard account is born private. The door only swings one way after that: a public workspace can later be made private, and a private workspace can never be made public. There is no override — not for support, not for an admin, not in SQL (a database trigger refuses the transition with the remedy in the error).
Public means eligible, never readable. A public workspace may list its products on openproduct — a listing exposes the pitch, the maintainers you explicitly publish, and open roles. It does not open the workspace's data: the audit log, runs, agent sessions, secrets, configuration, catalog, member roster and spend stay exactly as private as in a private workspace, served by the same deny-by-default surfaces.
The openproduct account
Each person has at most one openproduct account. It is created for you the first time you list a product — you never create it by hand, and it is always called openproduct. It is free and stays free: it has no plan to change and no billing page, and it is not counted against the accounts you may own. It is not a place the console creates workspaces from: its workspaces come from one door.
The one path to a public workspace
- On openproduct.live, open Create and describe your product — a name, a one-liner, a pitch. Sign in when you submit; what you typed survives the sign-in.
- The console lands you on one confirm screen — "Create Kettleworks as a public workspace in your openproduct account." — with the name editable and one button.
- It ensures your openproduct account, creates the workspace in it (born public), creates the workspace's first project, mints the listing link, and hands you to openproduct's studio with the listing prefilled. If a step fails, Try again resumes at that step; nothing is created twice.
There is no Public workspace switch on the create form and no account setting to enable — both used to exist, and both are gone.
Linking a workspace you already have
Every product you start this way becomes its own workspace in your openproduct account. To list one you started but never finished listing, or to relink a listing's draft, use Link a workspace in openproduct's studio. It opens a console page that lists your openproduct workspaces (where you are an owner or admin), then the chosen workspace's projects, and sends you back to the studio with the listing link. Your other accounts' workspaces are never listed there, and openproduct itself never sees the list: it only ever holds a sign-in token that can read your name.
Why the door is one-way
Making an existing workspace public would mean retroactively auditing everything it ever accumulated — an audit trail, agent-session transcripts, secret metadata, run logs, a member roster — and proving none of it reaches the public surface. A workspace that was never private has nothing to redact, so the honest moment to decide is creation, before there is any history to audit. An "exception process" for the reverse direction is how such rules erode, so none exists.
What being public changes
| Concern | Public workspace |
|---|---|
| Members | Free. Members and pending invitations never count toward limit.members — approving contributor four hundred is as unremarkable as approving contributor four. The seat gate is skipped (and logs the skip); narrowing to private brings the seats back. |
| Compute | Metered normally. Nothing about being public makes a run free — the credit wallet and budget envelopes gate the dispatch door exactly as on a private workspace, billed to the workspace's own account. |
| Concurrency | Hard ceiling of 5 in-flight agent sessions, independent of plan, at both dispatch paths (tasks and routines). The refusal names the ceiling. This is the abuse bound that makes free membership safe to offer. |
| Listings | Eligible. Publishing a listing still takes everything it always took: a linked public repository, a pitch, and a one-time admin review. A private workspace sees workspace_private as the first publish blocker. |
| Narrowing | Owner-only. Making a public workspace private unlists every listing (within the cache TTL) and cannot be reversed. |
| Billing | The openproduct account has no billing page; a bookmarked billing address lands on the account overview with one line. Usage is still metered and attributed; a free account with no payment method produces the same zero-charge statement any free account does. |
"I built it private and now I want to list it"
You don't flip the workspace — you can't. The path is the one above: create the product from openproduct.live, and it lands in your openproduct account as a new public workspace. Then link the repository to a project there and publish the listing from the public workspace.
A repository has one active link at a time. If it is still linked in your private workspace, adding it to the public one is refused with "This repository is already linked to another workspace. Unlink it there first." — unlink it from the private workspace (Settings → Repositories), then add it in the public one. First claim wins, and the message never says which workspace holds the claim.
History does not travel, deliberately: the private workspace keeps its audit trail, runs and sessions, and the public one starts clean — which is the entire point of the rule.
API
| Method | Path | Notes |
|---|---|---|
PUT | /v1/accounts/openproduct | Ensure the caller's openproduct account: 200 { account, created: false } when it exists, 201 { account, created: true } when it did not. No body. |
POST | /v1/organizations | Name the account with accountId. Visibility is derived — public under an openproduct account, private otherwise — and a visibility field in the body is refused (422). |
PATCH | /v1/organizations/{ref} | visibility: "private" narrows (owner-only, its own request — not combinable with a rename); "public" is refused with visibility_widening_refused. |
POST | /v1/organizations/{ref}/billing/… (plan change, checkout, portal, top-up) | Refused on the openproduct account with 412 openproduct_account_not_billable. |
POST | /v1/organizations/{ref}/listing-link-grants | Mint the listing link for one project ({ "projectId" }), owner or admin only. Refused with 412 and blocker workspace_private on a private workspace, and workspace_not_openproduct on any workspace outside an openproduct account. |
| — | events | organization.visibility_narrowed, audited. |
Every organization read carries visibility on a workspace and accountKind (standard or openproduct) on an account root.