Isolation

Layer	Knows	Must not know
Platform	Catalog, iframe host, logs/push	HEE internals, IO graph, Trivy policy
Surface App	Product UX, domain verifiers	HEE plugin registry, IO node ids
IO	Entrypoint, adapters, await-async	Verifier product rules
helix-ee	Job + workspace + baked plugins	Platform apps by name
Job processors	Wizard job contract	HEE plugins

Platform owns shared SSM /helix/github-app/*. Products must not share Node processes or import each other’s Lambda code.