# AetherDesk signing and release integrity

This document is the commercial release trust lane for AetherDesk portable pilot builds.

## Current trust state

AetherDesk now ships with a deterministic release integrity manifest:

- `dist/aetherdesk-portable/RELEASE_INTEGRITY.json`
- `dist/aetherdesk-portable-latest-integrity.json`
- `npm run aetherdesk:release:integrity`
- `npm run aetherdesk:release:verify`

The manifest records SHA-256 hashes, byte counts, file count, and one overall package hash for the portable package. Runtime/customer state is intentionally excluded:

- `artifacts/`
- `node_modules/`
- `.git/`
- `*.log`

That keeps verification focused on shipped product files, not logs, receipts, local config, or installed dependencies.

## Release flow

1. Build the portable package:

```powershell
npm run aetherdesk:package:portable
```

2. Generate the integrity manifest:

```powershell
npm run aetherdesk:release:integrity
```

3. Verify the package before delivery:

```powershell
npm run aetherdesk:release:verify
```

4. Run the package smoke when changing install/start scripts:

```powershell
npm run aetherdesk:package:smoke
```

## Certificate signing status

The portable package is not certificate-signed yet. That is the next trust layer after pilot packaging:

- Sign PowerShell scripts and binary wrappers with a Windows code-signing certificate.
- Keep `.cmd`/`.bat` launchers hash-covered by release integrity, or replace them with signed executable wrappers before broad public sale.
- Publish the certificate identity and hash beside `RELEASE_INTEGRITY.json`.
- Keep `AETHERDESK_POWERSHELL_MAX_ACCESS=read-only` as the default customer-safe startup mode.
- Treat host-write enablement as an explicit support/pro/operator action, not a default commercial behavior.

Until certificate signing exists, the integrity manifest is the concrete trust receipt for paid pilots.

## Signed artifact preflight

Run the preflight without writing public-sale approval:

```powershell
npm run aetherdesk:release:signed-artifacts
```

When a real certificate is configured and every Authenticode-signable release file validates against it, write the public-sale manifest:

```powershell
$env:AETHERDESK_CODE_SIGNING_CERT_SHA256 = "<sha256-of-public-code-signing-certificate>"
npm run aetherdesk:release:signed-artifacts:write
```

The write command refuses to create `dist/aetherdesk-portable/SIGNED_ARTIFACTS.json` unless release integrity exists, the certificate hash is configured, signatures are valid, and the signer certificate matches the configured hash.

## Public-sale readiness

Use `artifacts/aetherdesk_public_sale_readiness/latest.json` as the machine-readable blocker ledger before any broad distribution. Pilot entitlement is not public-sale approval.

Use the redacted config preflight before entering real payment or licensing secrets:

```powershell
npm run aetherdesk:public-sale:config
```

That preflight reports whether payment provider, entitlement provider, license-secret strength, legal review, and optional public customer URLs are configured without writing secret values to artifacts.
