# AetherDesk Commercial Release Readiness

This file tracks the path from technical preview to sellable portable product.

## Current sellable shape

AetherDesk is suitable for paid pilots and custom installs when positioned as a local AI workstation preview.

It is not yet a no-support self-serve consumer app.

## Hard invariants

- PowerShell max access defaults to `read-only`.
- Host-write cannot be armed by UI alone.
- MCP hooks may persist toggle intent, but not secret values.
- System Access actions must leave receipts.
- Portable releases preserve customer `artifacts/` state across updates.

## Portable release lane

Build:

```powershell
npm run aetherdesk:package:portable
```

Output:

```text
dist/aetherdesk-portable/
```

Customer entry point:

```text
START-AETHERDESK.cmd
```

Current-user install:

```text
INSTALL-AETHERDESK.cmd
```

Safe upgrade:

```text
UPGRADE-AETHERDESK.cmd
```

Release metadata:

```text
dist/aetherdesk-portable/RELEASE_MANIFEST.json
dist/aetherdesk-portable-latest.json
```

## Required checks before a paid handoff

```powershell
npm run aetherdesk:system-access:hardening
npm run aetherdesk:auth-hooks:smoke
npm run aetherdesk:package:smoke
```

Manual visual check:

```text
Open the app, click the SA tray button, confirm:
- POWER ACCESS: READ-ONLY
- MCP hook quick toggles are visible
- Headless check passes
- Real PowerShell read-only sample returns a version
- denied PowerShell writes create denied receipts
```

## Still not done for broad commercial release

- Signed Windows installer or bundled executable.
- Real OAuth flows through the owning connector surfaces.
- Final legal review of the draft license, privacy, security, and support pages.
- Signed installer and code-signing certificate.
- Paid onboarding script and customer support process around the current support runbook.

## Release integrity lane

Commercial pilot builds now include a concrete package-trust step before certificate signing:

- `npm run aetherdesk:package:portable` builds `dist/aetherdesk-portable`.
- `npm run aetherdesk:release:integrity` writes `dist/aetherdesk-portable/RELEASE_INTEGRITY.json`.
- `npm run aetherdesk:release:verify` recomputes SHA-256 hashes and fails on changed, missing, or extra shipped files.
- `npm run aetherdesk:release:signed-artifacts` checks Authenticode signatures and certificate-hash readiness without writing approval.
- `npm run aetherdesk:release:signed-artifacts:write` writes `dist/aetherdesk-portable/SIGNED_ARTIFACTS.json` only after real signing evidence passes.
- `npm run aetherdesk:public-sale:config` checks payment, entitlement, license-secret strength, legal-review marking, and optional public URLs with redacted evidence only.
- `docs/SIGNING_AND_RELEASE.md` documents the current integrity lane and the future Windows certificate-signing path.

Status: integrity manifest implemented; signed-artifact preflight implemented; real certificate signing remains future hardening before broad public sale.

## Commercial gate command

Before handing a paid pilot package to a customer, run:

```powershell
npm run aetherdesk:commercial:gate
```

The gate rebuilds the portable package, generates/verifies release integrity, runs the package smoke, creates a support bundle, and writes JSON/Markdown receipts under `artifacts/commercial_gate/`. Optional live route hardening can be included by setting `AETHERDESK_COMMERCIAL_GATE_LIVE=1` when a fresh local server is available.

The gate also refreshes signed-artifact and public-sale config preflights before writing the public-sale readiness ledger. These preflights are evidence surfaces, not fake public-sale approval.

## Agent workflow spine for paid pilots

The AI PC workflow spine is now part of pilot readiness. It gives humans and agents one shared route to discover and run allowlisted system operations while preserving receipts:

- `GET /api/agent/workflows`
- `POST /api/agent/workflows/:id/run`
- `GET /api/agent/workflows/receipts`
- `npm run aetherdesk:agent-workflows:smoke`

See `docs/AGENT_WORKFLOW_SPINE.md` for the exact safety shape.

Commercial gate now also runs `npm run aetherdesk:agent-workflows:smoke` as a required step, so paid-pilot receipts prove the shared workflow spine is discoverable, runnable, and receipted.

Commercial gate now also runs the workflow UI-contract smoke, verifying the Workflow Library-to-backend workflow wiring as part of pilot readiness.

Commercial gate now includes `npm run aetherdesk:ops:digest` as a required step, so each gate run leaves a consolidated operational handoff in `artifacts/aetherdesk_ops_digest/`.

Commercial gate now includes `npm run aetherdesk:ops:autopilot` as a required plan-only step. This proves the AI PC can derive safe next operations from its own digest without enabling arbitrary host control.

Commercial gate now includes `npm run aetherdesk:system:catalog` as a required orientation step, so paid-pilot receipts prove agents have a current map of scripts, workflows, roots, docs, and artifact lanes.

Commercial gate now includes `npm run aetherdesk:mission:packet` as a required handoff step. This proves each release candidate includes a current agent onboarding packet derived from catalog, digest, autopilot, workflows, routes, and safety rules.

Commercial gate now includes `npm run aetherdesk:ai-pc:scorecard` as a required evidence step. This gives every release candidate a measurable AI-PC readiness score and explicit gap list.

Commercial gate now includes `npm run aetherdesk:agent:bootstrap` as a required first-call entrypoint step. This proves release candidates include one compact route for agent onboarding and safe operation.

## Visual proof commercial boundary

The commercial gate now includes the visual proof doctor. A passing paid-pilot gate means the source UI contract, workflow wiring, support bundle, release integrity, and visual-readiness diagnosis completed. It does not mean broad public-sale visual QA is finished unless `artifacts/aetherdesk_visual_proof/latest.json` reports `live_browser_visual: true` from a real browser/screenshot proof.

Current sales language should stay at paid-pilot readiness until live visual proof, signing, licensing/payment automation, and multi-machine soak testing are complete.

## Live visual proof sales rule

The commercial gate now runs the live visual proof attempt before the visual proof doctor. A passing gate proves the attempt was receipted without hanging. It only proves live visual QA when `artifacts/aetherdesk_live_visual_proof/latest.json` has `proof_ok: true` and the AI PC scorecard has no `live_visual_proven` risk.

## Control-plane sales rule

The commercial gate now runs the self-hosted control-plane proof. This upgrades paid-pilot readiness because safety claims are backed by a portable artifact: MCP hooks/toggles, sign-in intents, Sieve tools, headless route checks, PowerShell denial, and access-tier receipts are exercised without requiring an already-running customer server.

## Soak recovery sales rule

The commercial gate now includes the soak recovery proof. A passing gate means the core visual, control-plane, doctor, bootstrap, and scorecard evidence stayed healthy across bounded repeated cycles. This is still a paid-pilot readiness claim, not a substitute for multi-machine beta soak, crash telemetry, signed installers, or customer licensing automation.

## Customer readiness sales rule

The commercial gate now includes the customer-machine doctor. A passing gate means the package can produce a redacted customer support receipt for Node, npm, PowerShell, package scripts, modules, port posture, and artifact writes. This improves paid-pilot supportability, but does not replace signed installers, entitlement automation, or multi-machine beta results.

Update: commercial gate runs the customer doctor and soak recovery before workflow smoke so a fresh package can generate those latest route artifacts before the route smoke reads them.

## License entitlement sales rule

The commercial gate now includes the license entitlement proof. A passing gate proves paid-pilot entitlement readiness: customer/package/machine hashes, pilot term, enabled feature list, and public-sale blockers are receipted. It does not mean public-sale licensing is complete unless the receipt is signed and payment/entitlement provider plus code-signing certificate are configured.

## Public-sale blocker ledger

The commercial gate now includes `npm run aetherdesk:public-sale:readiness`. This separates paid-pilot readiness from broad public sale. The artifact can pass while `public_sale_ready` is false; blockers remain until code-signing certificate hash, payment provider, entitlement provider, license secret/signing, signed artifact manifest, and legal/release approval evidence are configured.
