moving

docs/code-signing-pilot-and-launch.md

@@ -1,5 +1,14 @@
 # Code-Signing Playbook — Pilot + Public Day 0
 
+> [!CAUTION]
+> Only `tauri:build:win:pilot-signed` below is current internal-pilot guidance.
+> macOS is deferred; its historical commands are not release certification.
+> **PARTIALLY SUPERSEDED — DO NOT USE THE PUBLIC-SIGNING SECTIONS.** The pilot
+> history remains valid for internal RC evidence. Public Windows signing now
+> uses the protected exact-tag GitHub workflow with Azure OIDC/federated identity;
+> client-secret service-principal flows below are invalid. Current ship authority
+> is `docs/production-readiness/09-LAUNCH_RECOMMENDATION.md`.
+
 **Decision (2026-05-07):** Self-sign for pilot (Wave-1 Egzakta-internal, T+10 = 2026-05-16). Procure real certs in parallel for public Day 0 (T+30 = 2026-06-05).
 
 **Why split:** Real Authenticode + Apple Developer ID have 5-15 business-day lead times. Self-signing unblocks the pilot ship date without paying for certs that aren't usable until a vetting check completes.
@@ -25,8 +34,9 @@ npm run tauri:sign:pilot:win:setup
 npm run tauri:sign:pilot:win:apply
 
 # 3. Build — Tauri's MSI/NSIS bundlers pick up the thumbprint from the
-#    override config and sign automatically.
-npm run tauri:build:win
+#    explicitly passed override config and sign automatically. The plain
+#    tauri:build:win command does not load this override.
+npm run tauri:build:win:pilot-signed
 
 # 4. (Optional, redundant safety) Re-sign the produced MSI explicitly
 #    via signtool. Useful if you want to apply timestamp at a different time
@@ -46,7 +56,10 @@ npm run tauri:sign:pilot:win:sign -- src-tauri/target/release/bundle/msi/Waggle_
 
 ### 1.2 macOS self-sign (ad-hoc)
 
-**Already wired (LAUNCH-06).** `app/src-tauri/tauri.build-override.conf.json` ships with `bundle.macOS.signingIdentity = "-"`, so every `npm run tauri:build:mac` produces an ad-hoc-signed `.app` automatically — no operator step required.
+> **HISTORICAL / ROADMAP ONLY.** macOS is outside the Windows-first launch cohort
+> and has no current package certification. `npm run tauri:build:mac` does not
+> automatically load `tauri.build-override.conf.json`; do not label its output
+> signed merely because the override contains `signingIdentity = "-"`.
 
 **Re-sign + verify wrapper.** For nested helpers (sidecar, native deps) Tauri's bundler may miss, run:
 
@@ -85,6 +98,15 @@ Subject: **Welcome to Waggle Wave-1 — install + first-run notes**
 
 ---
 
+<details>
+<summary><strong>Archived public-signing history — do not execute</strong></summary>
+
+> The remainder of this document preserves obsolete vendor, local-thumbprint,
+> client-secret, timeline, and cost notes for audit history only. Current public
+> Windows signing is the protected exact-tag Azure OIDC workflow in
+> `.github/workflows/release.yml`; current ship authority is
+> `docs/production-readiness/09-LAUNCH_RECOMMENDATION.md`.
+
 ## 2. Public Day 0 prep — real certificates (start by T+15 = 2026-05-21)
 
 ### 2.1 Windows Authenticode
@@ -190,6 +212,11 @@ After notarization + stapling, Mac users see no warning on first launch — `.dm
 
 ## 3. CI integration (post-pilot, before public Day 0)
 
+> **INVALIDATED SECTION — DO NOT EXECUTE.** The Azure client-secret example and
+> May 2026 target dates below are historical only. Public Windows signing must
+> use `.github/workflows/release.yml` with hosted OIDC, exact-tag controls, and
+> a publicly trusted certificate after identity validation.
+
 **Target state:** every `main`-branch tag triggers signed builds for both platforms.
 
 **Windows (GitHub Actions sketch):**
@@ -284,5 +311,7 @@ Renewals: ~$348/yr ongoing. Tauri auto-updater also expects signed binaries —
 
 ---
 
-Last updated: 2026-05-10 — LAUNCH-06 self-sign automation landed (Phase 2 Step 4). §1.1 now points to the npm-wrapped scripts (`tauri:sign:pilot:win:setup` / `:apply` / `:sign`) backed by `app/scripts/sign-windows-pilot.ps1`, `apply-signing-config.mjs`, and the tested `signing-config.ts` utility. §1.2 ships the macOS ad-hoc identity in the build-override config by default; `tauri:sign:pilot:mac:adhoc` re-signs nested helpers post-build.
+Last updated: 2026-08-22 — Windows internal-pilot builds must use `tauri:build:win:pilot-signed`. macOS packaging remains deferred; an ordinary macOS build is not signed by the unused override and must be explicitly signed and verified before it is described as an internal artifact.
 Owner: Marko Marković (driving via CC); pilot self-sign actionable T+5; real cert procurement actionable T+14.
+
+</details>