# AiMe Delivery Roadmap

Status: Draft execution plan  
Last updated: 2026-08-15

## Purpose

This roadmap turns the confirmed product goal into security-gated increments.
It intentionally avoids calendar promises until account constraints, packaging,
and end-to-end Chat behavior are measured. Passing tests for one phase does not
authorize work from a later permission level.

## Status vocabulary

| Status | Meaning |
| --- | --- |
| Complete | Evidence and exit gate are recorded; later regression is still possible. |
| In progress | Some deliverables exist, but the phase exit gate is not satisfied. |
| Planned | Scope is accepted but implementation has not started. |
| Blocked | Approved plan whose implementation cannot start until a named gate passes. |
| Deferred | Deliberately outside the current release sequence. |

## Current snapshot

The consolidated paused checkpoint, exposure matrix, completed-work inventory,
explicit non-claims, and dependency-ordered resume plan are maintained in
[Implementation Status and Next Steps](IMPLEMENTATION_STATUS.md).

AiMe has a working security foundation for a read-only stdio MCP host and the
initial outbound Secure MCP Tunnel lifecycle. This includes strict profile
loading, fail-closed audit, a native handle-based Windows filesystem boundary,
credential-isolated tunnel launch, native process-tree supervision, and local
readiness checks. The real Chat feasibility investment gate recorded a scoped
`GO` on 2026-08-13 for Chat `High` mode on the tested account and devices.
Release packaging and all higher permission levels remain unaccepted.
A Windows-local composition now proves the first bounded Modify slice:
schema-v2 policy, native SafeFs, a pending-action broker, native default-Deny
confirmation UI, redacted JSONL/protocol audit, Read tools, and MCP stdio for
create, exact structured single-file patch, expected-content replace, and
exact-change rollback. Patch confirmation binds the current, patch, and result
digests before reusing the existing atomic replace and rollback boundary. Real
Windows tests cover idempotent retries, exact-byte restoration, denial without
side effects, UI exit, startup interruption, and handle cleanup. A dedicated
internal tunnel can supervise this child while locking both native helpers, but
it is not an accepted release surface. `preview_patch` now exists as an
internal metadata-only Modify preview, but it remains unavailable on the
public release surface. Move and delete remain unavailable on the Modify
surface. The supported Read stdio/tunnel can expose profile-gated
`search_text_files`; it stays Read-only and uses a dedicated cancellable native
helper so ordinary reads remain isolated. The supported Read
stdio/tunnel still rejects Modify profiles, and Managed remains globally
`aime.read` and rejects Modify.

Phase 5 has started with a lower-level internal `run_process_preset` mechanism
proof. Profile-v2 owns the verified executable SHA-256, argv, modify-root cwd,
title, and resource limits; the direct MCP test composition exposes asynchronous
start, status/output pagination, and cancellation without accepting raw
executable, argv, cwd, environment, or stdin from the caller. Exact local
default-Deny confirmation precedes a standard-user Job Object launch with
bounded wall/grace/process/memory/output limits, UTF-8-safe combined-cursor
output, crash/cancel/timeout cleanup, and redacted durable audit. This is
Full-risk mechanism evidence, not an accepted Modify build/test tool: scripts,
imports, package hooks, config, plugins, and network remain outside the runner's
containment boundary. The production local Modify runtime and stdio host reject
the capability pre-effect. The task/request registry is in memory only, and a
Full-session gate or dedicated structured wrapper, Managed/public Chat
authorization, Git, and live packaged release behavior remain outside the slice.

An offline release slice now produces deterministic native helper identities,
an unmanaged x64 packaged launcher, an exact staged runtime allowlist, and an
unsigned MSIX validated by real Windows SDK MakeAppx pack/unpack and SHA-256
block-map inspection. The launcher removes ambient Node/CLR injection variables,
holds stdin open, enforces a per-session singleton, and owns the Node process
tree. An exact redacted lifecycle channel now drives a standard status/tray UI,
reveals the existing singleton on duplicate activation, and provides graceful
then bounded forced Stop behavior. The manifest exposes that launcher in the app
list, but this does not accept the release surface: production signing,
protected installation, real shell activation/update, and external tunnel-
client distribution remain gated. A narrow Personal-mode setup dialog now
covers the missing-config path only; the complete first-run and operator-repair
experiences remain gated.

The supported native operation provides handle-relative single-file publication
and best-effort ordered NTFS recovery, not a filesystem transaction or hostile
same-user compare-and-swap. `repair_required` hard-stops every mutation in the
runtime/profile until a future local operator repair path resolves it.
The latest executable proof adds a local Managed-mode chain: a separately
signed and single-use local approval, explicit Ed25519 or ECDSA-P256 device
proof, revocable schema-v2 device certificate, fresh algorithm-and-fingerprint-
bound reconnect challenge, a headless confirm-before-sign enrollment
coordinator with atomic protected-store seam, signed five-minute Read lease, one
logical outbound device session, and bounded Streamable HTTP forwarding to the
existing local Read tools. Tests cover replay, expiry, capacity, audit rollback,
Host/Origin validation, body bounds, session deletion, disconnect, and revoke.
The relay now has a production-shaped authorization seam for protected-resource
metadata, fixed challenges, and issuer/client/resource/scope/expiry enforcement,
but it still uses local test compositions, journal-backed local authorities,
and an injected test verifier. A standalone bounded RS256/JWKS resource-server
verifier and matching short-lived RS256 token issuer now pass local round-trip
security tests. A headless authorization-code authority additionally proves
single-use codes, approval/client/resource binding, optional legacy redirect
matching, and PKCE S256.
Its token-service seam composes redemption and issuance with fixed sanitized
errors. A local public-application router now composes the metadata/JWKS,
authorization, token, protected-resource, JWT-verification, and MCP relay
boundaries in one end-to-end Read test. Managed tool discovery advertises one
global `aime.read` OAuth scheme and rejects simultaneous Modify configuration;
stdio independently refuses Modify profiles. The local device-wire
stack now multiplexes bounded logical MCP streams over real sockets, performs
a fresh Ed25519 or P-256 device proof, binds the authenticated connection to the
session
hub and its exact route lease, and passes a Read call over a trusted loopback
WSS connection while rejecting an untrusted certificate. A device-side
supervisor now retries transient connection loss with bounded backoff and fresh
authentication, while treating authentication and protocol denial as terminal;
it never resumes an old logical stream or lease. A real loopback reconnect test
now proves a fresh gateway connection ID, stale-lease `route_mismatch` denial
before device stream admission, and a successful newly bound Read lease after
forced carrier loss. Deployed TLS/WSS termination and a deployed reconnect proof
remain unimplemented. These are local proofs, not
deployed endpoints. No production
real-database-verified or wired durable code store, login/consent UI, durable signing-key ring, public HTTPS,
durable tenant store, or cloud service exists yet. The managed web control
plane, `kksm2` deployment, multi-user sharing, signed installer, and automatic
update path are still planned and not implemented.

A narrow managed network host now composes the public OAuth/MCP router and the
authenticated device WebSocket gateway on one owned Node HTTP server. It fences
admission and performs bounded, idempotent shutdown, but deliberately leaves
public listening, TLS termination, tenant identity, durable server storage, and
deployment to later Phase 3 slices. A managed consumer gateway runtime now
composes that host with the OAuth, relay, route-lease, and authority owners,
stamps verified subject/tenant/connection claims into every lease, rejects
route selectors that return tokens or identity overrides, and prevents late
lease issuance once shutdown begins. It remains an unbound local composition,
not a deployed control plane.

Implementation facts and release blockers remain authoritative in the
[architecture](ARCHITECTURE.md); this roadmap defines sequencing and product
gates.

### Paused checkpoint — 2026-08-15

- Full regression: 1,284 tests total, 1,279 passed, zero failed, and five
  documented skips.
- TypeScript typecheck passes.
- Independent review of the latest production process/Modify denial boundary
  returned no actionable findings.
- The supported default remains Read-only; the Windows-local filesystem Modify
  route remains an internal pre-release proof.
- Generic `run_process_preset` remains lower-level Full-risk evidence and is
  rejected by production local Modify before runtime owners are acquired.
- The recommended resume point is the Full-session authority decision or a
  demonstrably narrower structured build/test wrapper. This must precede any
  claim that build/test is a Modify capability.
- Operator repair, rollbackable move/delete, signed install/live activation,
  complete onboarding, real-Chat higher-capability validation, Managed
  deployment, Control, Full, and Admin release gates remain open.

## Hard Go/No-Go gate — Chat feasibility

The investment gate recorded a scoped `GO` on 2026-08-13. The rules below are
retained as the historical evidence contract and as regression criteria. This
decision unlocks sequenced implementation; it does not mark Phase 1 release
hardening complete or waive any later capability gate.

Phase 1 was the investment gate for every later phase. Until it recorded `GO`,
implementation is limited to the minimum MCP, tunnel, Windows security,
test-fixture, and diagnostic work required for this proof:

- create a fresh conversation that remains visibly on Chat, not Work;
- select AiMe and observe real MCP initialize, tool discovery, and calls at the
  local server;
- complete multiple sequential bounded calls against unique VM canaries,
  including a correct allowed result and an out-of-root denial;
- return the results to Chat and repeat the check after reload;
- measure latency, tool/time limits, error behavior, cancellation, and the
  caller/session metadata actually available;
- disconnect, reconnect, revoke, and verify that the next call fails closed and
  no process remains; and
- write an explicit evidence-backed GO or NO-GO decision.

Before `GO`, do not implement the full desktop UX, Modify/Control/Full/Admin,
managed Web Control Plane, identity/RBAC, multi-user sharing, `kksm2`/Cloudflare
deployment, automatic updater, or public release machinery. Their planning
documents may be maintained so the decision is informed. A `NO-GO` pauses the
roadmap after Phase 1 and requires a transport/product decision.

## Phase summary

| Phase | Outcome | Status |
| --- | --- | --- |
| 0 | Clean-room reference research and threat inventory | In progress |
| 1 | Read-only Chat-to-Windows security foundation | In progress; investment gate GO, release gaps open |
| 2 | Local desktop shell, onboarding, devices, and profiles | In progress; narrow Personal missing-config setup implemented, complete first-run/Managed onboarding and repair pending |
| 3 | Managed web control plane, `kksm2` deployment, Read sharing, and signed updates | In progress; local pairing/routing, public OAuth/MCP composition, managed consumer runtime lifecycle, device-wide revoke, authenticated journal, per-tool OAuth metadata, authenticated device-wire/session binding, and bounded loopback WSS/TCP carrier proofs implemented; deployed HTTPS/WSS, login/public service, and real-database-verified durable server boundary pending |
| 4 | Modify filesystem changes and rollback recovery | In progress; internal Windows create/structured-apply/metadata-only-preview/replace/rollback MCP, native confirmation UI, broker, audited stdio host, supervised tunnel composition, exact parent-to-supervisor profile-content binding, offline exact MSIX staging, and an unmanaged packaged launcher implemented; profile-gated `search_text_files` is available on the supported default Read route; move/delete, operator repair UX, production signing/install/live activation, and real Chat confirmation remain gated |
| 5 | Supervised processes, build/test, and Git | In progress; lower-level Full-risk `run_process_preset` start/get/cancel mechanism verified, production Modify admission denied, and dedicated build/test wrapper, Git, Managed/public Chat, and release gates open |
| 6 | Browser and Windows Control capabilities | Planned; capability gate required |
| 7 | Managed multi-device/multi-user expansion and optional unified routing | Planned |
| 8 | Full/Admin boundaries and production release hardening | Planned |

## Phase 0 — Clean-room reference research

### Deliverables

- Evidence-backed static security review of the reference product.
- Controlled VM installation and behavioral report.
- Documented observed facts, inferences, assumptions, positive controls, and
  unresolved tests.
- Clean-room rules excluding proprietary source, assets, credentials, and
  private service reproduction.

### Exit gate

- Existing evidence is attributable by date/version/hash where applicable.
- No reference-product binary, secret, or proprietary asset is committed.
- AiMe requirements are independently stated and do not depend on copying an
  implementation detail.

Research remains open for behavior that materially affects later threat models,
but it must not block independent product work without a specific reason.

## Phase 1 — Read-only Chat security foundation

### Deliverables

- Exactly bounded status, directory-list, text-read, and profile-gated search tools.
- Root-alias path contract with no absolute-path disclosure.
- Native handle-relative Windows filesystem containment.
- Fail-closed privacy-preserving audit.
- Outbound-only tunnel launch with protected key reference and sanitized child
  environment.
- Native Job Object supervision, readiness, cancellation, and redacted CLI.
- Reproducible Windows negative-vector and resource-limit test report.

### Accepted investment evidence

- A user-authorized real tunnel and protected runtime key reached the OpenAI
  control plane without exposing the key to Node, argv, environment, or logs.
- ChatGPT Chat discovered and called the three read-only tools on the tested
  Windows VM, including an allowed canary read and an outside-root denial.
- Controlled disconnect/reconnect, app remove/reinstall, and AiMe process-tree
  cleanup were correlated with local audit evidence.

### Remaining release acceptance work

- Complete runtime-key rotation/revocation and cancellation testing rather than
  relying only on private-app removal.
- Add an explicit browser-reload regression on supported Chat modes and keep the
  observed `High` versus unreliable `Pro` behavior in the compatibility matrix.
- Close signing/packaging and the remaining filesystem race/resource gates.
- Repeat the full release evidence matrix after onboarding and packaging are in
  their distributable form.

### Exit gate

- Chat remains visibly on the Chat surface before, during, and after a real
  tool call and after reload.
- Local diagnostics prove the calls reached this AiMe instance and unique VM
  canaries rather than cached UI or another connector.
- Multiple sequential calls and a denied out-of-root request return the expected
  results in the same Chat feasibility run.
- All filesystem and protocol negative vectors pass on real Windows NTFS.
- No secret canary appears in output, logs, audit, environment, or child process.
- Revocation fails the next call closed and leaves no orphan process.
- No Critical or High finding remains for Read.
- The evidence report records `GO` before Phase 2 begins; otherwise it records
  `NO-GO` and later phases remain blocked.

## Phase 2 — Local desktop shell, onboarding, devices, and profiles

### Deliverables

- Signed-development desktop shell with tray presence, quick status, settings,
  approval surface, active-task view, audit view, and emergency stop.
- First-run wizard for device naming, profile creation, root selection,
  capability explanation, Personal/Managed mode, account pairing where
  selected, OpenAI connection, and verification.
- Local device identity and multiple profile records with independent roots,
  limits, capability sets, confirmation policy, and tunnel binding.
- Protected secret storage and explicit device/profile/session revoke.
- Stable IPC between UI and local services without a public listener.
- Local activation/rejection UX for managed profile-share proposals and a clear
  distinction between web-requested policy and effective local capability.
- Personal Connect foundation already completed: native-safe profile reads,
  retained fail-closed audit, DPAPI runtime-key handling, atomic protected
  profile/tunnel configuration, and supervised outbound tunnel lifecycle. A
  bounded native setup dialog now accepts only the Tunnel ID and paths to an
  existing profile, protected runtime-key blob, and tunnel client. Native fixed-
  state preparation derives the private Local App Data target, and an accepted
  no-replace publication triggers exactly one tunnel retry. This removes manual
  `tunnel.json` authoring for the missing-config path, but does not create the
  prerequisite assets or replace a different existing configuration. The
  local Managed-mode foundation now also proves signed local approval,
  single-use pairing, explicit Ed25519/P-256 device proof, a revocable
  algorithm-bound certificate, and fresh reconnect proof for a fixed Read
  profile revision. The bounded authenticated authority journal, device-wide
  revocation fence, tested single-process authority composition, and a
  non-exportable current-user Windows P-256 signing helper now exist. A
  headless coordinator also validates an authenticated proposal, requires local
  confirmation before signing, checks the certificate envelope against exact
  schema-v2 claims, and commits through an injected atomic protected-store
  boundary before returning. The Windows protected-store implementation now
  publishes and reloads an identity-bound DPAPI credential through a private
  atomic no-replace transaction and deletes only after an exact record-digest
  check. A separate Windows bootstrap now resumes an existing enrollment by
  opening the fingerprint-pinned CNG identity and starting authenticated WSS
  reconnect; it does not create a key, replay enrollment, or delete local state
  during ordinary shutdown. Remaining work includes the real authenticated broker, durable
  multi-process registry state and cleanup outbox, the desktop UX,
  profile/identity registry and recovery, confirmation surface, and user-facing
  revoke/repair lifecycle.

### Exit gate

- A non-technical test user completes setup without a terminal.
- Personal mode and Managed-mode sign-in/pairing are distinguishable and both
  follow their documented safe lifecycle.
- Two profiles on one device remain isolated under positive and negative tests.
- Closing/crashing the UI or service follows the documented safe lifecycle.
- Local confirmation cannot be forged by remote MCP input or another profile.
- Uninstall/revoke leaves no active tunnel, credential, or orphan process.

## Phase 3 — Managed web control plane, deployment, and Read sharing

### Deliverables

- Local routing proof completed: short-lived signed Read leases bind one
  immutable tenant/user/connection/device/profile/policy route to the existing
  device-side MCP enforcement boundary. Authenticated device-wire handoff,
  authenticated device-session binding, and bounded loopback TCP/WSS carrier
  proofs are also implemented locally. The remaining deliverables below must
  replace these local authorities/transports with authenticated, durable server
  components without duplicating local tool policy at the gateway.

- Standards-based login with MFA/passkey-ready account security, recovery,
  session rotation, CSRF defense, and global logout.
- Organizations, fixed Owner/Admin/Member/Viewer roles, separately authenticated
  Platform Admin roles, invitations, device pairing, and tenant-scoped audit.
- User, organization-admin, and platform-admin pages with no local content,
  credential viewer, impersonation shortcut, or device-command console.
- Device/profile metadata, locally activated Read profile shares, short-lived
  policy leases, replay-resistant versions, expiry, downgrade, and revoke.
- Containerized alpha on NAS `kksm2`, published at `aime.kks.homes` through
  outbound Cloudflare Tunnel with isolated database, protected secrets,
  monitoring, backup, restore, migration, and rollback procedures.
- Signed Windows installer plus signed, staged, rollback-safe automatic update
  feed; signing private keys remain outside the NAS/control plane.
- Protocol-version negotiation and minimum-version policy that does not strand
  a client without a safe update/recovery path.

Detailed requirements live in the
[web control-plane and RBAC plan](WEB_CONTROL_PLANE_AND_RBAC_PLAN.md) and the
[deployment and automatic update plan](DEPLOYMENT_AND_UPDATE_PLAN.md).

### Exit gate

- Two users and two devices remain tenant/identity isolated; a Read share is
  unusable before local activation and fails the next call after revoke/expiry.
- The complete web role/object matrix and automated cross-tenant matrix pass
  with zero unauthorized rows, objects, jobs, tokens, exports, or audit events.
- Platform Admin can suspend/revoke and operate releases but cannot retrieve
  local content/credentials, impersonate a tool user, or issue a device command.
- Outage, replay, stale/reordered policy, restore, clock uncertainty, membership
  removal, and local downgrade cannot widen authority.
- NAS origins are not publicly reachable outside the intended Cloudflare
  hostnames; backup/restore, migration rollback, tunnel/DNS recreation, and
  credential rotation are rehearsed.
- A signed staged update succeeds; corrupt, unsigned, wrong-publisher,
  downgraded, replayed, interrupted, or unhealthy updates reject or recover
  safely. NAS compromise alone cannot create an accepted package.
- No Critical or High finding remains for Managed Read, deployment, or update.

## Phase 4 — Modify filesystem changes and rollback recovery

### Deliverables

- Internal Windows slice implemented: create, exact structured single-file
  apply-patch, expected-content replace, and exact-change rollback through local
  MCP, a native default-Deny confirmation UI, audited stdio host, and supervised
  internal tunnel. Apply uses strictly ordered non-fuzzy hunks and binds the
  current, patch, and result digests before atomic publication. A metadata-only
  `preview_patch` path validates the same bounded patch and returns only hashes,
  counts, and byte sizes without mutation or reservation. Profile-gated search
  is already available through the supported default Read route; move and
  delete remain planned at the Modify surface.
- Parent validation and native child admission are bound by the SHA-256 of the
  exact raw profile bytes; the supervisor verifies and retains that profile
  before log, key-decrypt, or process side effects.
- Offline release staging uses an exact payload allowlist and an unmanaged
  launcher that supplies a sealed child environment, retained stdin, singleton
  admission, and kill-on-close process-tree ownership. Real MakeAppx pack/unpack
  is proven. Exact lifecycle parsing, status/tray wiring, duplicate-instance
  reveal, graceful Stop, and forced 30-second tree termination are covered by
  offline/native tests. Terminal setup/failure states remain dismissible for a
  bounded ten seconds; signed installation and live packaged activation are not.
- Same trust boundary as Read for roots, handles, reparse rejection, and output
  bounds.
- Supported replacement uses single-file atomic publication plus best-effort
  ordered rollback recovery; it is not a filesystem transaction or hostile
  same-user compare-and-swap guarantee.
- `repair_required` globally fences mutations in the runtime/profile and needs
  a documented local-operator repair path before work resumes.
- Secret/content redaction policy for returned diffs and previews.
- Prompt-injection corpus covering hostile filenames and file contents.

### Exit gate

- An approved Chat task can inspect, patch, verify, and roll back a workspace.
- Race, junction, hard-link, root-replacement, out-of-root destination, partial
  write, disk-full, and cancellation tests fail safely.
- Read cannot reach Modify through tool arguments or chained content.
- Audit contains effects and counts but no file contents or absolute paths.
- A signed production desktop composition displays and binds one exact local
  confirmation, authenticates every helper before launch, and the tested
  operator repair flow resolves or safely retires every `repair_required` state.
- No Critical or High finding remains for Modify filesystem operations.

## Phase 5 — Supervised processes, build/test, and Git

### Deliverables

- Structured process start/status/output/input/cancel tools.
- Approved executable identity, cwd, environment, network policy, Job Object,
  concurrency, time, and output controls.
- Structured build/test presets and Git status/diff/log tools.
- Explicit policy for Git mutation, commit, remote push, package managers,
  interpreters, plugins, helper options, and downloaded executables.
- Long-running task UX with progress, cancellation, and final result.

### Current internal evidence

- A direct lower-level profile-v2 `run_process_preset` composition exposes
  asynchronous MCP start, get, and cancel operations for a profile-owned preset;
  it accepts no raw executable, argv, cwd, environment, or stdin from the caller.
- Exact local default-Deny confirmation binds the preset, workspace-relative
  cwd, executable identity, resource limits, and explicit
  `network:not_enforced` warning before launch.
- The Windows runner verifies and pins the executable/root, starts suspended,
  assigns a standard-user kill-on-close Job Object before resume, and bounds
  wall time, cancellation grace, processes, memory, stdout, stderr, total
  output, and UTF-8-safe combined-cursor pagination.
- Real Windows MCP tests cover replay, nonzero exit, cancellation, timeout,
  descendant cleanup, helper crash, output limits, redacted durable audit, and
  handle release. The staged package and supervised Modify tunnel retain the
  process runner helper and process-tool modules.
- The production local Modify runtime and stdio host deny
  `run_process_preset` profiles before acquiring Read, confirmation, process, or
  server owners. A fixed executable and argv do not narrow mutable workspace
  scripts/imports, package hooks, config, plugins, or unenforced network into
  Modify authority.
- This is not the Phase 5 exit: a Full-session gate or dedicated structured
  wrapper is still required; task/request records do not survive restart, input
  and interactive stdin are unavailable, build/test product presets and Git are
  not shipped, and Managed, ordinary Read, public Chat activation, production
  signing/install, and live packaged activation remain gated.

### Exit gate

- ChatGPT Chat can inspect a repository, apply a patch, run build/tests, inspect
  Git diff, and summarize results without invoking another AI backend.
- Process exit, timeout, cancellation, UI crash, supervisor crash, and stubborn
  descendant tests leave no orphan process.
- Structured Modify execution cannot escape to raw shell or interpreter behavior.
- Commit, push, publish, install, and external mutations require their explicit
  product authorization; editing permission is insufficient.
- No Critical or High finding remains for shipped process/Git capabilities.

## Phase 6 — Browser and Windows Control

### Deliverables

- Explicitly selected browser profile/session and bounded navigation/DOM tools.
- Window/application inventory, accessibility tree, targeted screenshot,
  clipboard, mouse, keyboard, and hotkey capabilities.
- Persistent foreground indicator, exact target binding, local approval queue,
  input rate limits, privacy controls, and emergency stop.
- Policy for authenticated pages, messages, purchases, uploads/downloads,
  camera/microphone, and externally visible side effects.
- Visual and content prompt-injection test suite.

### Exit gate

- Control is impossible without a visible, time-bounded local grant.
- Focus changes, window replacement, screen topology changes, secure desktop,
  lock screen, remote desktop, and cancellation fail safely.
- Sensitive screen/clipboard/browser data is not retained or audited as content.
- A malicious page/document cannot approve or broaden a capability.
- No Critical or High finding remains for Control.

## Phase 7 — Managed multi-device and multi-user expansion

### Deliverables

- Install AiMe independently on several computers.
- Give every device a unique identity, display alias, credential, tunnel, audit,
  and revoke boundary.
- Extend profile sharing only to capability levels that have independently
  passed their local and managed release gates.
- Support invitation, expiry, delegation policy, organization maximums,
  concurrency, recipient session visibility, and lost-device workflows.
- Expose one explicitly authorized ChatGPT connection per profile/recipient
  where necessary to preserve verified caller identity.
- Evaluate an authenticated unified selector/router only if OpenAI identity,
  connection binding, target confirmation, tenant isolation, and route
  revocation can be proven end to end.
- Add operational capacity, privacy/retention, incident-response, export/delete,
  staged-release, and version-compliance controls needed for external users.

### Exit gate

- At least two computers and two profiles per computer remain isolated.
- At least two organizations and several recipients remain tenant isolated.
- Revoking one user/share/device/profile does not interrupt or widen another.
- Offline, duplicate-name, stale-presence, reconnect, lost-device, and uninstall
  flows are understandable and safe.
- Organization roles never imply local capabilities; every shared Modify or
  Control action still follows the local ceiling and confirmation model.
- If shipped, unified routing cannot silently switch target and passes its own
  identity, tenant-isolation, replay, availability, privacy, and incident tests.
- No Critical or High finding remains for the expanded managed capabilities.

## Phase 8 — Full/Admin and production release hardening

### Deliverables

- Decision record for which raw execution capabilities are supportable.
- Short-lived Full sessions with exact command/cwd/env/network preview and a
  persistent local warning/stop control.
- If required, a signed, minimal privileged broker with predefined verbs,
  administrator-owned installation path, authenticated IPC, and no interactive
  elevated shell.
- Production signing/release authorization, SBOM/provenance, automated
  dependency scanning, crash/support-bundle redaction, recovery, and uninstall.
- Operational runbooks for key rotation, revoke, lost device, incident response,
  update failure, and service outage.

### Exit gate

- No lower permission level can reach Full or Admin through interpreters,
  plugins, helpers, UI control, executable replacement, or argument semantics.
- Installation/update tamper, rollback, compromised-user, app-replacement,
  broker IPC, and local attacker tests pass.
- Independent security review finds no open Critical or High issue.
- Managed-mode Full/Admin sharing is disabled unless it receives a separate
  explicit threat model and release decision; organization or Platform Admin
  roles never imply either level.
- The full product-acceptance definition in the
  [product requirements](PRODUCT_REQUIREMENTS.md) passes.

## Cross-phase definition of done

Every shipped slice includes:

- product requirement and capability mapping;
- strict schemas and stable redacted errors;
- unit, integration, negative, resource, cancellation, and real-Windows tests;
- local confirmation and audit behavior where applicable;
- user-visible lifecycle and recovery behavior;
- updated architecture, roadmap, security evidence, and documentation index;
- explicit remaining risks and external account dependencies; and
- no silent expansion into the next permission level.

## Deferred until justified

- Storing or proxying local file, screen, clipboard, prompt, browser, or command
  output through the managed control plane.
- Mobile clients or non-Windows local execution.
- Custom tenant-defined roles beyond the fixed reviewed RBAC matrix.
- Marketplace, billing, and public distribution features unrelated to secure
  personal operation.
- Autonomous background work without an active, revocable user session.
