roadmap

Right now the live site is refreshed by pushing content from the dev machine (render/deploy.sh content). Make it fully hands-off: a read-only deploy key on kinogaki-infra, a checkout on the box, and an entry in the existing push-to-deploy webhook so a commit from the Kinogaki Server reflects on the site within seconds. Needs a persistent-access decision (the deploy key).

What: Encrypt the .prism binary crate (and the package bundle) at rest — an opt-in, authenticated transform in the serialize path, living in kinogaki-core next to the own-code compressor (Compress.h). The .prisma ASCII source stays plaintext: it is the diff-clean, reviewable source; encryption targets the compiled binary you ship or store.

Why core: Serialization is core's mandate, and the binary crate already carries one opt-in payload transform (LZ compression). Encryption is the parallel transform and belongs at the same seam, so every consumer (CLI, Python, server, editor) gets it through the existing serialize/deserialize API.

Shape:

• Compress-then-encrypt: the crate body is optionally compressed, then optionally encrypted. A header flag marks an encrypted crate and detect() reports a new encrypted encoding. deserialize() fails closed with a clear error when a key is needed but absent or wrong.
• Authenticated encryption (AEAD) so a wrong key or any tampering is detected, never silently mis-decoded. Store salt + nonce in the header; never reuse a nonce.
• Key input: raw key bytes from the caller, or a passphrase run through a KDF (salt in the header).

The open decision (settle before building): core is pure C++20 with no third-party dependencies, and "don't roll your own crypto" is real. Three options:

1. Pluggable cipher hook (recommended) — core defines the envelope/header + a Cipher interface; the host links a vetted implementation (libsodium / OpenSSL / BoringSSL). Core stays dependency-free; the crypto choice moves out.
2. Bundle one vetted AEAD (e.g. a public-domain ChaCha20-Poly1305) inside core — self-contained, but core then owns crypto code.
3. Take a real crypto dependency — breaks the no-deps principle.

Surface to add: serializeBinary(stage, {compress, encrypt}) + deserialize(bytes, key); mirror in the C ABI, the Python binding, and the CLI (convert --encrypt, --key/passphrase). detect_encoding learns encrypted.

Tests: key round-trip; wrong-key fails closed; tampered-ciphertext fails closed (AEAD); compressed+encrypted round-trip; package-bundle encryption; nonce uniqueness.

What: Make pip install kinogaki also put the kinogaki CLI and kinogaki-server on PATH, so one install gives the library, the command-line tool, and the MCP server together.

No signing needed. This is packaging, not crypto. The wheel already ships a compiled native library (libkinogaki_core) that runs after a plain pip install, for two reasons that apply equally to the two executables: (1) pip-installed files are not quarantined, so macOS Gatekeeper/notarization never engages (that path is only for browser/DMG/.pkg downloads); (2) clang/ld auto ad-hoc-sign every arm64 binary at link time, which is all Apple Silicon requires to run. Linux executables just need the exec bit. Developer-ID signing + notarization stay out of scope — they are only for a downloadable .app/.dmg.

Shape:

• Build kinogaki and kinogaki-server in the same matrix as the dylib: universal2 on macOS, inside the manylinux Docker on Linux. Bundle both in the wheel (e.g. alongside kinogaki/_native/).
• Put them on PATH via console-script shims: [project.scripts] kinogaki = "kinogaki._exec:cli" and kinogaki-server = "kinogaki._exec:server", where _exec locates the bundled binary in the package and os.execvs it. (The same pattern the cmake / ninja / ruff PyPI wrappers use to ship native tools.)
• Extend release.sh's clean-env verify to run kinogaki --help and a kinogaki-server MCP handshake, so a broken binary never reaches PyPI.

Caveats (minor): the wheel grows and the tools become version-locked to the package (both fine); and if any post-build step rewrites a macOS binary (install-name fixups), re-apply the ad-hoc signature with codesign -s - <file> — still no paid signing. Windows stays deferred (no wheel yet).

Acceptance: on a clean machine, pip install kinogaki then kinogaki --help and kinogaki-server both run, on macOS (arm64 + Intel) and the manylinux Linux box, with no Gatekeeper prompt and no signing step.