james.maesandCodex
f896215ec9
Sign explicit owned Windows binaries, preserve third-party bytes/signatures, and verify final NuGet/Velopack distribution before publication. Protected release signing uses Azure OIDC, SHA256 and RFC3161 timestamps. Validation: exacte3aaed4CI38263239957 passes all required gates; 35 local signing regressions, conformance self-test/full API preflight and document/workflow/security lint pass. Real local representative six-binary and final installer/portable/update signing integration also passes; protected CI OIDC remains to be verified by the consumer release. Maintainer confirmed review of exacte3aaed4and resolution of all findings in this session, and authorized release publication. Signed-off-by: James Maes <james@kof22.com> Co-Authored-By: Codex (GPT-6) <noreply@openai.com>
Reference architectures
Worked designs for each kind of product KofTwentyTwo builds. Each one already meets
the policies and standards, so a project that follows it starts compliant. A project
that departs from its reference architecture records why in an ADR
(K22-SDLC-02).
| Architecture | Status | Implemented by |
|---|---|---|
| Windows desktop application | Active | AppKit, the Windows app template, gclo |
| macOS application (Swift / SwiftUI) | Planned | |
| Command-line tool (Rust or Go) | Planned | |
| Web application and API | Planned | |
| Kubernetes workload and GitOps delivery | Planned |
Every reference architecture covers the same sections, so they can be compared: stack, repository layout, runtime and startup, data and secrets, updates or deployment, the build and release pipeline, a threat model summary, and the testing strategy.
Templates used by product repositories: ADR, threat model, release checklist.