# Next hardening wave

This document prepares the next post-MVP desktop hardening cycle without changing the current release runtime.

## Scope

- production code signing
- stronger transport pinning rollout
- stronger secure local storage follow-up
- PyInstaller vs Nuitka evaluation for release hardening

## Code signing prep

- Keep a certificate inventory outside the repo.
- Decide whether signing happens on the build machine or in a separate signing step.
- Sign both the main executable and the installer payload.
- Preserve the current unsigned PyInstaller pipeline until the signing step is validated end-to-end.

Related operator template: `deploy/CODE_SIGNING.template.md`

## Transport pinning prep

- Keep the current HTTPS-only transport policy as the enforcement baseline.
- Use `config/transport_pinning.production.template.json` as the future source template for pinned API/update hosts.
- Roll out pinning only after collecting primary and backup SPKI pins for every production hostname.
- Treat pinning as release-only and keep an explicit recovery path for certificate rotation.

Related operator template: `deploy/TRANSPORT_PINNING.template.md`

## Stronger secure local storage prep

- Current local hardening already moved sensitive identity material out of public JSON.
- Next storage pass should target token/session secrets first, while keeping migration support for existing installs.
- Any stronger OS-backed storage must preserve non-breaking upgrades and support diagnostics redaction.

## PyInstaller vs Nuitka prep

- Keep PyInstaller as the active release path until a parallel Nuitka smoke path proves equivalent packaging and runtime behavior.
- Compare startup time, package size, antivirus false positives, and maintenance overhead before switching.
- Treat obfuscation/compilation as a separate release decision, not as an unreviewed build flag.

Related operator template: `deploy/NUITKA_EVALUATION.template.md`

## Exit criteria for the next implementation phase

- signing inputs and operator steps are documented
- pinning host/pin inventory is ready
- secure-storage migration target is chosen
- Nuitka evaluation matrix is prepared without breaking PyInstaller packaging
