# Discussion Round 2 - Opus

## Final Opus Position

Opus accepts all six of Snarky's final decisions and accepted refinements:

- `sx-blocked` is a hard governance state.
- Error model is pinned to landed sx with real examples.
- M1 APK inspection is ZIP container plus `AndroidManifest.xml` presence only.
- Enterprise, MDM, proxy HTTPS readiness, and artifact-only are distinct states.
- Public visibility does not imply public IPA download.
- M1 is DB-free and SQLite moves to M2.

No open contest remains on product scope or sequencing.

## Any Remaining Blockers

1. **Cross-repo sx-authoring ownership is undefined.**

   `sx-blocked` handles bugs, but not normal sx work. The DB-free skeleton still
   requires new sx modules such as JSON, CLI, hash, and archive wrappers. Decide
   whether distribution M1 consumes sx strictly as-is, or whether there is a
   sanctioned sx-repo authoring lane under `sx/CLAUDE.md`.

2. **Repo/module-resolution boundary is undefined.**

   Decide where `dist`/`distd` product code lives and how it imports sx stdlib
   across the two repos.

3. **Subagent machinery versus single-thread rule is still unresolved.**

   Either explicitly waive the no-fan-out rule for this project or drop the
   machinery and keep only run-dir artifacts.

## Exact First Patch Set To Apply

1. `git init` and baseline commit in `/Users/agra/projects/distribution`.
2. Patch `PLAN.md` to:
   - replace First Milestone with DB-free walking skeleton
   - demote HTTP, SQLite, admin UI, Docker to M2+
   - move `pub`/alias/re-export off the critical path
3. Patch orchestration docs:
   - add `sx-blocked`
   - add cross-repo handoff
   - split Opus read-only approval from write approval
   - record subagent/single-thread decision
4. Patch Subplan 01:
   - remove dead `PLAN.md` references
   - park `pub`
   - pin landed sx commit and error examples
   - mark FFI-first/Linux-first boundaries
5. Patch Subplan 02:
   - remove `Release.channel`
   - add `Release.state`
   - add validation outcome
   - add `ChannelPromotion`
   - mark SQLite as M2
6. Patch Subplan 03:
   - local publish becomes M1
   - add concrete `dist.json` schema and example
   - add idempotency and rerun semantics
   - clarify `dist doctor` TLS/proxy checks
7. Patch Subplan 05:
   - classify every validation check
   - scope M1 APK to zip-entry metadata
   - move full IPA/APK checks post-M1
8. Patch Subplan 04:
   - split Enterprise, MDM, artifact-only
   - add TLS caveat
   - add concrete routes and JSON shapes
   - mark HTTP as M2+
9. Add access policy section:
   - roles
   - visibility
   - token scopes
   - signed-link HMAC
   - download authorization table
   - iOS artifact-only never public
10. Author the real implementation run directory for the chosen first slice.

## Whether Implementation Can Start After Those Patches

Product/sx track:

- No, not after plan patches alone.
- Still needs sx authoring lane, module resolution boundary, pinned sx commit
  and error examples, accepted Opus proposal, clean branch, and write-paths.

Mock-redesign track:

- Yes, after git baseline plus a Snarky `brief.md`.
- It has no sx/backend dependency and can run independently under the UI
  allowed paths.
