docs: prepare SignPath signing readiness

CODE_SIGNING_POLICY.md

@@ -0,0 +1,80 @@
+# Code signing policy
+
+Last updated: 2026-07-18
+
+## Current status
+
+DS Agent `v1.0.2` is unsigned. Windows may therefore display an unknown-publisher
+warning for that historical release. The project is preparing an application
+for the SignPath Foundation open-source program, but no DS Agent binary may be
+represented as SignPath-signed until the application is approved and the
+published artifact independently verifies as Authenticode `Valid`.
+
+For releases accepted into that program: **Free code signing provided by
+[SignPath.io](https://signpath.io/), certificate by
+[SignPath Foundation](https://signpath.org/).**
+
+## Team roles
+
+DS Agent is currently maintained in the public
+[`Lee-take/dsagent`](https://github.com/Lee-take/dsagent) repository by one
+maintainer:
+
+- Authors and committers: [`Lee-take`](https://github.com/Lee-take).
+- Reviewers for outside contributions: [`Lee-take`](https://github.com/Lee-take).
+- Signing approver: [`Lee-take`](https://github.com/Lee-take).
+
+Every signing request requires a manual decision by the signing approver. An
+API token or successful build is never sufficient approval by itself. Team
+members with repository or signing access must use multi-factor authentication.
+
+## Source and build provenance
+
+Only DS Agent artifacts built from the project's own public source may be
+signed. A signing-eligible release must:
+
+1. originate from an exact commit in `Lee-take/dsagent`;
+2. build on a GitHub-hosted Windows runner through a reviewed workflow;
+3. upload the unsigned artifact to the same GitHub Actions run before it is
+   submitted for origin-verified signing;
+4. sign `ds-agent.exe` before it is packaged into NSIS, then separately sign
+   the resulting NSIS installer;
+5. keep product name and product version metadata consistent across every
+   signed file; and
+6. receive the required manual signing approval.
+
+Locally built binaries, manually uploaded unsigned replacements, artifacts from
+another repository, and artifacts whose source commit cannot be verified are
+not eligible. Private keys and signing API tokens must never be committed to
+the repository. Provider identifiers may be added only after SignPath assigns
+them; guessed or placeholder identifiers are forbidden.
+
+## Release verification
+
+Before a signed installer is published, maintainers must verify both the
+application executable and installer with Windows Authenticode. Evidence must
+bind the exact source commit, file name, product version, byte size, SHA-256,
+signer subject and certificate chain, timestamp, and `Valid` signature status.
+The installer downloaded back from GitHub must match the reviewed release
+asset. An invalid, missing, expired, unexpectedly issued, or unbound signature
+stops publication.
+
+## Project purpose and restrictions
+
+DS Agent is a permissioned local desktop agent for ordinary office, file,
+research, and automation work. Its terminal, browser, and Computer Use
+capabilities are designed for user-approved work; they are not designed to
+discover or exploit vulnerabilities, steal credentials, or bypass security
+controls. Signing must stop if the distributed product no longer matches that
+scope or the [privacy policy](PRIVACY.md).
+
+## Incidents and policy changes
+
+Report suspected signing misuse or a compromised release through
+[GitHub Private Vulnerability Reporting](https://github.com/Lee-take/dsagent/security/advisories/new).
+Do not put secrets or exploit details in a public issue. Affected publication
+and signing requests must stop while the incident is investigated, and the
+signing provider must be notified when revocation or other certificate action
+may be required.
+
+Changes to this policy are reviewed through the public repository history.

PRIVACY.md

@@ -0,0 +1,86 @@
+# Privacy Policy
+
+Last updated: 2026-07-18
+
+This policy describes the current published DS Agent desktop application and
+public project. DS Agent is local-first and does not operate a project cloud
+backend, advertising service, or project analytics or telemetry service.
+
+## Information kept locally
+
+DS Agent keeps settings, audit and recovery events, task state, memory, and
+other runtime state under the operating system's application-data location.
+User-selected workspaces hold approved evidence, exports, reports, work
+packages, screenshots, and other artifacts. This information is not silently
+synced to a DS Agent-operated server.
+
+The current stable `v1.0.2` reads a user-supplied DeepSeek API key from the
+desktop process environment. The project does not provide a shared key. API
+keys must not be written to events, logs, UI state, exports, screenshots, or
+work packages.
+
+Uninstalling the application may not delete a user-selected workspace or every
+application-data file. Review and remove those local locations separately when
+you no longer want to retain them.
+
+## Network activity initiated by a user action
+
+DS Agent transfers information to networked systems only for work requested by
+the user or person operating the application:
+
+- **DeepSeek.** Model-backed work sends the user's prompt and the bounded
+  context selected for that request to the configured DeepSeek API. The
+  user-supplied API key is used for authentication. DeepSeek processes that
+  request under its [privacy policy](https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html).
+- **Web search and visited sites.** Source-linked web search can send the search
+  query to DuckDuckGo, a user-configured route, or an optional user-started
+  local bridge. Opening or submitting a requested web page sends normal
+  browser requests to that destination. The destination's privacy policy
+  applies; see [DuckDuckGo's privacy policy](https://duckduckgo.com/privacy).
+- **GitHub.** User-requested update checks, installer downloads, and supported
+  GitHub skill-source operations contact GitHub release, API, download, or
+  source endpoints. GitHub's
+  [privacy statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement)
+  applies.
+- **Hugging Face.** A user-requested skill-source operation can contact a
+  selected Hugging Face repository. Hugging Face's
+  [privacy policy](https://huggingface.co/privacy) applies.
+- **Microsoft WebView2.** The Windows desktop shell uses Microsoft Edge
+  WebView2. WebView2 diagnostic data is controlled by Microsoft and Windows
+  settings as described in Microsoft's
+  [WebView2 data and privacy documentation](https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/data-privacy).
+
+The optional local desktop bridge accepts only loopback addresses and is
+started and controlled by the user. DS Agent does not install or supervise that
+service. Production Microsoft and Google account registration and live
+mail/calendar writes are disabled in `v1.0.2`; offline connector contracts do
+not authorize a production account or external write.
+
+## What can be included in a model request
+
+Depending on the action the user approves, a request can include chat text,
+selected memory, excerpts from selected local files, source-linked web content,
+or a description of the desired artifact. DS Agent is designed to package only
+the context needed for the requested work, but users remain responsible for
+not selecting information they are not permitted to send to the configured
+service.
+
+Local paths, credentials, provider response bodies, screenshots, and file
+contents are not uploaded merely because the application is open. Computer
+control and local file mutations require the product's permission boundaries;
+approval of a local action does not grant unrelated network authority.
+
+## User choices
+
+Users control whether to configure a DeepSeek key, request model-backed work,
+run web search, open a web destination, import a remote skill source, or start
+an optional local bridge. Remove the relevant credential or do not invoke the
+network-backed capability to prevent that route from being used.
+
+For a sensitive security or privacy issue, use
+[GitHub Private Vulnerability Reporting](https://github.com/Lee-take/dsagent/security/advisories/new).
+Do not include API keys, private files, tokens, screenshots, or private local
+paths in a public issue.
+
+Material changes to reachable network behavior or data handling require an
+update to this policy before the changed release is published.

README.md

@@ -182,6 +182,15 @@ The v1.0.2 installer is currently unsigned, so Windows may display an
 unknown-publisher warning. Read the [installation guide](docs/INSTALLATION.md)
 before installing.
 
+## Code signing policy
+
+DS Agent `v1.0.2` remains unsigned. The project is preparing an open-source
+signing application; no release is represented as signed until its application
+executable and installer independently verify as Authenticode `Valid`. For
+releases accepted into the program: **Free code signing provided by
+SignPath.io, certificate by SignPath Foundation.** See the full
+[code signing policy](CODE_SIGNING_POLICY.md) and [privacy policy](PRIVACY.md).
+
 ### Build from source
 
 ```powershell
@@ -197,8 +206,8 @@ example `D:\build-target\ds-agent-v1-release`.
 
 - Release: [DS Agent v1.0.2](https://github.com/Lee-take/dsagent/releases/tag/v1.0.2)
 - Installer: `DS.Agent_1.0.2_x64-setup.exe`
-- Size: `12,716,857 bytes`
-- SHA-256: `469C4EFA54F4C94A6E37D28C9C88D331B26E1770C6792DC93D02B451640E2A6F`
+- Size: `12,714,353 bytes`
+- SHA-256: `21459D5A8CFF2606171CBD52B9D5508A40434101693BEFA81E8DC2D9EBF50E3D`
 - Fix: approvals now stay with their owning task, and one task with several
   permissions needs only one confirm-or-reject decision.
 - Validation: source secret scan, production frontend build, Node/UI checks,
@@ -212,7 +221,9 @@ example `D:\build-target\ds-agent-v1-release`.
 - [v1 architecture](docs/architecture/DS_AGENT_V1_ARCHITECTURE_PLAN.md)
 - [v1.0.2 release notes](docs/RELEASE_NOTES_v1.0.2.md)
 - [v1 completion audit](docs/DS_AGENT_V1_COMPLETION_AUDIT.md)
-- [Security](SECURITY.md) · [Contributing](CONTRIBUTING.md) · [License](LICENSE)
+- [Security](SECURITY.md) · [Privacy](PRIVACY.md) ·
+  [Code signing policy](CODE_SIGNING_POLICY.md) ·
+  [Contributing](CONTRIBUTING.md) · [License](LICENSE)
 
 DS Agent is an independent open-source project. It is not an official DeepSeek
 product and does not claim DeepSeek ownership, authorization, or endorsement.

README.zh-CN.md

@@ -161,6 +161,13 @@ command 与 React UI 保持薄层，业务状态由 Kernel 和持久投影统一
 v1.0.2 安装包目前尚未签名，Windows 可能显示“未知发布者”提示。安装前请阅读
 [安装指南](docs/INSTALLATION.md)。
 
+## Code signing policy（代码签名政策）
+
+DS Agent `v1.0.2` 仍未签名。项目正在准备开源签名申请；只有应用程序和安装包都独立回读为
+Authenticode `Valid`，才会将对应 Release 声明为已签名。获准加入该计划的 Release 将遵循：
+**Free code signing provided by SignPath.io, certificate by SignPath Foundation.**
+完整说明见[代码签名政策](CODE_SIGNING_POLICY.md)和[隐私政策](PRIVACY.md)。
+
 ### 从源码运行
 
 ```powershell
@@ -176,8 +183,8 @@ npx pnpm@9.15.9 --filter @deepseek-agent-os/desktop tauri:dev
 
 - Release：[DS Agent v1.0.2](https://github.com/Lee-take/dsagent/releases/tag/v1.0.2)
 - 安装包：`DS.Agent_1.0.2_x64-setup.exe`
-- 大小：`12,716,857 bytes`
-- SHA-256：`469C4EFA54F4C94A6E37D28C9C88D331B26E1770C6792DC93D02B451640E2A6F`
+- 大小：`12,714,353 bytes`
+- SHA-256：`21459D5A8CFF2606171CBD52B9D5508A40434101693BEFA81E8DC2D9EBF50E3D`
 - 修复：审批只跟随所属任务；同一任务需要多项权限时，只需一次确认或拒绝。
 - 验证：源文件密钥扫描、前端 production build、全部 Node/UI 检查以及 852 项 Rust
   测试；845 项通过，7 项需要额外权限的 live/GUI 测试按设计忽略，0 项失败。
@@ -189,7 +196,9 @@ npx pnpm@9.15.9 --filter @deepseek-agent-os/desktop tauri:dev
 - [v1 架构计划](docs/architecture/DS_AGENT_V1_ARCHITECTURE_PLAN.md)
 - [v1.0.2 发布说明](docs/RELEASE_NOTES_v1.0.2.md)
 - [v1 完成审计](docs/DS_AGENT_V1_COMPLETION_AUDIT.md)
-- [安全说明](SECURITY.md) · [参与贡献](CONTRIBUTING.md) · [开源许可](LICENSE)
+- [安全说明](SECURITY.md) · [隐私政策](PRIVACY.md) ·
+  [代码签名政策](CODE_SIGNING_POLICY.md) · [参与贡献](CONTRIBUTING.md) ·
+  [开源许可](LICENSE)
 
 DS Agent 是独立开源项目，不是 DeepSeek 官方产品，也不主张任何 DeepSeek 所有权、授权
 或官方背书。项目使用 DeepSeek 名称，仅用于说明模型兼容性和 DeepSeek-first 设计方向。

SECURITY.md

@@ -1,15 +1,16 @@
 # Security Policy
 
-DeepSeek Agent OS is an alpha local-first desktop project. The 0.1.0 preview is
-a source-first public preview and is not an official DeepSeek product. Security
+DS Agent is a local-first Windows desktop agent. DS Agent v1.0.2 is the current
+published stable release and is not an official DeepSeek product. Security
 reports are welcome, especially around local credentials, permission gates,
-audit records, Computer Use boundaries, and package import/export behavior.
+audit records, Computer Use boundaries, update integrity, code signing, and
+package import/export behavior.
 
 ## Supported Version
 
 | Version | Supported |
 | --- | --- |
-| 0.1.0 | Security reports accepted; no stability guarantee |
+| 1.0.2 | Supported |
 
 ## Reporting A Vulnerability
 
@@ -28,8 +29,12 @@ Include:
 
 ## Security Boundaries
 
-- DeepSeek API keys are read from the local process environment and must not be
-  stored in events, UI state, logs, or exported work packages.
+- Current stable v1.0.2 reads a user-supplied DeepSeek API key from the desktop
+  process environment. It must not be stored in events, UI state, logs, or
+  exported work packages.
+- Unpublished Step 1 onboarding work proposes a dedicated Windows DPAPI vault
+  and secret-free readiness receipt. It is not part of the current stable
+  release and must not be described as published until its release gates pass.
 - `pnpm test:secrets` scans tracked and unignored repository files for live
   `sk-` style keys and non-empty `DEEPSEEK_API_KEY` assignments without printing
   candidate values.
@@ -42,6 +47,9 @@ Include:
 - Web search evidence must preserve source URLs.
 - Import writes memories as reviewable candidates, not automatic long-term
   memory.
+- Release identity must follow the [code signing policy](CODE_SIGNING_POLICY.md).
+  An unsigned or invalidly signed artifact must not be represented as a signed
+  release. See also the [privacy policy](PRIVACY.md).
 
 ## Out Of Scope For Alpha
 

docs/INSTALLATION.md

@@ -23,6 +23,32 @@ source checkout to run the installed app.
 The installer-selected application directory is only for program files. It is
 not the workspace, evidence folder, export folder, or event database location.
 
+## Code signing policy and verification
+
+DS Agent `v1.0.2` is an immutable historical unsigned release. Its checksum
+remains the verification route for that asset. Future release notes must state
+whether a release is signed. A release must not be described as signed unless
+both `ds-agent.exe` and the NSIS installer independently report Authenticode
+`Valid`, the expected signer and timestamp, and the documented SHA-256.
+
+For releases accepted into the open-source signing program: **Free code signing
+provided by SignPath.io, certificate by SignPath Foundation.** The complete
+[Code signing policy](../CODE_SIGNING_POLICY.md) defines provenance, approval,
+verification, and incident handling. The [privacy policy](../PRIVACY.md)
+describes current local data and user-triggered network behavior.
+
+On Windows, inspect a downloaded installer without launching it:
+
+```powershell
+Get-AuthenticodeSignature .\DS.Agent_1.0.2_x64-setup.exe |
+  Select-Object Status, StatusMessage, SignerCertificate, TimeStamperCertificate
+Get-FileHash .\DS.Agent_1.0.2_x64-setup.exe -Algorithm SHA256
+```
+
+For `v1.0.2`, `Status` is expected to be `NotSigned`. For a future release that
+is explicitly documented as signed, any status other than `Valid`, any
+unexpected signer, or any hash mismatch is a stop condition.
+
 At first run, choose one local workspace root. DS Agent uses that workspace for
 approved local file actions and maintains subdirectories for evidence, exports,
 reports, workflow runs, work packages, memory, logs, and future artifact types

docs/OPEN_SOURCE_RELEASE.md

@@ -63,6 +63,10 @@ Ship a buildable local-first desktop Agent OS preview that demonstrates:
   setup behavior, and Operations Briefing scope.
 - If an unsigned installer is attached, disclose the unsigned status in the
   release notes and provide a SHA-256 checksum.
+- The immutable `v1.0.2` installer remains unsigned. A future release must not
+  be represented as signed unless its application executable and NSIS installer
+  satisfy `CODE_SIGNING_POLICY.md` and independently verify as Authenticode
+  `Valid` with the expected signer, timestamp, source binding, and SHA-256.
 
 ## Release Hygiene Artifacts
 
@@ -71,6 +75,13 @@ Ship a buildable local-first desktop Agent OS preview that demonstrates:
 - `CONTRIBUTING.md` explains the `0.1.0` Windows-first preview policy.
 - `SECURITY.md` documents current security boundaries and private reporting
   expectations.
+- `PRIVACY.md` documents local data handling and every current category of
+  user-triggered network activity.
+- `CODE_SIGNING_POLICY.md` documents signing roles, manual approval,
+  source-to-binary provenance, two-stage application/installer signing, and
+  independent Authenticode verification. Until SignPath approval provides real
+  identifiers, CI must not contain guessed organization, project, policy, or
+  artifact slugs and the repository must not contain a signing token.
 - GitHub Private Vulnerability Reporting is enabled for sensitive security
   reports.
 - `.github/pull_request_template.md` keeps PRs scoped to existing preview work.