LlamaCasty/TASKS/task-48-distribution-msix.md

TASK 48 — Distribution & packaging: route decision, MSIX, signing

Catalog: TASKS.md — status and requirements live here. Research: TASKS/research-store-certification.md — the "why". Carved out of TASK 36 item 6 (release engineering) on 2026-09-27 so distribution has one owner instead of three scattered mentions.

Status: ☐ Queued — ⏳ blocked on the creator's route decision (item 0)

Goal: get LlamaCasty in front of a user without a SmartScreen scarewall, ideally without an annual certificate bill, and without breaking recording, capture, or audio.

⚠️ Nothing in this task is decided yet. The research is done and MSIX is the front-runner, but the route is the creator's call. Items 2–8 describe the MSIX path conditional on choosing it — if the answer is Polar-hosted + a cert, most of them evaporate and only items 0, 1, and 9 remain.

---

0. ⛔ THE DECISION — creator, not AI

Pick one:

#	Route	Cert/yr	SmartScreen	Extra work
A	Store MSIX + Store IAP	$0	none	MSIX packaging; Store review; Polar deleted; revenue cut
B	Store MSIX + Polar	$0	none	MSIX packaging; Store review; two systems to maintain
C	Polar file hosting + Polar + own cert	$120–300	warning ramp	none beyond buying the cert
D	Store EXE (10.2.9)	$120–300	warning ramp	dominated — cert anyway + silent install + maintain our own URL

C is the status quo already sketched in Distribution.md:14/:296 — Polar hosts the signed exe (10GB, signed personal URLs, SHA-256). The Store is not needed for delivery at all; its only unique value is free Microsoft signing with no warning.

Cost table, full detail, and the dead-EV correction: research-store-certification.md §2–3.

---

1. ⛔ Bundle ffmpeg instead of downloading it — do this on EVERY route

Not conditional on the Store. This is worth doing regardless.

Services/Encoder/FfmpegLocator.cs:37-38 pins a GitHub release URL; LocateAsync downloads (line 69), extracts (line 73), and the encoder executes the result. On a cold cache the app downloads an unsigned executable from the internet and runs it.

• Store blocker: policy 10.2.2 forbids dynamic code inclusion (download-and-execute).
• Route-independent bug class: FfmpegLocator.cs:30-35 records that the previous daily pin aged out of GitHub retention and 404'd on the first real recording attempt (2026-09-01). Bundling kills this permanently and removes the startup network dependency.

Do: ship ffmpeg.exe + ffprobe.exe + the libav*.dll family inside the package; FfmpegLocator resolves PATH → package-local → cache, and never downloads. IFfmpegLocator's contract, the ExtractBinaries staging discipline, and the existing FfmpegLocatorTests cold/cache/PATH coverage all still apply.

Licensing: the LGPL-shared build was chosen for LGPL §6 compliance (dynamic linking = "license text + source offer"). That reasoning is unaffected. Confirm THIRD-PARTY-NOTICES.txt covers the bundled build.

Record the immutable tag in TASKS.md per the licensing rule, and note the URL is now a provenance record rather than a runtime fetch.

---

2. ☐ Package.appxmanifest — full trust, camera, microphone

Only if the Store is chosen. There is currently no .manifest file in the repo at all, so this is purely additive.

• rescap:Capability Name="runFullTrust" — medium integrity, not AppContainer
• webcam and microphone capabilities
• uap10:TrustLevel="mediumIL", uap10:RuntimeBehavior="packagedClassicApp"
• uap10:RuntimeBehavior="packagedClassicApp" is what allows launching package executables as child processes
• Declare English only (10.7 — otherwise the description must be localized into every declared language)
• Block map SHA2-256, StoreManifest, under the 25 GB cap

Do NOT use appContainer — see the invariant in item 6.

3. ☐ Remove Velopack — 3 edit sites

Only if the Store is chosen (the Store handles updates). Trivially removable; the code was written defensively for exactly this.

• ytLive.csproj:92 — <PackageReference Include="Velopack" Version="1.2.0" />
• App.xaml.cs:3 — using Velopack;
• App.xaml.cs:38-46 — the sole call site, already try/caught and commented "(non-fatal) … when no URL is set, the check is a no-op"

Retires: the pending "Velopack update URL" item (TASKS.md open items, task-10-monetization.md:43) and the self-hosted DigitalOcean droplet.

4. ☐ Windows App Certification Kit

Run before submission. Technical compliance is tested by WACK; it is not optional. Known relevant check: the app must start promptly, stay responsive, and shut down gracefully (10.4.2).

5. ☐ Certification notes + the three documentation artifacts

In Partner Center (submission):

• ☐ Working YouTube demo account (10.3.1) — required, we cannot stream without sign-in
• ☐ Tick the secure third-party purchase API box — Polar (10.8.1 / 10.8.2)
• ☐ The 11.12 UGC position, stated in full — "mirrored from YouTube, which moderates it at industrial scale upstream; we render transiently, persist nothing, and provide no user-to-user communication surface." Full reasoning and the Q1-2026 enforcement numbers are in research-store-certification.md §9
• ☐ The YouTube age-gate argument — operator is 13+ by construction (§8)
• ☐ Note that the product is general audience, not directed at under-13s

On llamachile.shop:

• ☐ Privacy policy (10.5.1 — mandatory for Win32/Desktop Bridge). Must state: camera/mic access is user-directed and OS-gated; no retention of chat or reward payloads; no viewer data collected; ffmpeg is bundled and nothing is fetched at runtime
• ☐ Code of conduct + content guidelines (11.12 / 11.15)
• ☐ Confirm THIRD-PARTY-NOTICES.txt covers the bundled LGPL ffmpeg build

In Partner Center (listing):

• ☐ IARC age-rating questionnaire (10.11.1) — general audience, 12+ territory
• ☐ Title is exactly LlamaCasty — 10.1.1 forbids marketing text or extraneous keywords
• ☐ Search terms: max 7, no pricing terms, and no other product titles (10.1.3 — cannot list OBS or StreamYard)
• ☐ Real listing content — 10.1.4 requires an active, substantive presence
• ☐ Review the Individual vs Company account question before enrolling (see research-store-certification.md §11 item 1) — getting this wrong means re-enrolling

6. ☐ The full-trust recording invariant — comment lands WITH this work

ViewModels/MainViewModel.Recording.cs:173-179 (DefaultRecordFolder()) writes to %USERPROFILE%\Downloads or SpecialFolder.MyVideos; ChooseRecordFolder() (line 151) uses Microsoft.Win32.OpenFolderDialog; the temp-write-then-move lifecycle stays in one directory (line 131-132).

This works only because the package is full trust. At mediumIL, user-profile writes pass through unvirtualized and OpenFolderDialog is an ordinary Win32 browser with no capability token. No broadFileSystemAccess needed.

⚠️ If anyone flips the manifest to appContainer, recording silently breaks — Directory.CreateDirectory and File.Move start resolving to a per-package virtualized location and output vanishes.

Add a comment at DefaultRecordFolder() in this task, not before. A comment describing a manifest that does not exist is worse than no comment.

Also verify on a real packaged build before trusting it with recordings — the docs say full trust passes writes through, but that is worth confirming with an actual package identity rather than an unpackaged run.

7. ☐ Confirm the disqualifiers stay clear after packaging

All four are currently clear (verified by grep 2026-09-27) — re-verify once the packaging project exists:

• No Windows driver installed (we consume DShow filters, we do not install one)
• No per-user Windows service
• No elevation / requireAdministrator / UAC manifest
• No shell extension, no in-process module loading by outside processes, no jump list

8. ☐ Pre-submission gates

• ☐ 0 warnings, full suite green
• ☐ Vertical-recording path verified end-to-end (compositor tier is proven by Render_VerticalTier_Outputs_1080x1920_From_The_Center_Crop; the record path has never been exercised — Services/Pump/FramePump.cs:645 flags off-size tiers as a known follow-up)
• ☐ The real-output confirmation the creator has been doing manually
• ☐ Camera/mic/wasapi capture verified from the packaged build, not just unpackaged
• ☐ Clean uninstall verified (10.2.7)
• ☐ Notification-disabled path leaves the app functional (10.9)

---

Not in this task (deliberately)

• Velopack hardening / obfuscation / assembly splitting — stays a GA-time decision per TASK 36 item 6's agreed ceiling. Compile flags max at HARDENED + MOCK_REWARDS, additive-only.
• EULA draft/review and the THIRD-PARTY-NOTICES gate — stay in TASK 36 item 6.
• Vertical-canvas feature work — the feature exists; only the record-path test above is missing.
• macOS / Avalonia port — deferred; would be a second app, not a port.