# Pro Policy, Website, and Release Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

**Goal:** Make every in-app, public-site, and Google Play disclosure match the implemented one-time Pro purchase, then pass the complete Android release gate.

**Architecture:** Committed policy text and structured website content remain the authoritative public copy. Tests require the same product boundary, processor list, retention, restore, refund, and support statements across all surfaces. Play Console is configured only after repository artifacts and internal-track behavior pass review.

**Tech Stack:** Node.js content tests, React legal/settings UI, static website generator, Android Gradle/AAB, Google Play Console operational workflow.

## Global Constraints

- Update public claims only after local enforcement, verifier interfaces, and Android purchase UI exist.
- State that the app is free to download; all Codex remote features work with one account; Pro adds
  accounts two through five. Never imply Codex usage itself is purchased.
- Use “one-time non-consumable purchase,” not subscription or lifetime cloud service.
- Preserve statutory refund/consumer rights; do not promise a refund rule narrower than Google Play
  or applicable law.
- External site deployment, Play Console changes, signing, upload, submission, production purchase,
  and refund tests require explicit operator approval.

---

### Task 1: Turn policy requirements into failing contract tests

**Files:**
- Modify: `tools/public-policy-documents.test.mjs`
- Modify: `tools/public-site.test.mjs`
- Modify: `apps/pwa/src/features/settings/SettingsWindow.test.jsx`

- [ ] Add Korean and English assertions for free 1-account/Pro 5-account limits,
  `pro_multi_account`, one-time purchase, Google Play billing, restore, cancellation/refund effect,
  outage grace, service sunset protection, support, and no Code Remote login.
- [ ] Add privacy assertions for transient purchase-token verification, SHA-256 token hash,
  installation public-key thumbprint, purposes, retention, processors (Google Play, Cloud Run,
  Firestore, Pub/Sub), deletion/support route, and no email/payment-method collection by the app.
- [ ] Assert terms, privacy, website, store listing, and in-app links all expose matching effective
  dates and URLs. Keep the current “no in-app purchases” assertions until this task intentionally
  flips them, proving the test fails before content changes.
- [ ] Run the three focused test files and record the expected contradictory-copy failures.
- [ ] Commit only the failing tests with `test: define Pro public policy contract`.

### Task 2: Update authoritative terms and privacy disclosures

**Files:**
- Modify: `distribution/TERMS.txt`
- Modify: `distribution/PRIVACY.txt`
- Modify: `apps/pwa/src/features/settings/SettingsWindow.jsx`
- Modify if needed: `apps/pwa/src/features/settings/settings.css`

- [ ] Update terms in Korean and English with product scope, account limits, purchase/restore,
  Google Play payment handling, refund and applicable-law rights, local-data retention on downgrade,
  verifier outage behavior, abuse limits, support, and service termination handling.
- [ ] Update privacy text with exact purchase data flow, transient token handling, hashed server
  record, installation binding, processors and regions, retention periods, security controls,
  deletion/support process, and data not collected.
- [ ] Add accessible in-app terms/privacy/support links and concise purchase disclosures next to the
  purchase action. Avoid duplicating full policy prose in components.
- [ ] Run policy and settings focused tests and confirm all pass.
- [ ] Commit with `docs: disclose Android Pro purchase`.

### Task 3: Synchronize website, Store Listing, and Data Safety source

**Files:**
- Modify: `website/content.mjs`
- Modify: `website/content.test.mjs`
- Modify: `docs/STORE_LISTING.md`
- Create: `docs/PLAY_DATA_SAFETY.md`
- Modify: `docs/PRO_ENTITLEMENT_OPERATIONS.md`

- [ ] Update home, privacy, terms, support, and deletion pages in Korean and English. Include the
  free/Pro boundary, localized-price caveat, restore path, refund/support path, processor list, and
  service-status/outage language.
- [ ] Update Store Listing short/full descriptions and screenshot captions without using
  “official Codex app,” “unlimited,” or subscription language.
- [ ] Record the Play Data Safety answers as an evidence worksheet, including purchase history
  processing, encryption in transit, no sale/advertising, retention/deletion, and every shipped SDK.
  Treat Console answers as an assessment to confirm against the final artifact, not an automatic
  declaration.
- [ ] Add an operations sync matrix mapping each public claim to its authoritative file and Play
  Console field so a future operator can re-check it.
- [ ] Run website and policy tests and confirm all pass.
- [ ] Commit with `docs: synchronize Pro store disclosures`.

### Task 4: Dependency notices and artifact privacy audit

**Files:**
- Modify: `THIRD_PARTY_NOTICES.md`
- Create: `tools/pro-release-artifact.test.mjs`
- Modify if generated by the existing workflow: `apps/pwa/android/app/src/main/res/raw/third_party_notices.txt`

- [ ] Add license/source notices for Google Play Billing, Google Auth Library, and Firestore client
  using their shipped versions and licenses; use the repository's notice-generation process where
  available.
- [ ] Add artifact tests that reject secrets, service-account JSON, private keys, local paths,
  debug verifier URLs, raw purchase tokens, and inconsistent package/product IDs across tracked
  release inputs.
- [ ] Build verifier container and unsigned Android release AAB; inspect dependency lists and
  archive contents. Save only safe command evidence, not extracted credentials or local paths.
- [ ] Run notice/artifact tests and `git diff --check`; confirm pass.
- [ ] Commit with `build: audit Pro release dependencies`.

### Task 5: Operator-approved Google and website staging

**Files:**
- Modify after actual staging evidence: `docs/PRE_RELEASE_CHECKLIST.md`
- Modify after actual configuration: `docs/PRO_ENTITLEMENT_OPERATIONS.md`

- [ ] Stop and request explicit approval before external changes.
- [ ] After approval, create/link the dedicated Cloud Run runtime service account without a key
  file; grant only Play purchase read/acknowledge, Secret accessor for the signing key, and required
  Firestore permissions.
- [ ] Create verifier signing secret, Firestore retention/indexes, authenticated Pub/Sub RTDN push,
  authenticated Scheduler reconciliation, Cloud Run service, rate limits, alerts, and rollback
  revision. Record only resource labels/fingerprints permitted by the private operator inventory.
- [ ] Configure Play Console merchant profile and non-consumable product `pro_multi_account` at the
  intended Korean base price, license testers, RTDN, privacy/support/deletion URLs, Data Safety,
  content rating, and internal track. Do not publish production.
- [ ] Deploy the public website only after preview diff and operator approval; verify HTTPS pages and
  links from a clean browser.
- [ ] Commit only non-secret documentation/evidence with `ops: record Pro staging configuration`.

### Task 6: Integrated internal-track release gate

**Files:**
- Modify: `docs/PRE_RELEASE_CHECKLIST.md`
- Modify: `ROADMAP.md`

- [ ] Run `npm.cmd test`, `npm.cmd --workspace apps/pwa exec vite build`, and `git diff --check`;
  require exit code 0 and record pass/fail/skip counts.
- [ ] Run Android native unit tests, verifier tests, website tests, and signed-release artifact
  audit. Signing and internal-track upload require explicit approval immediately before each action.
- [ ] On a clean install at 390x844 verify free account use, second-account purchase prompt,
  localized price, cancellation, pending, successful license-tester purchase, acknowledgement,
  account two through five, sixth rejection, app restart, and backend restart.
- [ ] Verify same-Play-account restore after clearing app data, another device restore, 30-day
  refresh, simulated verifier outage with 7-day grace, RTDN cancellation, and an operator-approved
  license-test refund. Confirm no account/chat deletion and future certificate denial after refund.
- [ ] Verify Tailscale access, account switching, unified Chats, desktop history, old-thread resume,
  SSE, approvals, Changes, usage status, notifications, and pinned mobile composer.
- [ ] Compare the final AAB SDK/data inventory to the Play Data Safety worksheet and compare every
  in-app URL and claim to the deployed website and Store Listing.
- [ ] Update checklist evidence, mark the Pro patch complete, and advance to the next bounded release
  item. Update the roadmap only with verified status.
- [ ] Commit with `release: complete Android Pro gate`.
- [ ] Stop before production submission or rollout and ask for separate operator approval.
