# Production entitlement public-key record

This record contains public identification data only. The private key and its
password are not part of the repository, source archive, binary package, CI, or
Lemon Squeezy product.

- Purpose: sign machine-bound SmartCut64 paid entitlements
- Created: 2026-08-16 UTC
- Algorithm: RSA 3072-bit, public exponent 65537 (`010001`)
- Certificate subject: `CN=SmartCut64 Production Entitlement Signing`
- Certificate thumbprint: `F3D0431E0F6E79B9A722B6CE7CB0A45AB8C8847B`
- Public-modulus SHA-256: `6a1684cc402c989015d31d17584d0b9d89783e81774886e0bcce9893e335026f`
- Certificate expiry: 2036-08-16 UTC

The encrypted PFX, DPAPI-protected random password, and complete public-key
metadata are held outside Git beneath the current Windows user's private
`%LOCALAPPDATA%\Linekerpandi\SmartCut64\Licensing` directory. The generated key
public half and exact production HTTPS service URL are compiled into the current
commercial candidate. That candidate passed the paid-entitlement gate with a
perpetual machine-bound token. The private key has deliberately not been
uploaded to the fail-closed production licensing service while Lemon live-store
approval and the remaining operational controls are open.

Before live sale:

1. Copy the encrypted PFX to two independently controlled encrypted offline
   backups and verify a restore on a non-production machine.
2. Export the private key in memory only when placing it into the production
   activation service's secret store; do not create a plaintext PEM file.
3. Populate the production bridge only with approved live Lemon IDs and
   secrets, then perform a controlled live activation/refund/revocation cycle.
4. Document rotation, compromise response, customer continuity, and service
   shutdown remedies before enabling checkout.

The official build configuration and paid-gate evidence corresponding to the
public key are complete. Exact artifact hashes and signatures are recorded in
the generated non-overwriting store-staging manifest.
