# External commercial release blockers

The repository can automate build, testing, source delivery, package validation,
checksums, entitlement enforcement, and signing verification. It cannot create
or truthfully approve the external identities and legal rights below.

- [x] Seller identity, registered office and privacy/support/security/legal
  contacts are recorded for LINEKERPANDI LIMITED (company number 06406014).
- [x] Lemon Squeezy reports KYC verified, bank connection and 2FA complete, and
  Live Mode is available following store approval on 2026-08-20. Approval
  evidence is retained; payout/tax/territory eligibility remains governed by
  the live merchant account configuration.
- [x] The SmartCut64 first-party executables and NSIS installer are signed with
  the LINEKERPANDI LIMITED Azure Artifact Signing public-trust profile,
  Microsoft-timestamped, verified after packaging, and covered by the release
  SHA-256 manifest. Third-party runtime DLL provenance remains recorded in the
  SBOM and notices rather than being re-signed as SmartCut64-authored code.
- [x] The product owner confirmed on 2026-08-27 that independent counsel approved the exact GPL/LGPL binary/source delivery,
  customer terms, privacy notice, refund/digital-content flow, entitlement
  wording, and merchant-of-record configuration; the advice is retained outside
  the public repository.
- [x] The product owner confirmed that qualified legal sign-off resolved AVC/H.264, HEVC/H.265, AAC and any other
  enabled codec-patent exposure for each intended territory and distribution
  model; supporting advice and any required commercial arrangements are
  retained outside the public repository.
- [x] The product owner confirmed that the SmartCut64 product name, logo, splash artwork, screenshots, and factual
  VideoReDo compatibility wording passed trademark/copyright clearance for the
  intended launch.
- [ ] A dedicated 3072-bit production entitlement key has been generated and
  its encrypted local custody/public fingerprint recorded. Its public key and
  HTTPS service URL passed the exact commercial release gate. Isolated
  production KV/preview storage, rate limits, and a fail-closed Worker shell are
  deployed. Two verified offline backups, live Lemon IDs, Cloudflare/Lemon
  secrets, domain, MFA, monitoring, retention, incident response, rotation, and
  continuity/shutdown remedy remain to be operationally approved.
- [x] Lemon test-mode activation passes repeat activation, two-device limit,
  third-device rejection, transfer, wrong-email rejection, signed refund
  webhook revocation of all seats, and deployed rate limiting.
- [ ] Exact staged installer/portable/source/checksum receipt downloads,
  interactive exact-binary activation, perpetual offline use, and support-reset
  flows pass; repeat the purchase/refund path once with a controlled live order.
- [ ] The broader VLC/mpv, long-file, device-diverse GPU/corpus matrix and
  optional elevated Application Verifier pass on the exact signed artifacts.

Live checkout must remain disabled until every item is evidenced and signed off.
