${{ secrets.VARIABLE_NAME }}.
---
@@ -228,7 +228,8 @@ publish:
Your server must host the same directory structure as the S3 layout above.
-> [!IMPORTANT] > **MIME Type Configuration**: Ensure your file server correctly serves `.yml` files with `text/yaml` and installer binaries with `application/octet-stream`. Incorrect MIME types will cause download corruption or silent update failures.
+> [!IMPORTANT]
+> **MIME Type Configuration**: Ensure your file server correctly serves `.yml` files with `text/yaml` and installer binaries with `application/octet-stream`. Incorrect MIME types will cause download corruption or silent update failures.
**Nginx reference:**
@@ -255,7 +256,8 @@ server {
## 🛡️ Code Signing: The Trust Boundary
-> [!WARNING] > **Code signing is not merely a requirement — it is the Trust Boundary established by the operating system.** macOS Gatekeeper will explicitly terminate unsigned applications or refuse background updates to maintain system integrity. Windows SmartScreen will display alarming warnings to users. Without valid signatures, `electron-updater` will **reject update payloads entirely**.
+> [!WARNING]
+> **Code signing is not merely a requirement — it is the Trust Boundary established by the operating system.** macOS Gatekeeper will explicitly terminate unsigned applications or refuse background updates to maintain system integrity. Windows SmartScreen will display alarming warnings to users. Without valid signatures, `electron-updater` will **reject update payloads entirely**.
### macOS
diff --git a/apps/desktop/docs/CONFIGURATION.md b/apps/docs-dev/src/apps/desktop/CONFIGURATION.md
similarity index 99%
rename from apps/desktop/docs/CONFIGURATION.md
rename to apps/docs-dev/src/apps/desktop/CONFIGURATION.md
index 208eb23..c0ec7f8 100644
--- a/apps/desktop/docs/CONFIGURATION.md
+++ b/apps/docs-dev/src/apps/desktop/CONFIGURATION.md
@@ -1,4 +1,3 @@
-[← Back to Root](../../../README.md)
# Desktop Configuration Guide
diff --git a/apps/desktop/docs/IPC_ARCHITECTURE.md b/apps/docs-dev/src/apps/desktop/IPC_ARCHITECTURE.md
similarity index 92%
rename from apps/desktop/docs/IPC_ARCHITECTURE.md
rename to apps/docs-dev/src/apps/desktop/IPC_ARCHITECTURE.md
index b36d79f..26a50e3 100644
--- a/apps/desktop/docs/IPC_ARCHITECTURE.md
+++ b/apps/docs-dev/src/apps/desktop/IPC_ARCHITECTURE.md
@@ -1,10 +1,21 @@
-[← Back to Root](../../../README.md)
+---
+outline: [2, 3]
+---
# IPC Architecture & Security Model
-The Secure Communication Blueprint.
+> **Scope**: Electron Main ↔ Renderer process communication
+> **Enforcement Level**: Mandatory — deviations constitute security violations
-> This document defines the **Hardened Security Perimeter** and communication topology governing the Desktop Wrapper. Every native capability exposed to the renderer is mediated through a **Non-Bypassable IPC Bridge**, ensuring that the Node.js Main Process remains cryptographically and logically isolated from untrusted web content. Adherence to this document is **mandatory** — deviations constitute security violations subject to immediate remediation.
+This document defines the **hardened security perimeter** and communication topology governing the Desktop Wrapper. Every native capability exposed to the Renderer is mediated through a **non-bypassable IPC bridge**, enforcing strict privilege separation between the Node.js Main Process and untrusted web content.
+
+The architecture operates on three invariants:
+
+| Invariant | Guarantee |
+|---|---|
+| **Context Encapsulation** | The Preload Script executes in a hermetically sealed V8 context, isolated from both Main Process globals and the Renderer DOM. |
+| **Interface Narrowing** | Only explicitly declared, type-safe API surfaces are exposed via `contextBridge`. No wildcard access patterns exist. |
+| **Deterministic Lifecycle** | All IPC subscriptions are paired with unsubscribe functions, tying native event listeners to React's component lifecycle to prevent memory leaks. |
---
@@ -96,7 +107,8 @@ These settings are declared in `BrowserWindow.webPreferences` and are **non-nego
Every native feature in this architecture **must** follow the Three-Step Bridge — a Standard Operating Procedure (SOP) that ensures traceability, type-safety, and auditability across the entire IPC surface.
-> [!IMPORTANT] > **Deterministic Synchronization**: Maintaining parity between the Main Process handler, the Preload Gateway exposure, and the TypeScript interface declaration is **mandatory**. A mismatch between any two of the three layers will result in either a **Type-Safety Gap** (silent failures in development) or a **Runtime Regression** (crashes in production).
+> [!IMPORTANT]
+> **Deterministic Synchronization**: Maintaining parity between the Main Process handler, the Preload Gateway exposure, and the TypeScript interface declaration is **mandatory**. A mismatch between any two of the three layers will result in either a **Type-Safety Gap** (silent failures in development) or a **Runtime Regression** (crashes in production).
### Step 1: Register the Handler — Main Process
diff --git a/apps/desktop/README.md b/apps/docs-dev/src/apps/desktop/index.md
similarity index 90%
rename from apps/desktop/README.md
rename to apps/docs-dev/src/apps/desktop/index.md
index 220e0ee..68e245e 100644
--- a/apps/desktop/README.md
+++ b/apps/docs-dev/src/apps/desktop/index.md
@@ -102,7 +102,7 @@ All artifacts are emitted to the `release/` directory.
> APPLE_APP_SPECIFIC_PASSWORD=Building high-end enterprise applications requires strict consistency, shared tooling, and well-defined boundaries. This monorepo serves as the absolute source of truth for our frontend ecosystem.
+By enforcing strict linting, formatting, and building patterns at the root (powered by Turborepo), we ensure that every application in the ecosystem adheres to our high standards without duplicate configuration.
+The separation of UI components and Core logic guarantees that our web and desktop applications all share the exact same state management and event-driven architecture, drastically reducing cognitive load.
+With a rich library of 22+ advanced Form components, pre-configured Vite/TypeScript environments, and an enterprise App Shell, teams can stop reinventing the wheel and start building product features on day one.
+