What it teaches
- Discover current commands from CLI help and HTTP schemas from the raw OpenAPI contract.
- Build the checkout CLI, create and acknowledge an account credential, package/upload an app, publish immutable content, create a playlist, pair a Player, assign the playlist, and follow durable events.
- Preserve the account/runtime/release authority split and avoid treating protected storage as public hosting.
- Retry safely with idempotency keys and revisions; recover from durable operation, cursor, and problem responses.
Phase truth
| Surface | Status |
|---|---|
| CLI, SDK, Player, backend | Verified on the full three-replica localhost lifecycle |
| Android source | Standard/managed/Amazon unit, lint, debug, R8 release, and Player integration pass; no KVM instrumentation, physical hardware validation, store publication, or general offline guarantee |
| npm packages | Not published |
| Marketing + docs | Public HTTPS live and verified; not an uptime, SLA, customer, or traffic claim |
| Service production | API, Player, release hosts, protected content, and full stack not deployed or verified |
| MCP / billing / screenshots / recovery | Deferred beyond v1 |
Safe verification
node packages/cli/dist/bin.js --help
node packages/cli/dist/bin.js app pack ./path/to/built-webapp --output /tmp/app.tar.gzThe first command inspects the implemented command tree. The second packages local content without contacting a backend. Do not install an unrelated npm package named screenrig.
Hard rules
- Never place account bearer tokens in URLs, Player state, uploaded applications, logs, or examples.
- Never invent public API availability from localhost evidence.
- Never construct release or media URLs from identifiers; follow server-issued manifests and grants.
- Never describe protected release/media/K/V origins as public file hosting.
- Use the OpenAPI contract for HTTP schema and CLI
--helpfor commands.