Build a private application

1. Create and develop

aegis create superb-metalform --template ai-workbench --visibility private
cd superb-metalform
npm install
aegis dev

The local shell simulates identity, files, AI, jobs and approvals. It does not require the production platform. Configure your private npm registry for the @aegis scope first.

2. Validate and package

aegis test
aegis build

Set the organisation ID in aegis.app.yaml, the source repository and committed revision. Pin dependencies in package-lock.json. Supply AEGIS_SIGNING_KEY as a private Ed25519 key file and AEGIS_PUBLISHER_ID as the trusted registry publisher.

3. Register the customer installation

Create the application and target environment in Application Factory. A customer administrator approves the requested permissions in Aegis OS → Application access. Staging and production use separate workspaces.

4. Request deployment

aegis deploy --tenant superb-industries --environment staging

The CLI registers the signed release and creates a plan. A different operator approves the plan. Record staging test evidence before creating a production plan. Releases are immutable; rollback selects a previously installed, rollback-safe version.

Runtime contract

Apps run in a sandboxed frame. The host provides navigation and scoped SDK calls; NestJS rechecks identity, entitlement, publisher trust, grants and resource ownership. App code receives neither session tokens nor secret values.

SDK v1 supports document-analysis and metalform-cad workers. CAD uses the configured platform adapter, including Daytona. New worker implementations require platform registration; application packages cannot upload server executables.

Dedicated infrastructure must be provisioned through an authorised deployment workflow before a tenant-bound target is registered. Package installation does not create a cloud account or deploy infrastructure.