# V2 Executable Packing and Encryption

V2 shipping binaries are distributed through a protected executable envelope
after the Shipping build is produced and before storefront wrapping. The packing
layer is intentionally scoped to release packaging: it encrypts the shipping
payload, records exactly what was packed, and leaves gameplay determinism,
accessibility fallbacks, and crash reporting paths outside the protected
envelope.

## Profiles

The launch coverage is `Win64-Shipping`, `Linux-Shipping`, and `Mac-Shipping`.
Each profile defines the input binary, protected binary, encrypted chunk
manifest, signed packing manifest, symbol input, storefront coverage, and
excluded modules in `V2/ue/Build/DRM/v2-executable-packing.json`.

Every profile uses AES-256-GCM for payload encryption, zstd compression, an
Ed25519 signed packing manifest, and release KMS envelope key wrapping. The
packing manifest is release evidence and must be archived beside the protected
binary so support, build engineering, and security review can trace the exact
inputs used for a store submission.

The binary signing handoff is explicit: sign binary after packing, never before
the protected executable envelope is produced.

## Safety Boundaries

This layer does not implement anti-debugging, runtime memory inspection, license
verification, or code virtualization. Those are separate Phase 72 tasks with
their own tests and review requirements. Keeping this boundary explicit avoids
mixing packaging protection with gameplay runtime behavior.

The packer must preserve crash unwind information, leave `CrashReportClient`
outside the envelope, and retain platform symbol inputs. Symbolication and crash
triage are release blockers, so protected builds must remain supportable.

Rollback and accessibility modules are also excluded from the protected payload.
The deterministic simulation code path must behave the same in protected and
unprotected builds, and the accessibility safe mode bypass must remain available
for support-approved recovery scenarios.

## CI Gates

`V2/ue/Tools/plan-v2-executable-packing.py` emits the deterministic packing plan
used by BuildGraph and release review.
`V2/ue/Tools/check-v2-executable-packing.py` validates the manifest, planner
output, Horde wiring, CI workflow wiring, and this runbook.

Required release gates:

- `drm-executable-packing-plan-generated`
- `drm-executable-packing-profile-coverage`
- `drm-executable-packing-encryption-enabled`
- `drm-executable-packing-manifest-signed`
- `drm-executable-packing-crash-unwind-preserved`

The gates ensure that every shipping desktop profile has encrypted payloads, a
signed packing manifest, crash unwind preservation, and explicit isolation from
deterministic simulation and accessibility fallback paths.