SovereignDesk AI

SovereignDesk AI is a premium ICP-native client operations workspace: private client workrooms, approval gates, document metadata, role governance, audit history, upgrade safety, and public canister proof.

Production status: this repository currently represents a live ICP mainnet MVP for public review and technical validation. It now includes encrypted document object storage, but it is not approved for real confidential client data, secrets, user funds, or regulated production workloads until vetKeys-backed key release and release governance are completed.

Live app: https://v7inb-hyaaa-aaaal-qw7aq-cai.icp0.io/
Backend:  vyjlv-kaaaa-aaaal-qw7aa-cai
Frontend: v7inb-hyaaa-aaaal-qw7aq-cai
Creator:  Robert <robert19001@gmail.com>

Built on Internet Computer. This project is independent and is not affiliated with or endorsed by the DFINITY Foundation.

The current implementation is intentionally canister-first and dependency-light:

• Motoko persistent backend canister.
• Vite frontend hosted by an ICP asset canister.
• Premium white/gold reviewer surface with product tabs and public proof.
• Internet Identity gated write operations and role-aware app modes.
• Owner/Admin/Operator/Client/Reviewer role model.
• Backend hardening gates for bootstrap, approvals, hashes, and snapshots.
• Schema version and owner-only state snapshot export.
• No AWS, Vercel, external database, or centralized app server.
• Local demo seeded through the backend seed_demo method.
• icp-cli is installed for the next migration step, while this MVP currently deploys through dfx.

Repository Docs

• Security policy
• Roadmap
• Reproducible build notes
• Controller hardening runbook
• Release checklist
• vetKeys integration plan
• Canister split plan
• Governance migration
• Trust manifest
• Demo script
• Case study
• Launch post
• Architecture
• Design system
• Product audit and plan

Demo capture artifacts are generated with:

npm run demo:capture

Current captures live in docs/qa/screenshots/demo/.

Local Canisters

Local IDs are generated by dfx in .dfx/local/canister_ids.json. They are machine-local, not stable, and should not be committed or referenced in documentation.

Open the local frontend with the frontend canister ID printed by dfx deploy:

http://<frontend-canister-id>.localhost:4943/

Open backend Candid:

http://127.0.0.1:4943/?canisterId=<candid-ui-canister-id>&id=<backend-canister-id>

Mainnet Deployment

The application is deployed on ICP mainnet.

frontend: v7inb-hyaaa-aaaal-qw7aq-cai
backend:  vyjlv-kaaaa-aaaal-qw7aa-cai
vault:    venre-5aaaa-aaaal-qw7ca-cai
audit:    vdmxq-qyaaa-aaaal-qw7cq-cai
agent:    vkp4m-gqaaa-aaaal-qw7da-cai
owner:    up6xy-uol7y-xisiv-3oron-gl7d3-usnrr-r5ong-hiqu2-hnd2h-cufv3-pqe

Open the public app:

https://v7inb-hyaaa-aaaal-qw7aq-cai.icp0.io/

Creator contact:

Robert
email: robert19001@gmail.com
workspace owner principal: up6xy-uol7y-xisiv-3oron-gl7d3-usnrr-r5ong-hiqu2-hnd2h-cufv3-pqe

Open backend Candid:

https://a4gq6-oaaaa-aaaab-qaa4q-cai.raw.icp0.io/?id=vyjlv-kaaaa-aaaal-qw7aa-cai

Current mainnet MVP hardening includes:

• public showcase endpoint without contact email, portal principal, owner principal, or raw actor principals;
• redacted public project/task/approval/document/note/audit fields, so real workspace details are not exposed through the showcase;
• authenticated access modes for operator, client portal, signed read-only, and public read-only users;
• on-chain operator access request queue with governance-side approval;
• role grants, revocation, and client portal principal rotation;
• client invite codes for self-service Internet Identity portal claiming;
• Document Vault v2 with document versions, archive records, and client-side SHA-256 verification evidence;
• encrypted vault objects: browser-side AES-GCM encryption, ciphertext-only canister storage, and vetKeys-ready derivation context;
• split vault, audit, and agent canisters deployed on mainnet with the protected controller;
• live frontend routing for new encrypted vault writes, AI brief drafts, and proof events into the split canisters;
• governance proposal ledger for multisig/SNS/Launchtrail migration decisions;
• update endpoints for client, project, task, document metadata, and notes;
• approval final-state protection and backend-side document hash validation;
• schema version v5 endpoint and owner-only state snapshot export;
• Trust Center section with canister IDs, controller, module hashes, dashboard links, and verification command;
• independent-project disclaimer for DFINITY/Internet Computer branding;
• tightened asset canister CSP and Permissions-Policy;
• escaped frontend rendering for canister-provided text;
• anonymous visitors see read-only proof and login CTAs instead of write buttons;
• desktop and mobile Playwright QA coverage for the release surface;
• custom canister product mark; the app does not recreate or modify the official ICP logo.

Selected release screenshots:

docs/qa/screenshots/qa-mainnet-final-desktop.png
docs/qa/screenshots/qa-mainnet-final-mobile.png

npm run qa:mainnet and npm run qa:product are maintainer-only mainnet checks. They require network access, current deployed canister IDs, and operator care because they validate the live deployment. Routine screenshots are written to docs/qa/screenshots/current/ so selected release artifacts are not overwritten.

Mainnet canister controllers:

sovereign_desk_backend:  7dnyu-motzm-oqehm-762iq-irfd3-taexs-huxbx-z5bdr-4hdjg-j4lih-5ae
sovereign_desk_frontend: 7dnyu-motzm-oqehm-762iq-irfd3-taexs-huxbx-z5bdr-4hdjg-j4lih-5ae

Commands

Local release gate:

npm run build
npm audit --omit=dev
npm run qa:hardening
npm run qa:roles
npm run qa:upgrade

Maintainer-only mainnet QA:

npm run build:ic
npm run qa:mainnet
npm run qa:product

Mainnet asset deploys must use the IC build so the bundled frontend points at the live backend instead of a local replica:

npm run build:ic
source "$HOME/Library/Application Support/org.dfinity.dfx/env"
dfx --identity sovereign-controller deploy sovereign_desk_frontend --network ic

Do not deploy or push from routine QA. Follow docs/release-checklist.md for release preparation and docs/controller-hardening-runbook.md before handling real client data.

Local replica:

source "$HOME/Library/Application Support/org.dfinity.dfx/env"
dfx identity use codex-icp
dfx start --background
dfx deploy
dfx canister call sovereign_desk_backend seed_demo
dfx canister call sovereign_desk_backend get_client_portal '(1)'
dfx canister call sovereign_desk_backend list_audit '(0, 5)'
dfx canister call sovereign_desk_backend ask_agent '("project:1", "Summarize next steps")'

Playground Deployment

The backend was also deployed to the real IC playground:

playground backend: 6cajv-qqaaa-aaaab-qactq-cai

It was seeded with seed_demo. The playground rejected the asset canister frontend because the dfx 0.32.0 asset canister wasm is not allowlisted in the playground. The durable deployment is now on ICP mainnet.

MVP API

The backend exposes:

• init_workspace
• get_my_workspace
• get_public_demo
• request_operator_access
• list_access_requests
• list_access_request_history
• approve_access_request
• reject_access_request
• get_my_roles
• list_role_grants
• grant_role
• revoke_role
• rotate_client_principal
• create_client_invite
• list_client_invites
• claim_client_invite
• revoke_client_invite
• get_system_info
• migrate_schema_version
• export_state_snapshot
• create_client
• update_client
• create_project
• update_project
• create_task
• update_task
• update_task_status
• update_project_status
• create_approval
• respond_approval
• create_document_record
• update_document_record
• add_document_version
• archive_document_record
• verify_document_hash
• list_document_versions
• list_document_verifications
• list_document_archives
• get_vetkey_derivation_context
• store_encrypted_document_object
• list_encrypted_document_objects
• get_encrypted_document_object
• create_governance_proposal
• list_governance_proposals
• review_governance_proposal
• append_note
• update_note
• get_client_portal
• ask_agent
• list_audit
• seed_demo

Next Build Steps

• Move controller governance from protected single identity to multisig, SNS, Launchtrail, or equivalent.
• Add request status lifecycle UX: pending, approved, rejected, archived.
• Add typed backend cross-canister wrappers for the deployed split vault, audit/proof, and agent services.
• Replace passphrase-derived vault demo keys with vetKeys-backed key release.
• Add proper file upload and certified document retrieval.
• Add automated E2E tests for authenticated Internet Identity flows.
• Add ckBTC/ckUSDC invoice payment flow after mainnet MVP.