The upgrade package distribution hub for device-side launchers: upload and sign packages, deliver them through staged channels, and let devices download with short-lived tickets. Every install report is auditable.
Packages are stored verbatim (never decrypted on the server) and covered by an external signing key, so integrity is guaranteed end to end.
Beta packages are promoted to the stable channel only after the observation period passes; failed installs roll back automatically on the device.
Devices register with their machine-id and bind a credentials application; approve or block them and organize fleets by group.