CareTV Developer Interface v001 - 2026-08-20

Architecture
- Static HTML/JavaScript developer page: no AWS secrets.
- Local Windows PowerShell agent bound ONLY to 127.0.0.1:8765.
- Agent uses AWS CLI profile "caretv-publisher".
- One button performs S3 sync then CloudFront invalidation.
- All daily-build destinations are constrained to beta/_daily-builds/.

Today
1. Copy config.example.json to config.json.
2. If an existing AWS CLI profile already works, set awsProfile to that profile name and start the agent. No AWS console login is required.
3. Open caretv.org/index.html locally.
4. Press Agent Status, then Publish + Invalidate.

Credential design
DO NOT put AWS keys in HTML, JavaScript, source control, ZIP packages, or config.json.
For the immediate prototype, reuse an existing local AWS CLI profile if available.
For the hardened background-agent version, use a dedicated least-privilege identity and temporary credentials where practical. If long-lived credentials are temporarily unavoidable, store them encrypted for the Windows service account and expose them only to the child AWS CLI/SDK process.

AWS resources currently configured
- S3 bucket: www.8k.art
- CloudFront distribution: E2V3BNV4FSTYQ1

Daily-build rule
Every new deliverable updates YYYY-MM-DD/index.html. The page must show an obvious build version/date/Pacific-time stamp and point to the latest version of each project while preserving older versions.