Your local agent cockpit.

Kansei checks every update against the signed update manifest and an exact SHA-256 checksum before installing it. Windows and macOS signing varies by build. Windows will likely show a "Windows protected your PC" warning on first run — expected if this build is unsigned, and still possible on a signed one until it builds up reputation. Click More info, then Run anyway. If Smart App Control is on, Windows blocks unsigned apps and offers no Run anyway. The first time you open a signed and notarized macOS build, macOS asks whether to open an app downloaded from the internet. Click Open. macOS blocks an unsigned build the first time: open System Settings → Privacy & Security, scroll down, and click Open Anyway. Linux downloads always carry a detached GPG signature. Each Linux download link redirects to its file on updates.kansei.sh, and the signature lives at that final URL with .asc appended — which you can check against the signing key at https://updates.kansei.sh/alpha/signing-key.asc. A good signature means the download wasn't altered in transit, not who built it. Each release's notes give the exact signing status for every platform.

When you first open Kansei, it opens kansei.sh in your browser. Sign in there if you aren't already, then press Continue to sign the app in as that account. Accounts with two-step verification also enter their authenticator code in the app.

Sign in on the replacement or wiped computer and download again. There is no device token, invitation reissue, or per-account download quota.