diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml
index 32895ea..dc5dc3d 100644
--- a/.github/workflows/build-release.yml
+++ b/.github/workflows/build-release.yml
@@ -180,6 +180,9 @@ jobs:
           if [ -z "$PKG" ]; then echo "no pkg found, skipping"; exit 0; fi
           xcrun stapler staple "$PKG"
           xcrun stapler validate "$PKG"
+          # P3 终验（rant 验收 + 设计文档 §5.1）：spctl -a 确认 Gatekeeper 接受
+          # （签名 + 公证 + staple 全链路的最终裁决；期望输出 "accepted"）
+          spctl -a -vv "$PKG"
 
       # ── 冒烟（§12，临时 HOME + 无 Python runner）────────────
       - name: Smoke test (R42 temp HOME)