Plan: adopt upstream managed policy + signed in-app updates #17

Context

Upstream shipped a managed policy (nightly only as of 2026-11-01, not in stable v0.1.6).
We keep this fork, embed our policy in the build, and ship signed releases that the in-app update button can install.
Start when a stable upstream release contains the policy. Work is run manually: the maintainer runs the sync skill against this issue, and postpones by hand when blocked.

Scope

1. First sync with the new process: bake the policy; build and release pipeline; update channel from this fork's signed releases.
2. Signing
   • One self-signed code-signing key in a GitHub release environment secret, restricted to main. Fork PRs cannot reach it.
   • Public cert fingerprint committed and shown by t3safe doctor.
   • Designated requirement pins that key (no root CA).
   • Plain codesign with a temporary trusted keychain first, rcodesign as fallback (pinned version + checksum + host ledger entry).
3. One-time secret setup (needs maintainer approval of the exact commands at run time)
   • Create the release environment limited to the main branch.
   • Generate key + cert straight into gh secret set with no key file on disk; print only the public fingerprint.
4. Policy: allow desktopAutoUpdate, feed pinned to this repo; matching allowlist.json and security/CHANGELOG.md lines.
5. Publishing: keep the zip, blockmap and latest-mac.yml in safe-build.yml and upload them in release.yml. Host ledger and egress baseline refresh.
6. Updater channel: version has a prerelease tag (-safe.N); force the channel to latest and verify.
7. Docs: update section; rotation runbook (overlap release signed by the old key whose requirement accepts old or new key); forward-fix-only rollback rule; public cert fingerprint.
8. CI: real-Electron smoke asserting window.desktopBridge loads; previous-release to candidate update test; release blocked if the chain breaks.

Sync skill changes

• Stable upstream tags only (never nightly); min-age applies to the upstream release itself.
• Audit the diff; ensure every new egress path is policy-gated, else patch. Map new upstream policy keys to gated / ungated / n/a.
• No dependency under min-age: if one is, postpone and record a retry-after date; check no CVE fix is held back on frozen versions; check Electron/Chromium staleness.
• Flag new install scripts, native binaries and outbound hosts.
• Audit dependency source on doubt; escalate on anything suspicious.
• Post the audit summary in the PR (no internal info, repo is public), then babysit until a human merges.

Evidence

A local spike confirmed: same-key in-place update, version jump, rejection with a different key or ad-hoc, key rotation with an overlap release, and rotation under a root CA. Unverified: plain codesign on a CI runner, GitHub asset CDN host, keychain/TCC behavior across updates.