[paulsenon-r]

Problem

The safe fork disables desktop OTA updates and discards the ZIP, blockmaps and update manifest. Existing ad-hoc signing also cannot preserve the identity needed for later Squirrel.Mac updates. Refs #17, phase 1.

Change

• Permit desktopAutoUpdate alongside remoteAccess.network; safe builds pin rakutenanalytics/t3code and latest, ignore custom/mock feeds and saved nightly choices, and retain administrator disablement.
• Sign release builds through system codesign, using the existing osx-sign binary ordering/entitlements support and a certificate-pinned designated requirement. Import the secret into a temporary keychain only in the main-only release environment job; PR builds receive no secrets.
• Share build steps, retain consistent DMG/ZIP filenames, publish ZIP/blockmaps/latest-mac.yml and checksums/provenance, and display the public certificate fingerprint in t3safe doctor.
• Refresh policy, host ledger and egress baseline together. Document bootstrap, overlap rotation, forward fixes and manual release dispatch; preserve these boundaries in the sync skill.

Scope and approval

Requested implementation of #17 phase 1. Only this branch push and draft PR publication are authorized. No environments, secrets, tags or releases were created, and no workflows were dispatched.

Key risk: macOS signature continuity

Squirrel.Mac copies the installed app's designated requirement and validates the candidate with nested-code and strict checks. Apple permits non-Apple certificates for codesign. #17 records a successful same-key/rotation spike and rejection of different/ad-hoc keys.

Consequently, existing ad-hoc installs need one manual installation of the first signed release. A stable leaf-pinned identity can then preserve continuity. A disposable local signing probe without trusted-certificate setup failed with no identity found; the protected runner explicitly configures that trust. Trusted-runner signing and a real previous-to-candidate Electron update are unverified, not claimed working end to end. The signed DMG check rejects an ad-hoc or wrong-key result.

Human actions required before merge/release

Follow the exact Bash commands in MAINTAINING.md:

1. Create/configure environment release; allow only branch main, with no other branch/tag rules.
2. Generate the stable key once and upload environment secrets SAFE_SIGNING_P12_PASSWORD and SAFE_SIGNING_P12_BASE64. The generation script pipes private material directly to gh secret set; only the public fingerprint is written locally.
3. Commit the generated security/signing-certificate.sha256 and its changelog entry before merge. Its current UNCONFIGURED marker intentionally blocks signing.
4. Validate trusted-runner signing and a real signed-old → signed-new update, plus wrong-key/ad-hoc rejection, before treating OTA as production-verified. Clients currently on ad-hoc builds must manually install the first signed release.
5. If a matching merge starts no release run, manually dispatch release.yml on main. Do not overwrite published assets or downgrade; ship a higher safe version.

Verification

• 54 focused tests passed: managed gates, installer/doctor, packaged policy/host fixtures, frozen stage installation and pinned build feed/filenames.
• Desktop and scripts typechecks; touched-file lint/format; shell syntax/ShellCheck; actionlint without its unrelated existing inline-shell style warning: passed.
• workflow-scan origin/main, policy-verify, egress-scan, dependency-scan --online, stage-lock-scan: passed. No dependency changes or unresolved age checks.
• Fresh PR-version desktop/server/web and single-file CLI source emission: policy/identity and artifact scans passed, zero unapproved forbidden literals. Reviewed the changed schema-URL metadata context at desktop and CLI client paths.
• Locked electron-updater fixture resolved safe.1 → safe.2 using latest-mac.yml. Public release v0.1.7-safe.1 is not a GitHub prerelease; a public asset HEAD confirmed release-assets.githubusercontent.com.
• Full local DMG packaging could not run because Rust/Cargo is absent. Native DMG/SEA builds, trusted-runner signing and real Electron update/preload smoke remain unverified. No browser or installed-app interaction performed.

Source review: DesktopUpdates.ts pins the source/channel; build-desktop-artifact.ts pins package metadata and selects the signer; release.yml scopes secrets to protected main; build-safe/action.yml preserves updater assets; import/sign scripts enforce the reviewed certificate. Baselines are review records, not an egress firewall.

Implementation: gpt-6.1-sol through the Codex harness.

Generated with Claude Code