CC-169: Turn off the Mac TestFlight ship

.github/workflows/ios-ship-contract.yml

@@ -1,34 +1,27 @@
 name: iOS ship contract
 
-# Pins the iOS and Mac auto-ship wiring (owner 2026-10-17): a merge to main that
-# touches an app's native tree, including the shared Sources/QuotaCore files its
-# targets compile, uploads a TestFlight build with no human step.  Offline and
+# Pins the iOS auto-ship wiring (owner 2026-10-17): a merge to main that
+# touches the iOS app's native tree, including the shared Sources/QuotaCore files
+# its targets compile, uploads a TestFlight build with no human step.  The Mac
+# app no longer ships to TestFlight (CC-169, owner ruling 2026-10-19).  Offline and
 # credential-free: it reads the workflow text and project.yml, and runs the
 # scheduled-gate and key-handoff shell tests.  See
-# scripts/ios-ship-workflow.test.mjs and scripts/macos-ship-workflow.test.mjs.
+# scripts/ios-ship-workflow.test.mjs.
 
 on:
   pull_request:
     paths:
       - '.github/workflows/ios-ship*.yml'
-      - '.github/workflows/macos-ship.yml'
       - 'ios/CodeCapsCompanion/project.yml'
-      - 'ios/CodeCapsCompanion/mac-appstore-profiles.json'
       - 'scripts/ios-*'
-      - 'scripts/mac-*'
-      - 'scripts/macos-ship-workflow.test.mjs'
       - 'scripts/ios-fleet/**'
       - 'scripts/test-ios-stage-asc-key.sh'
   push:
     branches: [main]
     paths:
       - '.github/workflows/ios-ship*.yml'
-      - '.github/workflows/macos-ship.yml'
       - 'ios/CodeCapsCompanion/project.yml'
-      - 'ios/CodeCapsCompanion/mac-appstore-profiles.json'
       - 'scripts/ios-*'
-      - 'scripts/mac-*'
-      - 'scripts/macos-ship-workflow.test.mjs'
       - 'scripts/ios-fleet/**'
       - 'scripts/test-ios-stage-asc-key.sh'
   workflow_dispatch:
@@ -49,6 +42,6 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Pin the auto-ship wiring
         run: |
-          node --test scripts/ios-ship-workflow.test.mjs scripts/macos-ship-workflow.test.mjs
+          node --test scripts/ios-ship-workflow.test.mjs
           bash scripts/ios-fleet/test-asc-credentials.sh
           node --test scripts/ios-fleet/test-asc-credentials.mjs

docs/IOS-TESTFLIGHT.md

@@ -31,13 +31,10 @@ The marketing version train is `1.0.N` (`marketingVersionDefault` in `scripts/io
 2. A failed run names its step.  `Load ASC credentials (Fleet-OPS prod /asc)` failing means the CI Infisical identity lost read access to Fleet-OPS `/asc`; that is an owner fix in Infisical, never a new App Store Connect key.
 3. Compare the newest processed TestFlight build against `git log -1 -- ios/CodeCapsCompanion` before saying the app is up to date.
 
-## CodeCaps For Mac (TestFlight)
+## CodeCaps For Mac (Retired From TestFlight)
 
-The Mac App Store build of CodeCaps ships the same way, from `.github/workflows/macos-ship.yml`, and `scripts/macos-ship-workflow.test.mjs` pins it in the same `iOS ship contract` check.  It was manual only until Sat, Oct 17, 2026, so merges never reached TestFlight.
+CodeCaps for Mac no longer ships to TestFlight or the Mac App Store (CC-169, owner ruling Mon, Oct 19, 2026).  The Mac app is a direct download: the Sparkle app under `Sources/`, released as a signed and notarized DMG on GitHub Releases by `.github/workflows/mac-release.yml` and linked from https://simplewithus.com/codecaps/.
 
-- **What it builds.**  The `CodeCapsCompanionMac` scheme of `ios/CodeCapsCompanion/CodeCapsCompanion.xcodeproj`, bundle `com.simplewithus.codecaps.macos`, ship key `codecaps-mac`.  It is not the SwiftPM tree under `Sources/`: that is the Sparkle app, released by `mac-release.yml` as a Developer ID build, and a change there ships no TestFlight build.
-- **What triggers it.**  The same list as the iOS ship: `ios/CodeCapsCompanion/**` plus the eight exact `Sources/QuotaCore` files the Mac app and widget targets compile, the workflow, `scripts/ios-fleet/**` (test scripts excluded) and the Mac ship and signing scripts.  A cron tick (`11,41 * * * *`) catches merges GitHub does not announce and ships only when the scheduled gate (`codecaps-mac`) finds a change under those paths since the last successful ship.  `workflow_dispatch` ships without the gate.  The contract test fails when `project.yml` and the workflow disagree.
-- **Credentials.**  The App Store Connect key comes from Fleet-OPS Infisical prod `/asc` through the same step as `ios-ship.yml` (the test fails if the two copies drift).  `IOS_DIST_P12_*` and `MAC_INSTALLER_P12_*` stay repository secrets.  The same-named repository `ASC_*` secrets are the stale copy and are not read.
-- **Versions.**  Marketing train `1.0.N` (`codecaps-mac` in `scripts/ios-fleet/apps.json`); the older `0.1.N` builds, newest `0.1.12`, stay in TestFlight and `1.0.1` is above them.  The state cache key family is `ios-fleet-state-codecaps-mac-v1-`, so the retired sequence cannot carry over.  Every upload publishes What to Test.
-- **Gates.**  The ship script keeps its rate gate and the same-HEAD skip, and the job waits for Swift CI (`Mac package build and test` and `iOS companion compile`) on the commit first.  Swift CI builds the Mac widget extension (`CodeCapsWidgetsMac`) but not the `CodeCapsCompanionMac` app target, so a break in the Mac app alone shows up in the archive step, not before it.
-- **When a Mac build is missing.**  `gh workflow view macos-ship.yml -R Simple-With-Us/CodeCaps` must say active, and the latest `main` push touching the paths above should have a run.  A failed `Load ASC credentials (Fleet-OPS prod /asc)` step is an owner fix in Infisical, never a new App Store Connect key.  Then run the fleet's TestFlight freshness check for `codecaps-mac`; its verdict says whether the newest processed build contains the newest native commit.
+- **What was removed.**  `.github/workflows/macos-ship.yml` and its contract test, the Mac App Store signing and export scripts, `mac-appstore-profiles.json`, the `codecaps-mac` entry in `scripts/ios-fleet/apps.json`, and the Apple Distribution signing overrides on the `CodeCapsCompanionMac` and `CodeCapsWidgetsMac` targets in `project.yml`.  `scripts/mac-ship-testflight.sh` remains as a stub that exits non-zero.
+- **What stays.**  The `CodeCapsCompanionMac` and `CodeCapsWidgetsMac` targets still build (Swift CI compiles the widget extension without signing), but nothing archives or uploads them.
+- **Not changed.**  The iOS ship above, and `mac-release.yml`.

ios/CodeCapsCompanion/project.yml

@@ -181,12 +181,6 @@ targets:
         ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
         GENERATE_INFOPLIST_FILE: NO
         ITSAppUsesNonExemptEncryption: false
-      # Release profiles must authorize the app group for this app ID.
-      configs:
-        Release:
-          CODE_SIGN_STYLE: Manual
-          CODE_SIGN_IDENTITY: "Apple Distribution"
-          PROVISIONING_PROFILE_SPECIFIER: "CodeCaps for Mac AppStore"
 
   CodeCapsWidgetsMac:
     type: app-extension
@@ -228,11 +222,6 @@ targets:
         CODE_SIGN_STYLE: Automatic
         GENERATE_INFOPLIST_FILE: NO
         ITSAppUsesNonExemptEncryption: false
-      configs:
-        Release:
-          CODE_SIGN_STYLE: Manual
-          CODE_SIGN_IDENTITY: "Apple Distribution"
-          PROVISIONING_PROFILE_SPECIFIER: "CodeCaps Mac Widgets AppStore"
 
 schemes:
   CodeCapsCompanion:

scripts/ios-fleet/apps.json

@@ -12,18 +12,6 @@
       "worktreeHint": "~/Code/codecaps",
       "marketingVersionDefault": "1.0.0",
       "notes": "CodeCaps Companion \u2014 iOS companion for CodeCaps AI subscription monitor. Apple ID 6814623846 registered on ASC. ASC SKU codecaps-companion-ios. Marketing train 1.0.N (the retired 0.1.N builds stay in TestFlight; 1.0.1 is above every one of them); build UTC YYYYMMDDHHMM."
-    },
-    "codecaps-mac": {
-      "displayName": "CodeCaps for Mac",
-      "bundleId": "com.simplewithus.codecaps.macos",
-      "appleId": 6814951477,
-      "platform": "macOS",
-      "scheme": "CodeCapsCompanionMac",
-      "projectRel": "ios/CodeCapsCompanion/CodeCapsCompanion.xcodeproj",
-      "xcodegenDir": "ios/CodeCapsCompanion",
-      "worktreeHint": "~/Code/codecaps",
-      "marketingVersionDefault": "1.0.0",
-      "notes": "CodeCaps Companion for Mac. Bundle ID com.simplewithus.codecaps.macos. Team CC8UTF7ATG. AppleId 6814951477. ASC SKU codecaps-macos. Marketing train 1.0.N (the retired 0.1.N builds stay in TestFlight; 1.0.1 is above every one of them); build UTC YYYYMMDDHHMM."
     }
   }
 }

scripts/ios-ship-workflow.test.mjs

@@ -196,7 +196,6 @@ test("ship state cache is keyed apart from the Mac ship", () => {
   const keys = [...code.matchAll(/ios-fleet-state-codecaps-[a-z]*-?/g)].map((m) => m[0]);
   assert.ok(keys.length >= 6, "gate and ship restore and save the state cache");
   for (const k of keys) assert.equal(k, "ios-fleet-state-codecaps-ios-", `bare prefix ${k} also matches the Mac ship cache`);
-  assert.match(read(".github/workflows/macos-ship.yml"), /ios-fleet-state-codecaps-mac-/);
 });
 
 test("the marketing train is 1.0.N and release notes use the owner clock", () => {

scripts/mac-ship-testflight.sh

@@ -1,14 +1,7 @@
 #!/usr/bin/env bash
-# Thin wrapper: ship CodeCaps for Mac to TestFlight (no Xcode UI / no Mac seat).
-set -euo pipefail
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-IN_REPO="${ROOT}/scripts/ios-fleet/ship-testflight.sh"
-MAC="/Users/jay/apps/ios-fleet/ship-testflight.sh"
-if [[ -f "$IN_REPO" ]]; then
-  exec bash "$IN_REPO" codecaps-mac --repo-root "$ROOT" "$@"
-fi
-if [[ -f "$MAC" ]]; then
-  exec bash "$MAC" codecaps-mac --repo-root "$ROOT" "$@"
-fi
-echo "error: ios-fleet ship-testflight.sh not found at ${IN_REPO} or ${MAC}" >&2
+# RETIRED (CC-169, owner ruling 2026-10-19).  CodeCaps for Mac no longer ships to
+# TestFlight or the Mac App Store;  it is a direct-download app released by
+# .github/workflows/mac-release.yml.  This stub stays only so a stale caller
+# fails loudly instead of uploading.
+echo "Mac TestFlight shipping is retired (CC-169, owner ruling 2026-10-19);  the Mac app ships as a direct-download DMG (GitHub Releases, .github/workflows/mac-release.yml)." >&2
 exit 1